ysk-server-shared 1.0.0 → 1.1.9

package/locales/en/updates.json

@@ -13,7 +13,9 @@
   "hourAgo": "{{n}}h ago",
   "highRiskN": "{{count}} high-risk",
   "panelUpdate": "Panel update available",
+  "footerNewVersion": "New version {{version}}",
   "riskOk": "Risk manageable",
+  "riskUnevaluated": "Not evaluated — run Scan + OSV",
   "pendingScan": "Awaiting scan",
   "packages": "Packages",
   "highRisk": "High risk",
@@ -24,6 +26,7 @@
   "reload": "Reload",
   "osvTitle": "Query OSV for top 12 suggested packages (needs network)",
   "scanOsv": "Scan + OSV",
+  "cveNotChecked": "Not checked",
   "scanPkgs": "Scan packages",
   "tabInventory": "Package inventory",
   "tabSelf": "Panel self",
@@ -72,6 +75,8 @@
   "policyTitle": "Update policy",
   "policyBody": "High-risk and CVE packages require approval before apply",
   "applyPkg": "Apply package upgrade",
+  "rebootNeeded": "reboot",
+  "kernelRebootHint": "Kernel packages need a reboot after apply",
   "applyPkgConfirm": "Upgrade {{name}}?",
   "applyPkgDesc": "Runs apt upgrade for this package on the host. Needs root + YSK_EXECUTE.",
   "lastScan": "Last scan",
@@ -82,11 +87,12 @@
   "selfCurrentShort": "Current",
   "selfLatestShort": "Latest",
   "applyPanelUpdate": "Apply panel update",
+  "applyPanelAlreadyLatest": "Already the latest panel version",
   "recheck": "Recheck",
   "aboutScope": "Scope",
-  "aboutScopeV": "ysk-server control-plane version · not full-system apt upgrade",
+  "aboutScopeV": "ysk-server panel + catalog services + runtimes + remaining apt packages",
   "aboutChannel": "Channel",
-  "aboutChannelV": "npm → GitHub release → package.json; apply via npm install -g or git (YSK_SOURCE_ROOT)",
+  "aboutChannelV": "npm package ysk-server → GitHub release → apps/server/package.json; apply: npm i -g ysk-server@version or git (YSK_SOURCE_ROOT)",
   "aboutFail": "Failures",
   "aboutFailV": "Unavailable channels are not reported as up-to-date; apply needs EXECUTE; git apply needs service restart",
   "jobsTitle": "Scheduled jobs",
@@ -97,7 +103,25 @@
   "scanPolicy": "Scan",
   "scanPolicyV": "Scan ≠ upgraded; apply changes the system",
   "highRiskPolicy": "High risk",
-  "highRiskPolicyV": "Needs approval: second confirm before send",
+  "highRiskPolicyV": "Needs approval: the Apply button opens a confirm dialog before anything is sent",
+  "needApprovalHint": "Open Available and filter to packages that need approval",
+  "applyNeedConfirm": "Opens a confirm dialog before applying",
+  "probeFailed": "Probe failed",
+  "notViaApt": "Not managed by apt — no candidate",
+  "noCandidate": "No candidate from package manager",
+  "cveLabel": "CVE",
+  "jobOpenGeo": "GeoIP page",
+  "job": {
+    "protection_probe": { "name": "Protection probe", "hint": "Periodic defense signals" },
+    "updates_scan": { "name": "Updates scan", "hint": "Refresh package inventory" },
+    "daily_backup": { "name": "Daily backup", "hint": "Scheduled backup all" },
+    "db_temp_expire": { "name": "Expire temp DB users", "hint": "Drop expired temporary database users" },
+    "defense_auto_ban": { "name": "Defense auto-ban", "hint": "Apply auto-ban tick" },
+    "defense_geoip_update": { "name": "GeoIP update", "hint": "Download GeoIP databases" },
+    "log_auto_vacuum": { "name": "Log vacuum", "hint": "journald retention" },
+    "email_dnsbl": { "name": "Email DNSBL", "hint": "Mail DNSBL check" },
+    "validators_upgrade_scan": { "name": "Validators upgrade scan", "hint": "Check validator image / binary updates" }
+  },
   "permPolicy": "Permissions",
   "permPolicyV": "Without EXECUTE/root → blocked (no fake success)",
   "osvPolicyV": "Needs network; enriches top 12 suggestions only",
@@ -122,6 +146,9 @@
   "updateFailed": "Update failed",
   "updateIncomplete": "Update incomplete",
   "appliedUpdate": "Update applied",
+  "panelRestarting": "Panel is restarting to load the new version…",
+  "panelRestarted": "Panel is back · {{version}}",
+  "panelRestartWait": "Panel apply finished. If this page does not refresh, reload after a few seconds.",
   "aptCandidate": "apt Candidate",
   "advice": {
     "update": "Update recommended",
@@ -163,5 +190,24 @@
   "scanNow": "Scan now",
   "viewUpgradable": "View upgradable",
   "installElsewhere": "To install packages (Nginx, PHP, databases…), open the matching feature page — not this hub.",
-  "status": "Status"
+  "status": "Status",
+  "groupService": "Services",
+  "groupRuntime": "Runtimes",
+  "groupOs": "System packages",
+  "notInstalled": "Not installed",
+  "goToPage": "Open page",
+  "hubHint": "Catalog software and runtimes on this host. Scan to refresh.",
+  "intervalDay": "every day",
+  "intervalDays": "every {{n}} days",
+  "intervalHour": "every hour",
+  "intervalHours": "every {{n}} hours",
+  "intervalMinutes": "every {{n}} minutes",
+  "intervalSeconds": "every {{n}} seconds",
+  "availableHint": "Packages with a newer candidate from the package manager.",
+  "servicesHint": "Catalog services on this host. Open the service page to install.",
+  "runtimeHint": "Runtimes on this host. Version upgrades are done on each runtime page.",
+  "needsReboot": "Reboot needed",
+  "kernelRebootWarn": "Installing a new kernel usually needs a reboot before it is used.",
+  "neverRun": "not run yet",
+  "scanOsvN": "Scan + OSV (first {{n}})"
 }

package/locales/en/users.json

@@ -4,12 +4,17 @@
   "packages": "Packages",
   "suspended": "Suspended",
   "securityCenter": "Security center",
+  "singleAdminNo2fa": "This host has a single admin and 2FA is off. Enable admin 2FA under Security, then add a backup admin on this page.",
+  "enableAdmin2fa": "Enable admin 2FA",
+  "addBackupAdmin": "Add a backup admin",
   "loading": "Loading users & packages…",
   "userList": "Users ({{count}})",
   "userListDesc": "Open detail to edit role, password, package, overrides",
   "createUser": "Create user",
+  "operatorHighRiskHint": "The factory operator role includes high-risk writes (services, firewall, package apply, MySQL, Nginx publish). Narrow it only if you intend to change every existing operator.",
   "createUserPlus": "+ Create user",
   "searchPh": "Username / role / package",
+  "searchPkgPh": "Package name",
   "searchUsersAria": "Search users",
   "user": "User",
   "roles": "Roles",
@@ -19,6 +24,9 @@
   "resume": "Resume",
   "suspend": "Suspend",
   "impersonate": "Impersonate",
+  "impersonateHint": "Opens a session as this user. Use the account menu to leave impersonation.",
+  "cannotDeleteSelf": "You cannot delete your own account here",
+  "cannotImpersonateSelf": "You are already signed in as this account",
   "openDetail": "Details",
   "edit": "Edit",
   "resetPassword": "Reset password",
@@ -118,5 +126,16 @@
   "securityClearTotpHint": "Requires step-up",
   "securityClearConfirm": "Type the username to confirm clearing 2FA",
   "securityClearOk": "Cleared 2FA for {{name}}",
-  "securitySelfNote": "To set up your own 2FA, open Security → My security."
+  "securitySelfNote": "To set up your own 2FA, open Security → My security.",
+  "cannotDeleteSelf": "You cannot delete the signed-in account",
+  "cannotModifySelf": "You cannot suspend or demote the signed-in account",
+  "cannotDeleteLastAdmin": "Cannot delete the last admin",
+  "cannotDemoteLastAdmin": "Cannot suspend or demote the last admin",
+  "lockSelfHint": "This is the signed-in account. Delete, suspend, and role change are blocked to prevent lock-out.",
+  "lockLastAdminHint": "This is the last admin. Delete, suspend, and demotion are blocked.",
+  "demoteAdminTitle": "Demote this admin?",
+  "demoteAdminDesc": "This user will lose full admin access. Confirm only if another admin remains.",
+  "quotaNonNeg": "Counts and quotas cannot be negative.",
+  "diskQuotaHint": "Presets are GiB; custom box is MiB.",
+  "bandwidthHint": "0 means unlimited."
 }

package/locales/en/validators.json

@@ -0,0 +1,325 @@
+{
+  "title": "Validators (Beta)",
+  "subtitle": "Install and manage L1 nodes on this host. Non-custodial — you keep the keys.",
+  "beta": "Beta",
+  "tab": {
+    "nodes": "Nodes",
+    "disk": "Disk",
+    "stack": "Software",
+    "about": "About"
+  },
+  "empty": {
+    "title": "No validator nodes yet",
+    "desc": "Create a testnet node in a few clicks."
+  },
+  "refresh": "Refresh",
+  "software": {
+    "engine": "Docker Engine",
+    "engineDesc": "Validator nodes run as Compose projects. Install Docker here if it is missing. Image prune stays on the Docker page.",
+    "client": "Client",
+    "image": "Image",
+    "present": "Local",
+    "local": "Pulled",
+    "missing": "Not pulled",
+    "size": "Size",
+    "usedBy": "Used by",
+    "unused": "No instance",
+    "pull": "Pull",
+    "pulling": "Pull {{ref}}",
+    "empty": "No pinned client images",
+    "emptyDesc": "The catalog is empty. This should not happen.",
+    "daemonDown": "Docker Engine is not running"
+  },
+  "disk": {
+    "title": "Validator disk",
+    "root": "Data directory",
+    "free": "Free",
+    "used": "Validator data",
+    "fsUsed": "Filesystem used",
+    "leftoverTitle": "Leftover data ({{count}})",
+    "leftoverEmpty": "No leftover instance directories",
+    "leftoverDesc": "Directories under the validators root that are not a store instance. Remove only after you confirm they are unused.",
+    "leftoverRemove": "Remove",
+    "leftoverRemoveTitle": "Delete leftover validator data?",
+    "leftoverRemoveDesc": "Permanently delete {{path}} from disk. This is not a listed node.",
+    "browseRoot": "Open in file browser",
+    "none": "No instance data yet",
+    "warn": "Disk usage is high (70%+)",
+    "danger": "Disk usage is critical (85%+)",
+    "autoClear": "Auto-clear the largest stopped instance when disk is critical (off by default)",
+    "autoClearRisk": "Destructive: the largest stopped instance is deleted without a further prompt. Default is off. Check audit / logs after it fires.",
+    "autoClearConfirmTitle": "Enable auto-clear?",
+    "autoClearC1": "When disk is critical, the largest stopped instance is deleted without asking again.",
+    "autoClearThreshold": "Trigger: filesystem use at or above 85%.",
+    "autoClearCandidate": "Current candidate: {{id}}",
+    "autoClearNone": "No stopped instance is a candidate right now."
+  },
+  "chain": {
+    "eth": "Ethereum",
+    "avax": "Avalanche",
+    "near": "NEAR",
+    "ada": "Cardano",
+    "btc": "Bitcoin",
+    "cosmos": "Cosmos Hub",
+    "sui": "Sui",
+    "aptos": "Aptos",
+    "dot": "Polkadot",
+    "sol": "Solana"
+  },
+  "network": {
+    "hoodi": "Hoodi",
+    "sepolia": "Sepolia",
+    "mainnet": "Mainnet",
+    "fuji": "Fuji",
+    "testnet": "Testnet",
+    "preview": "Preview",
+    "preprod": "Preprod",
+    "westend": "Westend"
+  },
+  "networkKind": {
+    "testnet": "Testnet",
+    "mainnet": "Mainnet",
+    "mixed": "Mainnet + testnet"
+  },
+  "profile": {
+    "minimal": "Minimal",
+    "pruned": "Pruned",
+    "validator-ready": "Validator-ready",
+    "rpc": "RPC"
+  },
+  "profileHelp": {
+    "title": "Profiles",
+    "desc": "The four choices on wizard step 3 are mainly disk budget and role. Each chain shows its recommended size in the wizard. The panel never holds staking keys.",
+    "minimal": "Smallest disk. Use for testnets or a first install. Not a full history, and not for a live staking validator.",
+    "pruned": "Keeps recent chain state and drops older blocks (Pruned). More disk than Minimal, less than a full node. Use to follow the tip long-term.",
+    "validatorReady": "Reserves more disk so you can later attest or propose as a validator. Generate keys offline yourself. Being offline or misconfigured can lose stake.",
+    "rpc": "For this host or other services to query the chain. RPC listens on 127.0.0.1 by default and is not published to the internet."
+  },
+  "col": {
+    "id": "ID",
+    "chain": "Chain",
+    "network": "Network",
+    "profile": "Profile",
+    "status": "Status",
+    "disk": "Disk"
+  },
+  "cli": {
+    "usage": "Usage: ysk-server validators list|chains|disk|get|status|logs|create|start|stop|restart|clear|upgrade|policy|mithril|prune|switch-network|snapshot|compose|settings [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--data-path P] [--rpc-port N] [--id ID] [--upgrade POLICY] [--confirm TOKEN] [--accept-low-disk] [--execute] [--json]"
+  },
+  "clients": {
+    "el": "Execution client",
+    "cl": "Consensus client"
+  },
+  "mithril": {
+    "label": "Restore from Mithril snapshot first (recommended on testnet)",
+    "action": "Restore with Mithril"
+  },
+  "errors": {
+    "notFound": "Validator instance not found",
+    "invalidId": "Invalid instance id",
+    "diskLow": "Not enough free disk for this chain, network, and profile",
+    "diskUnknownMainnet": "Cannot measure free disk; refusing mainnet create",
+    "needDocker": "Docker Compose is required and was not found",
+    "composeFailed": "docker compose failed",
+    "needConfirm": "Clear requires confirm=instance id or CLEAR",
+    "mithrilAdaOnly": "Mithril restore is only available for Cardano",
+    "needMithrilConfirm": "Mithril requires confirm=instance id or MITHRIL",
+    "mithrilBlocked": "Mithril docker run was blocked by the allowlist",
+    "mithrilKey": "Could not load the Mithril genesis verification key",
+    "mithrilFailed": "Mithril snapshot download failed",
+    "pruneFailed": "Prune failed",
+    "switchNeedStop": "Stop the node before switching network",
+    "switchNeedClear": "Switching network clears chain data. Confirm with instance id or CLEAR",
+    "composeMissing": "Compose file not found",
+    "composeNotManaged": "Refusing to write a compose file that is not YSK-managed",
+    "badDataPath": "Data path must be an absolute directory outside system paths",
+    "portInUse": "That RPC port is already used by another validator instance",
+    "snapshotUnsupported": "No allowlisted snapshot source for this chain",
+    "snapshotLookup": "Could not resolve the official snapshot pointer",
+    "needSnapshotConfirm": "Snapshot restore requires confirm=instance id or SNAPSHOT",
+    "snapshotBlocked": "Snapshot docker run was blocked by the allowlist",
+    "snapshotFailed": "Snapshot download or extract failed"
+  },
+  "notes": {
+    "beta": "This feature is Beta. Host changes need root and YSK_EXECUTE=1.",
+    "noKeys": "YSK Server never generates or stores staking keys.",
+    "dockerSoon": "Install and start from this page wizard. Host changes need root and YSK_EXECUTE=1.",
+    "dryCreate": "Wrote instance spec and compose (dry-run). Pass --execute and YSK_EXECUTE=1 to start containers.",
+    "dryStart": "Start is dry-run. Pass --execute and YSK_EXECUTE=1.",
+    "dryStop": "Stop is dry-run. Pass --execute and YSK_EXECUTE=1.",
+    "dryClear": "Clear is dry-run. Pass --execute and YSK_EXECUTE=1.",
+    "created": "Node created and compose started",
+    "started": "Node started",
+    "stopped": "Node stopped",
+    "cleared": "Chain data cleared",
+    "dryMithril": "Mithril restore is dry-run. Pass --execute and YSK_EXECUTE=1.",
+    "mithril": "Mithril snapshot restored; node restarted",
+    "dryPrune": "Prune is dry-run. Pass --execute and YSK_EXECUTE=1.",
+    "pruned": "Unused project images pruned",
+    "pruneProfile": "Client-native prune is the pruned/minimal profile. Recreate to change it.",
+    "sameNetwork": "Already on that network",
+    "drySwitch": "Network switch is dry-run.",
+    "switched": "Network switched and chain data cleared",
+    "dryCompose": "Would write compose.yml",
+    "composeWrote": "Wrote compose.yml",
+    "statsEmpty": "No running containers to measure",
+    "autoClearNone": "No stopped instance to auto-clear",
+    "drySnapshot": "Snapshot restore is dry-run. Pass --execute and YSK_EXECUTE=1.",
+    "snapshotEthEl": "Restored ethPandaOps EL archive and reset CL for checkpoint sync",
+    "snapshotEthCl": "Reset CL data for official checkpoint sync",
+    "snapshotNear": "Wiped NEAR data; compose will re-init official genesis and epoch sync",
+    "nativePrune": "Ran the client-native prune command",
+    "dryDelete": "Delete is dry-run. Pass --execute and YSK_EXECUTE=1.",
+    "deleted": "Node deleted",
+    "leftoverRemoved": "Removed leftover {{path}}"
+  },
+  "create": "Create node",
+  "wizard": {
+    "title": "Create node",
+    "stepOf": "Step {{n}} / {{total}}",
+    "stepChain": "Chain",
+    "stepNetwork": "Network",
+    "stepProfile": "Profile",
+    "stepSummary": "Summary",
+    "needDocker": "Docker Engine is not installed. Install it first — this button stays disabled.",
+    "diskNeed": "This profile needs about {{need}} · free {{free}}",
+    "diskNeedNetwork": "Default (Minimal) for this network needs about {{need}} · free {{free}}",
+    "profileHint": {
+      "minimal": "Smallest sync — light disk, not for staking.",
+      "pruned": "Keeps recent history only (Pruned). Smaller than archive, still usable for RPC.",
+      "validator-ready": "Sized for a staking validator. Needs more disk than Minimal.",
+      "rpc": "Public RPC node — not a staking validator."
+    },
+    "diskShort": "Not enough free disk for this chain / network / profile",
+    "diskShortDetail": "Need {{need}} · free {{free}} · short {{short}}",
+    "needCustomPath": "Enter an absolute data path",
+    "previewId": "Node id",
+    "previewCompose": "Compose project",
+    "profileSeeAbout": "What each profile means is on the About tab.",
+    "back": "Back",
+    "next": "Next",
+    "install": "Install",
+    "mainnetWarn": "Mainnet needs a lot of free disk (ETH often 800 GiB+). Testnet is recommended.",
+    "mainnetAck": "Create the mainnet node. I understand it needs a lot of disk, and a staking validator can lose stake if it is offline or misconfigured.",
+    "lowDiskAcked": "Free disk is below the recommended size. You confirmed create anyway; sync may stop if the disk fills.",
+    "heavyWarn": "This chain is heavy (large disk and high IOPS). Mainnet Solana typically needs 2 TiB+.",
+    "memory": "Memory limit",
+    "cpus": "CPU limit",
+    "dataPath": "Data path",
+    "rpcPort": "RPC port",
+    "limitNone": "No limit",
+    "rpcDefault": "Default",
+    "customPath": "Use a custom data path",
+    "installConfirmTitle": "Install this node?",
+    "installConfirmDesc": "{{chain}} · {{network}} · {{profile}}. About {{disk}} of disk. The image pull can take a long time.",
+    "installC1": "Several gigabytes of images may be downloaded.",
+    "installC2": "You can cancel the panel task; already-pulled images are not deleted automatically.",
+    "dockerAbout": "Docker Engine is required to install and start nodes.",
+    "dockerAboutOk": "Docker Engine is installed.",
+    "dockerAboutMissing": "Docker Engine is not installed. Open Docker to install it.",
+    "rewriteCompose": "Rewrite compose",
+    "rewriteComposeTitle": "Rewrite compose.yml from the current adapter?",
+    "rewriteComposeDesc": "Overwrites the generated compose for {{id}} using the shipped flags for this chain.",
+    "chainMeta": "{{disk}} min · {{clients}} clients"
+  },
+  "actions": {
+    "detail": "Details",
+    "start": "Start",
+    "stop": "Stop",
+    "restart": "Restart",
+    "clear": "Clear",
+    "upgrade": "Upgrade",
+    "clearConfirm": "Type instance id or CLEAR",
+    "prune": "Prune",
+    "switchNetwork": "Switch network",
+    "removeUnit": "Also remove compose / instance record",
+    "restoreAfter": "Restore snapshot after clear",
+    "delete": "Delete",
+    "deleteTitle": "Delete {{id}}",
+    "deleteDesc": "This removes the node from the panel.",
+    "deleteC1": "Docker Compose is stopped and removed",
+    "deleteC2": "Chain data on disk is deleted",
+    "deleteC3": "The instance record is removed",
+    "pruneTitle": "Prune unused images",
+    "pruneDesc": "Type the instance id to prune unused Compose images for this node.",
+    "pruneC1": "Unused images labelled for this Compose project are deleted.",
+    "clearTitle": "Clear {{id}}",
+    "clearC1": "Chain data on disk is deleted.",
+    "clearC2": "The instance stays in the panel, stopped and empty.",
+    "switchTitle": "Switch network",
+    "switchC1": "The node is stopped and chain data is wiped before the new network is written."
+  },
+  "policy": {
+    "label": "Upgrade policy",
+    "manual": "Manual",
+    "notify": "Notify",
+    "auto-safe": "Auto (safe)",
+    "auto-all": "Auto (all)"
+  },
+  "logs": {
+    "empty": "No logs yet",
+    "follow": "Follow logs"
+  },
+  "compose": {
+    "label": "Compose file",
+    "save": "Save compose"
+  },
+  "snapshot": {
+    "action": "Restore snapshot",
+    "mithril": "Cardano uses Mithril for certified snapshot restore.",
+    "eth": "Ethereum mainnet uses official checkpoint sync on the consensus client. EL continues snap sync.",
+    "ethEl": "Hoodi/Sepolia can restore an ethPandaOps EL archive, then checkpoint-sync the CL.",
+    "avax": "Avalanche uses state-sync in the compose profile.",
+    "near": "Official free NEAR tarball snapshots were retired. Restore wipes data and uses official genesis plus epoch sync.",
+    "none": "No snapshot source is configured for this chain."
+  },
+  "stake": {
+    "title": "Prepare for staking (you keep the keys)",
+    "offlineKeys": "Generate keys offline. The panel never stores them.",
+    "deposit": "Complete deposit / registration on the official launchpad.",
+    "withdrawal": "Set withdrawal credentials yourself.",
+    "monitor": "Watch disk, peers, and upgrade badges on this page."
+  },
+  "alerts": {
+    "diskTitle": "Validator disk critical",
+    "diskBody": "Free space on the validator data volume is critically low.",
+    "upgradeTitle": "Validator upgrade available",
+    "upgradeBody": "One or more node clients have a newer pinned version.",
+    "syncTitle": "Validator node needs attention",
+    "syncBody": "A node has been syncing for more than 6 hours or reported an error.",
+    "rollbackTitle": "Validator upgrade rolled back",
+    "rollbackBody": "Upgrade of {{id}} failed the health check and was rolled back."
+  },
+  "upgrade": {
+    "changelog": "Changelog"
+  },
+  "readiness": {
+    "dockerTitle": "Docker for validator nodes",
+    "dockerOk": "{{count}} validator instance(s); Docker is installed",
+    "dockerMissing": "Validator instances exist but the docker binary was not found"
+  },
+  "detail": {
+    "status": "Status",
+    "sync": "Sync",
+    "peers": "Peers",
+    "version": "Version",
+    "access": "Access",
+    "upgrade": "Updates",
+    "upgradeHint": "How this node tracks client versions.",
+    "network": "Network",
+    "networkHint": "Switching network stops the node and clears chain data. Confirm under Clear data first.",
+    "maintain": "Maintenance",
+    "danger": "Clear data",
+    "dangerHint": "Type the instance id or CLEAR. This deletes chain data on disk.",
+    "compose": "Compose",
+    "logs": "Logs"
+  },
+  "state": {
+    "unknown": "Unknown",
+    "stopped": "Stopped",
+    "starting": "Starting",
+    "running": "Running",
+    "syncing": "Syncing",
+    "error": "Error"
+  }
+}

package/locales/en/vnc.json

@@ -119,15 +119,19 @@
   },
   "installHint": "TigerVNC → noVNC; XFCE optional",
   "needTigerVnc": "TigerVNC required",
+  "needXfceFirst": "Install XFCE first",
+  "needSessionRunning": "Session is not running — start it first",
   "needNovnc": "noVNC required",
   "needXfce": "XFCE (optional)",
   "needViewer": "Viewer (optional)",
   "needViewerOrNovnc": "Viewer or noVNC",
   "settingsHint": "Defaults for new accounts",
+  "settingsNeedStack": "These defaults apply when TigerVNC (and XFCE if selected) are installed. Install them on the Install tab first.",
+  "clientNeedNovnc": "Open in browser needs noVNC. Install it on the Install tab before adding remotes you expect to open here.",
   "defaultDesktop": "Default desktop",
   "defaultGeometry": "Default resolution",
   "defaultDepth": "Colour depth",
-  "defaultRfbBind": "RFB listen",
+  "defaultRfbBind": "VNC (RFB) listen range",
   "defaultAutostart": "Autostart sessions",
   "autostartLabel": "Start on boot",
   "settingsSaved": "VNC defaults saved",
@@ -169,6 +173,13 @@
   "start": "Start",
   "stop": "Stop",
   "startAfterCreate": "Start after create",
+  "hostnameBroken": "This host cannot resolve its own hostname ({{hostname}}). Session start will fail.",
+  "hostnameBrokenIdle": "No VNC sessions yet. Hostname {{hostname}} does not resolve — you can write /etc/hosts later if you create a session.",
+  "hostnameFix": "Write hostname to /etc/hosts",
+  "hostnameFixTitle": "Append this line to /etc/hosts?",
+  "hostnameFixDesc": "{{line}}",
+  "hostnameFixDone": "Hostname /etc/hosts updated",
+  "startAfterCreateBlocked": "Disabled until the hostname resolves",
   "colName": "Name",
   "colLinuxUser": "Linux user",
   "colDisplay": "Display / port",
@@ -194,12 +205,16 @@
   "nextPage": "Next",
   "pageOf": "Page {{page}} / {{total}} · {{count}}",
   "deleteAccountTitle": "Delete VNC account?",
-  "deleteAccountDesc": "Remove control-plane account {{name}} ({{user}}). Session will be stopped first.",
-  "deleteAccountC1": "VNC session for this display",
-  "deleteAccountC2": "Panel metadata under dataDir/vnc",
-  "deleteAccountC3User": "Linux user home will be removed (userdel -r)",
-  "deleteAccountC3Keep": "Linux user will be kept on the system",
+  "deleteAccountDesc": "Remove control-plane account “{{name}}” (Linux user {{user}}). The VNC session for this display stops first.",
+  "deleteAccountC1": "The VNC session for this account will be stopped first.",
+  "deleteAccountC2": "The panel VNC account record will be removed.",
+  "deleteAccountC3User": "The Linux user and home directory will also be removed. If the host refuses, the panel reports failure and the user stays.",
+  "deleteAccountC3Keep": "The Linux user stays on the host; only the panel account is removed.",
   "removeLinuxUser": "Also remove Linux user and home directory",
+  "deleteKeepUserWarn": "The Linux user will stay on the host as an orphan. You must clean it up later.",
+  "bindRfbLine": "RFB {{bind}} :{{port}}",
+  "bindNovncLine": "noVNC 127.0.0.1:{{port}}",
+  "bindNovncHint": "noVNC listens on localhost. The desktop is reached through this panel, not the public internet, unless RFB bind is all interfaces.",
   "connection": "Connect",
   "connectionTitle": "Connection materials",
   "connectionDesc": "How clients reach {{name}}",
@@ -242,5 +257,6 @@
   "stackMissingShort": "Not installed",
   "editClientTitle": "Edit remote client",
   "editClientDesc": "Update path, hosts, and optional stored password.",
-  "clientUpdated": "Client profile updated"
+  "clientUpdated": "Client profile updated",
+  "rememberNeedPassword": "Enter a password first."
 }

package/locales/en/vpn.json

@@ -61,6 +61,11 @@
   "ensureServer": "Apply server",
   "openFirewall": "Open {{port}}/{{proto}}",
   "presets": "Port presets",
+  "portHint": {
+    "51820": "Default WireGuard listen port",
+    "51821": "Alternate WireGuard listen port",
+    "51822": "Second alternate WireGuard listen port"
+  },
   "proto": "Protocol",
   "protoUdp": "UDP",
   "protoTcp": "TCP",
@@ -70,8 +75,16 @@
   "peersTitleOvpn": "Client configs",
   "peersTitleSs": "Access keys",
   "peerName": "Name",
-  "peerNamePlaceholder": "phone",
+  "peerNamePlaceholder": "office-laptop",
   "addPeer": "+ Add",
+  "installEngineFirst": "Install the VPN engine first",
+  "needServerRunning": "{{engine}} is not running — apply the server first",
+  "engineSummarySoftware": "{{installed}} installed · {{running}} running",
+  "privateKeyOnce": "The client private key is shown only here. Download or copy it now — it cannot be recovered later.",
+  "showPrivateKey": "Show private key",
+  "hidePrivateKey": "Hide private key",
+  "deletePeerTitle": "Delete peer {{name}}?",
+  "deletePeerDesc": "Remove {{name}} ({{address}}). The client disconnects immediately and the config cannot be restored. The WireGuard server stays up.",
   "addPeerWg": "+ Add peer",
   "addPeerOvpn": "+ Add client",
   "addPeerSs": "+ Add key",
@@ -127,5 +140,7 @@
     "lanCidrs": "LAN networks",
     "customCidr": "CIDR",
     "addCidr": "Add"
-  }
+  },
+  "engineNotInstalled": "This VPN engine is not installed on the host.",
+  "serverNotListening": "Server unit is not active. UDP/TCP {{port}} may be closed."
 }

package/locales/es/agents.json

@@ -11,7 +11,9 @@
     "failed": "Fallido",
     "error": "Error",
     "unknown": "No investigado",
-    "fallback": "Desconocido"
+    "fallback": "Desconocido",
+    "activating": "Starting",
+    "stuck": "Start stuck"
   },
   "liveN": "{{count}} en línea",
   "registeredOnly": "Sólo registrado",
@@ -126,5 +128,18 @@
   "labelStderr": "stderr",
   "labelAckCli": "reconocimiento + CLI JSON",
   "labelStdoutBody": "Cuerpo de salida estándar CLI",
-  "resultOuterHint": "El resultado externo es CLI --json stdout."
+  "resultOuterHint": "El resultado externo es CLI --json stdout.",
+  "statusFlowTitle": "Flujo de estado",
+  "statusFlow": "Solo registrado → en línea → obsoleto (>60 s) → fuera de línea (desconectado). El filtro \"Sin conexión\" está desconectado.",
+  "colSession": "UUID de sesión",
+  "copySession": "Copiar UUID de sesión para clúster/CLI --session",
+  "staleFor": "Invisible {{age}}",
+  "commandTitle": "Poner en cola un comando para esta sesión",
+  "historyTitleShort": "Abrir historial de comandos (solo lectura)",
+  "expEdge": "En un borde:",
+  "noteAllowlist": "Agent tool calls must pass the allowlist.",
+  "noteRbacCap": "Agent role is capped at write-low.",
+  "journal": "journal",
+  "activatingStuckHint": "Activating longer than 5 minutes — treated as failed. Check journal.",
+  "noOnlineAgents": "No agents online"
 }

package/locales/es/apache.json

@@ -53,5 +53,11 @@
   "cleanupConflicts": "Limpiar los residuos del conflicto",
   "cleanupConflictsTitle": "¿Limpiar todos los residuos del conflicto?",
   "cleanupConflictsDesc": "Elimine todas las configuraciones de artefactos en el disco que entren en conflicto con un proyecto o un nombre de servidor independiente. Se mantienen las filas del proyecto.",
-  "artifactRemovedOk": "Configuración residual eliminada"
+  "artifactRemovedOk": "Configuración residual eliminada",
+  "sslTerminatedUpstream": "TLS termina al frente de Nginx",
+  "removeArtifactHint": "Borra solo este conf residual en disco. No elimina el proyecto.",
+  "sourceOrphan": "Leftover",
+  "orphanSite": "Project gone",
+  "pillSitesSplit": "{{n}} sites · {{leftover}} leftover",
+  "stopSites": "{{n}} site(s) will stop answering HTTP."
 }

package/locales/es/audit.json

@@ -22,6 +22,9 @@
     "project.publish": "Publicar Nginx",
     "project.suspend": "Suspender proyecto",
     "software.install": "instalar software",
-    "software.update": "Actualizar software"
+    "software.update": "Actualizar software",
+    "backup.restore": "Backup restore",
+    "backup.run": "Backup run",
+    "backup.delete": "Backup deleted"
   }
 }