ysk-server-shared 1.0.0

package/locales/en/protection.json

@@ -0,0 +1,348 @@
+{
+  "levels": {
+    "low": {
+      "label": "OK",
+      "verb": "System steady",
+      "hint": "Keep daily protection"
+    },
+    "elevated": {
+      "label": "Elevated",
+      "verb": "Anomalies seen",
+      "hint": "Switch to hardened and watch suspect IPs"
+    },
+    "under_attack": {
+      "label": "Under attack",
+      "verb": "Likely under attack",
+      "hint": "Apply under-attack preset + bulk ban"
+    },
+    "critical": {
+      "label": "Critical",
+      "verb": "Severe threat",
+      "hint": "Consider emergency; ensure you are whitelisted"
+    }
+  },
+  "presetsWhen": {
+    "daily": "Day-to-day",
+    "hardened": "Scan / brute",
+    "under_attack": "L7 flood",
+    "emergency": "Last resort"
+  },
+  "note": {
+    "notApplied": "Not applied on host (needs root + YSK_EXECUTE=1) — saved to panel settings",
+    "nginxWritten": "Wrote Nginx rate-limit panel file",
+    "f2bWritten": "Wrote fail2ban panel settings"
+  },
+  "rel": {
+    "justNow": "Just now",
+    "minutesAgo": "{{n}} min ago",
+    "hoursAgo": "{{n}} h ago"
+  },
+  "apiUnreachable": "Cannot reach API (web proxy/backend may be down)",
+  "geoipLoadFailed": "Failed to load GeoIP",
+  "loadFailed": "Load failed",
+  "previewDone": "Preview done (not written)",
+  "presetApplied": "Protection preset applied",
+  "manualBan": "Manual ban",
+  "banSent": "Ban sent for {{ip}}",
+  "quickSelectBan": "Quick-select ban",
+  "bulkBan": "Bulk ban {{count}}",
+  "autoBanStatus": "Auto-ban: {{onOff}} · {{mode}} · {{method}}",
+  "autoBanUpdated": "Auto-ban updated",
+  "automationMaster": "Automation master: {{onOff}}",
+  "autoPresetStatus": "Auto preset: {{onOff}}",
+  "autoBanAutomation": "Auto-ban: {{onOff}} ({{mode}})",
+  "automationSaved": "Automation settings saved",
+  "statFirewall": "Firewall",
+  "statAutoBan": "Auto-ban",
+  "statApply": "System apply",
+  "statActiveBans": "Active bans",
+  "statPreset": "Preset",
+  "threatPill": "Threat {{label}} · score {{score}}",
+  "reprobed": "Re-probed",
+  "loadingStatus": "Loading protection status…",
+  "tabs": {
+    "command": "Response",
+    "automation": "Automation",
+    "bans": "Bans",
+    "geo": "IP access",
+    "stack": "Stack",
+    "intel": "Intel",
+    "about": "About"
+  },
+  "reapply": "Re-apply",
+  "nginxLimits": "Nginx rate limits",
+  "notWritten": "Not written",
+  "mode": "Mode",
+  "controlPlane": "Control plane",
+  "canApply": "Can apply",
+  "needRoot": "Needs root",
+  "writeOnly": "Write file only",
+  "autoRunning": "Running · every {{sec}}s · bans this hour {{n}}",
+  "autoOffManual": "Off — manual only",
+  "lastTick": "· last {{t}}",
+  "nextTick": "· next {{t}}",
+  "on": "On",
+  "off": "Off",
+  "open": "Open",
+  "ranAutomationTick": "Ran one automation tick",
+  "escalateHardened": "Hardened ≥ score",
+  "escalateAttack": "Under attack ≥ score",
+  "deescalateDaily": "Back to daily < score",
+  "zeroOff": "0 off",
+  "holdAfterEscalate": "Min hold after escalate",
+  "min5": "5 min",
+  "min15": "15 min",
+  "min30": "30 min",
+  "hour1": "1 h",
+  "hour2": "2 h",
+  "hour6": "6 h",
+  "presetOrCustom": "Preset / custom",
+  "autoBanMode": "Auto-ban mode",
+  "soft": "Soft",
+  "normal": "Normal",
+  "aggressive": "Aggressive",
+  "custom": "Custom",
+  "method": "Method",
+  "banMethod": "Ban method",
+  "both": "Both",
+  "scoreGte": "Score ≥",
+  "hitsGte": "Request hits ≥",
+  "hits429Gte": "429-related hits ≥",
+  "scanHitsGte": "Scan-path hits ≥",
+  "cooldown": "Cooldown",
+  "maxPerHour": "Max per hour",
+  "scanInterval": "Scan interval",
+  "schedulerDefault": "scheduler default 120s",
+  "collapse": "Collapse",
+  "expand": "Expand",
+  "step": "Step",
+  "mechanism": "Mechanism",
+  "youCanTune": "You can tune",
+  "probe": "Probe",
+  "probeSignals": "WAN / req rate / TCP / f2b / UFW",
+  "escalateThreshold": "Escalate threshold",
+  "emergency": "Emergency",
+  "neverAuto": "Never auto",
+  "manualEmergency": "Manual EMERGENCY",
+  "signalNetworkDown": "WAN down",
+  "signalHighReq": "High request rate",
+  "signalDdos": "DDoS heuristic",
+  "signalTcp": "TCP connections",
+  "signalUfwOff": "UFW off",
+  "signalF2bBans": "fail2ban ban count",
+  "weightHint": "{{label}} weight 0–3",
+  "detected": "(detected)",
+  "notSet": "(not set)",
+  "zonesComma": "Zones (comma-separated)",
+  "underAttackRequested": "Under Attack requested",
+  "underAttackCleared": "Clear UA requested",
+  "autoBanOpen": "On · {{mode}} · this hour {{n}}/{{max}}",
+  "autoBanClosed": "Off — manual/list only",
+  "pausedNoExecute": "· paused (no EXECUTE)",
+  "circuitOpen": "· circuit open",
+  "autoBanModeLabel": "Auto-ban mode",
+  "scanned": "Scanned",
+  "bulkOps": "Bulk actions",
+  "fromAccessLog": "From access log · one-click or bulk ban",
+  "noSuspectIps": "No suspect IPs for now",
+  "noSuspectDesc": "Appears when scan/429 traffic is seen. Expand for manual ban.",
+  "whitelistPlus": "Whitelist + {{ip}}",
+  "whitelistAdded": "Added to whitelist",
+  "activeBansTitle": "Active bans ({{count}})",
+  "activeBansDesc": "Protection aggregate · unban via defense API (same as fail2ban-client)",
+  "source": "Source",
+  "unbanned": "Unbanned",
+  "noBans": "No bans",
+  "noBansDesc": "Bans show here",
+  "collapseQuickAdd": "Collapse quick-add",
+  "quickAddOne": "Quick-add one",
+  "removeItem": "Remove {{w}}",
+  "updated": "Updated",
+  "ipOrCidr": "IPv4/IPv6 or CIDR",
+  "autoBanWhitelistAdded": "Added to auto-ban whitelist",
+  "added": "Added",
+  "banIpPlaceholder": "IPv4 or IPv6 to ban",
+  "reason": "Reason",
+  "scanBrute": "Scan / brute",
+  "noSignals": "No signals yet",
+  "pressReprobe": "Press re-probe",
+  "points": "pts",
+  "noTopIps": "No top IPs yet",
+  "topIpsAfterLog": "Shows after logs exist",
+  "noManagedVhost": "No managed vhost",
+  "afterPresetMarker": "Preset apply injects marker",
+  "injected": "YSK_DEFENSE injected",
+  "notInjected": "Not injected",
+  "noEvents": "No events yet",
+  "eventsAfterOps": "Appear after apply/ban",
+  "geoipUpdated": "GeoIP DB updated",
+  "dbReady": "DB ready",
+  "stale": "Stale",
+  "older7d": ">7 days",
+  "lastSuccess": "Last success",
+  "downloaded": "Downloaded",
+  "missing": "Missing",
+  "geoMode": "Geo access mode",
+  "denyList": "Deny list",
+  "allowListHighRisk": "Allow list · high risk",
+  "autoUpdateDb": "Auto-update DB",
+  "countriesSelected": "Countries ({{n}} selected)",
+  "searchCountry": "Search Chinese name or ISO",
+  "countryPlaceholder": "China / CN",
+  "regionsSelected": "Regions ({{n}} selected)",
+  "regionsHint": "From selected countries; custom CN-GD OK",
+  "pickCountryFirst": "Pick countries first to narrow list",
+  "customRegion": "Custom, e.g. CN-GD",
+  "regionPlaceholder": "Guangdong / CA / Tokyo",
+  "continentsSelected": "Continents ({{n}} selected)",
+  "continentsHint": "Optional continents",
+  "continentPlaceholder": "Asia / EU",
+  "asnsSelected": "Provider ASN ({{n}} selected)",
+  "asnsHint": "Cloud/ISP; custom ASN OK",
+  "customAsn": "Custom ASN, e.g. 13335",
+  "asnPlaceholder": "Cloudflare / ISP",
+  "cityExample": "e.g. CN|Shenzhen or US|Ashburn",
+  "policySaved": "Policy saved · countries {{c}} · regions {{r}} · ASN {{a}}",
+  "ipPolicySaved": "IP access policy saved",
+  "nginxGeoWritten": "Wrote nginx geo snippet",
+  "ipAddress": "IP address",
+  "lookupPlaceholder": "IPv4 or IPv6 to look up",
+  "wouldBlock": "Would block · {{reason}} · {{matched}}",
+  "wouldAllow": "Allow · {{reason}}",
+  "lookupDone": "Lookup done",
+  "item": "Field",
+  "value": "Value",
+  "country": "Country",
+  "region": "Region",
+  "city": "City",
+  "continent": "Continent",
+  "coords": "Coords",
+  "provider": "Provider",
+  "policy": "Policy",
+  "block": "Block",
+  "allow": "Allow",
+  "matched": "Matched",
+  "applyStricterTitle": "Apply stricter preset?",
+  "applyStricterDesc": "May enable auto-ban. Confirm your IP is whitelisted.",
+  "confirmEmergencyTitle": "Confirm emergency preset",
+  "confirmEmergencyDesc": "Emergency extremely rate-limits. Confirm whitelist and type EMERGENCY.",
+  "confirmString": "Confirm string",
+  "applyEmergency": "Apply emergency",
+  "sectionPreset": "Presets",
+  "sectionAutoPreset": "① Auto preset",
+  "sectionAutoBan": "② Auto-ban",
+  "unban": "Unban",
+  "ban": "Ban",
+  "save": "Save",
+  "yes": "Yes",
+  "no": "No",
+  "oneClickSuggested": "Apply suggested preset",
+  "viewPresets": "View presets",
+  "suspectIpsCount": "Suspect IPs {{count}}",
+  "goBans": "Go to bans",
+  "singleEntryPrefix": "Single entry:",
+  "singleEntryBody": " ",
+  "emergencyNeverAuto": "emergency never auto",
+  "writeOnlyBanner": "Write-only: system apply needs EXECUTE=1 and root.",
+  "readiness": "Readiness",
+  "goTo": "Open",
+  "presetGuide": "",
+  "active": "Active",
+  "recommended": "Suggested",
+  "useCarefully": "Caution",
+  "preview": "Preview",
+  "stackToolsSee": "Stack tools on Stack tab ·",
+  "readinessCheck": "Readiness check",
+  "automationMasterLabel": "Automation master switch",
+  "runOneTick": "Run one tick now",
+  "suggestEmergencyBanner": "Score very high — system suggests emergency but will not auto-apply. Confirm on Response tab.",
+  "autoPresetDesc": "Auto-switch daily/hardened/under-attack by score. Emergency never auto.",
+  "allowDeescalate": "Allow auto de-escalate",
+  "autoBanThresholdHint": "soft/normal/aggressive fill thresholds;",
+  "sectionMechanism": "③ How it works",
+  "lastNotes": "Last: {{notes}}",
+  "sectionWeights": "④ Signal weights (0–3)",
+  "weightsDesc": "Default 1;",
+  "needCfToken": "Needs env CF_API_TOKEN",
+  "cfOnEscalate": ". Can call API when escalating to under-attack or manual apply.",
+  "ufwOnlyCf": "Under attack: UFW allow only CF ranges (+SSH)",
+  "ufwOnlyCfHint": "Resets UFW to Cloudflare IPs only; needs system-change rights.",
+  "saveZones": "Save zones",
+  "uaNow": "Under Attack now",
+  "uaClear": "Clear (→ high)",
+  "stackRoleNote": "UFW and fail2ban are tool pages under Protection (not top-level nav). Sidebar keeps this page only.",
+  "fwUfwTitle": "Firewall UFW",
+  "fwStats": "Port policy · permanent DENY · allow {{allow}} · deny {{deny}}",
+  "fwRulesProfiles": "UFW rules & profiles",
+  "f2bStats": "Log temp bans · {{jails}} jails · banned {{banned}}",
+  "jailsWhitelistPolicy": "Jails · whitelist · policy",
+  "divisionTitle": "Division of labour",
+  "divisionUfw": "UFW = which ports open, permanent IP deny",
+  "divisionF2b": "fail2ban = temp ban after log scan",
+  "divisionDefense": "This page = attack orchestration (rate presets + auto-ban + suspects)",
+  "autoBanLabel": "Auto-ban",
+  "scanOnce": "Scan once",
+  "selectedIps": "{{count}} IP(s) selected",
+  "banSelected": "Ban selected",
+  "suspectIps": "Suspect IPs",
+  "selectAll": "Select all",
+  "alreadyBanned": "Banned",
+  "whitelist": "Whitelist",
+  "bansWorkflow": "Response: suspect list → ban/unban. Jail policy, ignoreip, service lifecycle:",
+  "f2bTool": "fail2ban tool",
+  "noSecondJail": "(no second jail editor here).",
+  "autoBanWhitelistTitle": "Auto-ban whitelist",
+  "autoBanWhitelistDesc": "Protection auto-ban exemptions (syncs fail2ban ignoreip",
+  "ignoreipWhitelist": "ignoreip whitelist",
+  "notSetSuggestAdmin": "Not set (add your admin IP)",
+  "moreItems": "… {{n}} more · see fail2ban whitelist",
+  "add": "Add",
+  "manualBanTitle": "Manual ban",
+  "methodFollows": "Method follows selection above (fail2ban / UFW)",
+  "preferSuspectList": "Usually the suspect list is enough.",
+  "threatSignals": "Threat signals",
+  "scoreSource": "Score sources · weights tunable",
+  "accessAuthSample": "access + auth samples",
+  "fullLogsAt": "Full nginx/auth logs:",
+  "logCenter": "Log center",
+  "colScore": "Score",
+  "banShort": "Ban",
+  "vhostLimits": "Vhost rate limits",
+  "eventStream": "Event stream",
+  "eventKind": {
+    "preset": "Preset",
+    "auto_preset": "Auto preset",
+    "cloudflare_ua": "Cloudflare",
+    "ban": "Ban",
+    "unban": "Unban"
+  },
+  "hours48": "48 hours",
+  "geoipDb": "GeoIP database",
+  "refreshStatus": "Refresh status",
+  "updateDbNow": "Update DB now",
+  "geoipSourceHint": "Uses local GeoIP DB by default; optional IPinfo token.",
+  "retry": "Retry",
+  "loadingGeoip": "Loading GeoIP status…",
+  "nextScheduledUpdate": "Next scheduled update: {{at}}",
+  "statusNotLoaded": "Status not loaded",
+  "load": "Load",
+  "accessPolicy": "Access policy",
+  "enable": "Enable",
+  "freeGranularity": "Free max: country + region + ASN; city optional (default off, lower accuracy). Provider = ASN. Whitelist always exempt. Click chip to remove.",
+  "allowListDanger": "Allow-list mode is high risk: public IPs not listed (incl. unknown geo) are blocked. Ensure admin IP is on ban-page whitelist.",
+  "dailySchedule": "Daily schedule",
+  "cityPolicy": "City policy (low confidence · optional)",
+  "useCityAccess": "Use city for access",
+  "cityPolicyHint": "Free DB city accuracy is limited",
+  "noCitiesYet": "No cities yet",
+  "savePolicy": "Save policy",
+  "applyNginxSnippet": "Apply Nginx snippet",
+  "nginxSnippetHint": "HTTP blocking needs the nginx geoip2 module.",
+  "testIp": "Test IP",
+  "lookup": "Lookup",
+  "plusCountry": "+ country {{v}}",
+  "plusRegion": "+ region {{v}}",
+  "plusCity": "+ city {{v}}",
+  "lastTickPrefix": "· last {{t}}",
+  "nextTickPrefix": "· next {{t}}"
+}

package/locales/en/publicFiles.json

@@ -0,0 +1,32 @@
+{
+  "notSet": "Not set",
+  "quota": "Quota",
+  "reloadOnApply": "On apply",
+  "path": "Path",
+  "fileManager": "File manager",
+  "overview": "Overview",
+  "overviewDesc": "Settings to apply (read-only summary)",
+  "serverName": "Server name",
+  "reloadNginx": "Reload Nginx",
+  "reloadTry": "Try on apply",
+  "siteSettings": "Site settings",
+  "siteSettingsDesc": "Writes managed conf; may reload Nginx on apply (reachable only after apply)",
+  "serverNameHint": "Nginx server_name, e.g. files.example.com",
+  "quotaMiB": "Quota (MiB)",
+  "quotaHint": "Optional; caps public directory size",
+  "unlimited": "Unlimited",
+  "applyHint": "Apply only writes config;",
+  "appliedOk": "Public files site applied",
+  "applyReload": "Apply and reload Nginx",
+  "statusLive": "Live on nginx",
+  "statusManagedOnly": "Managed only",
+  "statusNotApplied": "Not applied",
+  "nginxLive": "in conf.d",
+  "nginxNotLive": "not in conf.d",
+  "openSite": "Open site",
+  "notLiveHint": "Domain 404 usually means conf is only under dataDir, not copied to /etc/nginx/conf.d, or nginx was not reloaded. Re-apply with root + YSK_EXECUTE. Use http:// until SSL is issued for this hostname.",
+  "diskRoot": "Disk root",
+  "filesInRoot": "Entries",
+  "managedConf": "Managed conf",
+  "systemConf": "System conf.d"
+}

package/locales/en/rbac.json

@@ -0,0 +1,100 @@
+{
+  "permissions": "Permissions",
+  "permissionsDesc": "Add or remove capabilities per role. Factory defaults with one-click restore.",
+  "rolePolicy": "Role policy",
+  "dirty": "Customized",
+  "factory": "Factory default",
+  "maxLevel": "Max level",
+  "save": "Save policy",
+  "saved": "Saved {{role}} policy",
+  "restoreRole": "Restore this role",
+  "restoreAll": "Restore all roles",
+  "restoreRoleTitle": "Restore {{role}} to factory defaults?",
+  "restoreRoleDesc": "Custom capabilities for this role will be cleared.",
+  "restoreAllTitle": "Restore all roles to factory defaults?",
+  "restoreAllDesc": "All custom role policies will be cleared.",
+  "restoredRole": "Restored {{role}}",
+  "restoredAll": "Restored all role defaults",
+  "bandAllOn": "Enable all",
+  "bandAllOff": "Disable all",
+  "diffFromFactory": "Differs from default",
+  "effectivePreview": "Effective capabilities",
+  "userOverrides": "User overrides",
+  "extraGrants": "Extra grants",
+  "extraRevokes": "Extra revokes",
+  "restoreUserOverrides": "Clear user overrides",
+  "restoreUserOverridesTitle": "Clear overrides for {{name}}?",
+  "restoreUserOverridesDesc": "Only extra grants/revokes are cleared; role policy is unchanged.",
+  "overridesBadge": "Overrides",
+  "promoteAdminTitle": "Promote to Admin?",
+  "promoteAdminDesc": "Admin can manage users, change RBAC, impersonate, restore backups, and more.",
+  "level": {
+    "read": "Read",
+    "write-low": "Write (low)",
+    "write-high": "Write (high)",
+    "destructive": "Destructive",
+    "privilege": "Privilege"
+  },
+  "cap": {
+    "dashboardRead": "Dashboard",
+    "logsRead": "Logs",
+    "metricsRead": "Metrics",
+    "projectsRead": "Projects (read)",
+    "mailRead": "Mail (read)",
+    "dnsRead": "DNS (read)",
+    "sslRead": "SSL (read)",
+    "backupsRead": "Backups (read)",
+    "updatesRead": "Updates (read)",
+    "servicesRead": "Services (read)",
+    "firewallRead": "Firewall (read)",
+    "approvalsView": "Approvals (view)",
+    "usersSelf": "Self profile / 2FA",
+    "projectsWrite": "Projects create/edit",
+    "mailWrite": "Mailboxes / aliases",
+    "dbWrite": "Create databases",
+    "sslUpload": "Upload certificates",
+    "filesProject": "Project files",
+    "approvalsRespond": "Respond to approvals",
+    "cronManage": "Cron management",
+    "servicesControl": "Service control",
+    "updatesApply": "Apply package updates",
+    "dnsApply": "Apply DNS",
+    "sslIssue": "Issue SSL",
+    "publishApply": "Publish / Nginx",
+    "firewallEdit": "Edit firewall",
+    "mailApply": "Apply mail maps",
+    "runtimeTuning": "Runtime tuning",
+    "mysqlConsoleWrite": "MySQL write console",
+    "projectsDelete": "Delete projects",
+    "dbDrop": "Drop databases",
+    "backupsRun": "Run backups",
+    "backupsRestore": "Restore backups",
+    "firewallFlush": "Flush firewall",
+    "logsPurge": "Purge logs",
+    "usersManage": "Manage users",
+    "packagesManage": "Manage packages",
+    "usersImpersonate": "Impersonate",
+    "securityPolicy": "Security policy",
+    "rbacPolicy": "RBAC policy",
+    "settingsSystem": "System settings",
+    "auditExport": "Audit export",
+    "securityApiKeysAdmin": "API keys admin",
+    "networkBrowse": "Host-mediated web browse",
+    "networkVnc": "VNC remote desktop"
+  },
+  "aboutRoles": "Roles (factory defaults)",
+  "aboutRolesBody": "Roles set default capabilities; users can override individual ones.",
+  "aboutQuota": "Quotas",
+  "aboutQuotaBody": "Package quotas are primarily host/panel totals, not hard multi-tenant isolation",
+  "dangerPolicyTitle": "Grant destructive / privilege capabilities?",
+  "dangerPolicyDesc": "You are adding destructive or privilege caps, or raising maxLevel for this role",
+  "needRbacPolicy": "rbac.policy is required to edit role policies.",
+  "adminLockedFull": "Admin full-open (locked)",
+  "adminLockedHint": "The admin system role is always fully open and cannot be reduced",
+  "maxLevelHint": "Capability groups above this level stay locked.",
+  "capabilities": "Capabilities",
+  "capabilitiesHint": "Toggle what this role may do",
+  "enabledCount": "{{enabled}} of {{total}} enabled",
+  "bandAboveMax": "Above max level",
+  "dirtyHint": "Customized (differs from factory)"
+}

package/locales/en/readiness.json

@@ -0,0 +1,111 @@
+{
+  "cat": {
+    "core": "Control plane",
+    "security": "Permissions & security",
+    "binaries": "System software",
+    "hosting": "Runtimes",
+    "dns": "DNS",
+    "email": "Email",
+    "isolation": "Project isolation",
+    "ops": "Ops"
+  },
+  "level": {
+    "ready": "Ready",
+    "degraded": "Degraded",
+    "missing": "Missing",
+    "unknown": "Unknown"
+  },
+  "severity": {
+    "critical": "Critical",
+    "recommended": "Recommended",
+    "optional": "Optional"
+  },
+  "fix": "Fix",
+  "passed": "Pass",
+  "checkFailed": "Readiness check failed",
+  "gatePass": "Gate passed · {{pct}}%",
+  "gateFail": "Not ready · {{pct}}%",
+  "executeOn": "On",
+  "executeOff": "Off",
+  "blockers": "Blockers",
+  "probing": "Probing…",
+  "reprobe": "Re-probe",
+  "exportReport": "Export report",
+  "firstBlocker": "Fix first blocker",
+  "viewRecommended": "View recommended",
+  "loadingProbe": "Probing host capabilities…",
+  "priorityTab": "Priority fixes",
+  "checklistTab": "Full checklist",
+  "summaryTab": "Summary & shortcuts",
+  "priorityTitle": "Priority fixes",
+  "prioritySub": "Handle in order; re-probe after clearing blockers",
+  "nItems": "{{count}} items",
+  "noHardBlockers": "No hard blockers",
+  "noHardBlockersTitle": "No hard blockers",
+  "prodGate": "Production gate",
+  "gatePassed": "passed",
+  "gateMaybePerm": "may still fail due to permissions",
+  "viewDegradedHint": "Review degraded recommendations (mail, DNS, optional runtimes).",
+  "viewDegraded": "View degraded",
+  "fullChecklist": "Full checklist",
+  "showing": "Showing {{shown}} / {{total}}",
+  "filterAria": "Status filter",
+  "all": "All",
+  "category": "Category",
+  "allCategories": "All categories",
+  "searchPh": "Title, detail, id, fix hint…",
+  "quickCatAria": "Quick categories",
+  "noMatchTitle": "No matching items",
+  "noMatchDesc": "Clear search or change filters.",
+  "resetFilters": "Reset filters",
+  "summary": "Summary",
+  "shortcuts": "Shortcuts",
+  "opsShortcutsAria": "Ops shortcuts",
+  "scHost": "Host settings",
+  "scHostD": "hostname · power · NTP",
+  "scUnit": "Control-plane unit",
+  "scUnitD": "systemd install / enable",
+  "scServices": "Service matrix",
+  "scServicesD": "nginx · DB · lifecycle",
+  "scMetrics": "Host metrics",
+  "scMetricsD": "load · memory · alerts",
+  "scProtection": "Defense center",
+  "scProtectionD": "response · UFW · fail2ban",
+  "policyNote": "Policy: mail PTR / port 25 / registrar DNS are never auto-claimed complete. HTTP 503 = not ready but full report (not a fake success).",
+  "notProbedTitle": "Not probed yet",
+  "notProbedDesc": "Click “Re-probe” to start a read-only readiness check.",
+  "runCheck": "Run readiness check",
+  "reportFormatError": "Invalid readiness report format",
+  "checkFailedHttp": "Readiness check failed ({{status}})",
+  "itemAdminPassword": "Admin password strength",
+  "itemAdminPasswordWeak": "{{count}} admin(s) flagged must_change_password / insecure bootstrap — change before production",
+  "itemAdminPasswordOk": "No bootstrap/weak-password flag on admin accounts",
+  "itemAdminPasswordFix": "Change admin password (Security / Users)",
+  "itemListenBind": "Control plane listen bind",
+  "itemListenBindPublic": "Listen may be public (0.0.0.0/::). Prefer 127.0.0.1 + reverse proxy / firewall.",
+  "itemListenBindLoopback": "Prefer loopback bind (default 127.0.0.1)",
+  "itemDataDirPerms": "dataDir permissions",
+  "itemDataDirWorldW": "chmod 750 (or 700) dataDir; chown to panel user",
+  "itemDataDirOtherR": "Prefer chmod 750 dataDir so other users cannot read control-plane JSON",
+  "itemRustToolchain": "Rust toolchain",
+  "itemWebBuildFix": "Click “Fix now” to build the Web UI (requires monorepo on this host), or run: pnpm --filter ysk-server-web build",
+  "itemWebBuildManual": "No monorepo or packaged SPA on this host — one-click fix is unavailable. On a machine with source: pnpm --filter ysk-server-web build, then copy apps/web/dist/* into dataDir/web (e.g. /var/lib/ysk-server/web), or set YSK_WEB_ROOT and restart.",
+  "itemStateStore": "Control-plane state store",
+  "itemStateStoreSqliteHint": "Optional: YSK_STORE=sqlite for WAL document store",
+  "itemBackupFreshness": "Last full backup run",
+  "itemBackupNone": "No last_backup_run recorded — run backup all or schedule",
+  "itemBackupFix": "ysk-server backup all · backup schedule --install",
+  "itemFleetSessions": "Fleet agent sessions",
+  "itemFleetNone": "Optional for single-host; multi-edge needs agent run + heartbeat",
+  "itemFleetNoHb": "Sessions registered but not heartbeating — start edge agent",
+  "itemPdnsutil": "pdnsutil (PowerDNS)",
+  "apachePort80Title": "Apache vs public :80",
+  "apachePort80Detail": "Apache is listening on :80 and Nginx is not on public HTTP — conflicts with Nginx-as-edge topology.",
+  "apachePort80Both": "Both Apache and Nginx appear on :80 — rebind Apache to 127.0.0.1:8080.",
+  "apachePort80Ok": "Apache is running but not solely owning public :80 (topology OK).",
+  "apachePort80Fix": "Install rebind helpers exist; disable Apache vhosts on 80 or verify with ss -lntp after reload.",
+  "fixNow": "Fix now",
+  "fixFailed": "Fix failed",
+  "fixDone": "dataDir permissions hardened (chmod 750)",
+  "fixDoneWebUi": "Web UI built / installed"
+}

package/locales/en/redis.json

@@ -0,0 +1,68 @@
+{
+  "neverExpire": "Never expires",
+  "ttlSeconds": "{{ttl}}s",
+  "ttlMinutes": "{{n}} min",
+  "ttlHours": "{{n}} h",
+  "ttlDays": "{{n}} d",
+  "typeString": "String",
+  "typeHash": "Hash",
+  "typeList": "List",
+  "typeSet": "Set",
+  "typeZset": "Sorted set",
+  "keysLoadFailed": "Failed to load keys",
+  "writeFailed": "Write failed",
+  "saved": "Saved",
+  "deleted": "Deleted",
+  "offline": "Offline",
+  "connections": "Connections",
+  "totalKeys": "Total keys",
+  "writable": "Writable",
+  "connected": "Connected",
+  "notConnected": "Not connected",
+  "keys": "Keys",
+  "selected": "Selected",
+  "softwareMissing": "Redis software is not installed",
+  "notConnectedTitle": "Not connected to Redis",
+  "installThenStart": "Install Redis via the banner, then start the service.",
+  "installedNotConnected": "Installed but not connected — start the service to browse keys.",
+  "keysCountSuffix": " · {{n}} key(s)",
+  "searchPlaceholder": "Search keys, e.g. user:* or *",
+  "searchKeys": "Search keys",
+  "rows": "{{n}} row(s)",
+  "content": "Content",
+  "noMatchingKeys": "No matching keys",
+  "dbEmpty": "Database {{db}} is empty.",
+  "noMatchPattern": "No keys matching “{{pattern}}”.",
+  "opsResult": "Ops result",
+  "addStringKey": "Add string key",
+  "writeToDb": "Write to Redis DB {{db}} (live — be careful)",
+  "keyName": "Key",
+  "keyNameHint": "Use colon namespaces, e.g. session:user:1",
+  "ttlLabel": "TTL (seconds)",
+  "ttlHint": "Empty = never expire",
+  "m1": "1m",
+  "m5": "5m",
+  "h1": "1h",
+  "d1": "1d",
+  "d7": "7d",
+  "customSeconds": "Custom seconds",
+  "stringValue": "String value via SET",
+  "stringContent": "String content",
+  "deleteKeyTitle": "Delete this key?",
+  "deleteKeyDesc": "Delete “{{key}}” from DB {{db}}? This cannot be undone.",
+  "installedOk": "Redis installed",
+  "startedOk": "Redis started",
+  "memory": "Memory",
+  "addKey": "Add key",
+  "dbLabel": "DB {{i}}",
+  "keysInDb": " · {{n}} key(s)",
+  "dbRange": "{{n}} databases (0–{{max}}).",
+  "serviceLink": "Change count in service settings",
+  "dbsWithData": "DBs with data (quick)",
+  "keysShort": "{{k}} keys",
+  "keyList": "Key list",
+  "pickKey": "Select a key on the left to view content.",
+  "ttlPrefix": "TTL: {{ttl}}",
+  "writeLiveHint": "Writes live Redis; cannot undo from the panel in one click.",
+  "refPath": "Ref: {{path}}"
+}