ysk-server-shared 1.0.0

package/locales/en/security.json

@@ -0,0 +1,394 @@
+{
+  "title": "Security & Approvals",
+  "allowlist": "Tool Allowlist (read-only default; high-risk needs human approval)",
+  "llmUntrusted": "LLM output is always untrusted and must never execute directly",
+  "pending": "Pending approvals",
+  "runSysInfo": "Run sys.info",
+  "none": "No pending approvals",
+  "pillPending": "{{count}} pending",
+  "pillReady": "Ready",
+  "pill2faOff": "2FA off",
+  "stat2fa": "2FA",
+  "statApi": "API",
+  "statSsh": "SSH",
+  "statPending": "Pending",
+  "on": "On",
+  "off": "Off",
+  "output": "Output",
+  "tabAccount": "My security",
+  "tabApiKeys": "API keys",
+  "tabSsh": "SSH",
+  "tabApprovals": "Approvals",
+  "tabAllowlist": "Allowlist",
+  "apiTokenOnce": "API token (shown once):",
+  "copiedToken": "Token copied",
+  "totpTitle": "Two-factor (TOTP)",
+  "totpStatus": "Status: ",
+  "totpEnabled": "Enabled",
+  "totpEnrolledUnconfirmed": "In progress — scan & confirm",
+  "totpNotSet": "Not set",
+  "totpLead": "Login requires a 6-digit app code.",
+  "totpWhy1": "Stolen passwords alone cannot sign in without the app code",
+  "totpWhy2": "Sensitive actions can re-prompt for TOTP (step-up)",
+  "totpWhy3": "Works with Google Authenticator, Authy, NordPass, 1Password, and more",
+  "totpAppsHint": "Suggested apps: Google Authenticator, Authy, Microsoft Authenticator, NordPass, 1Password",
+  "totpStepsLabel": "Setup steps",
+  "totpStepReauth": "Verify password",
+  "totpStepScan": "Scan QR / enter key",
+  "totpStepConfirm": "Confirm 6-digit code",
+  "totpStepBackup": "Save recovery codes",
+  "totpScanTitle": "Scan QR code",
+  "totpScanHint": "Open your authenticator app → Add account → Scan this QR.",
+  "totpManualTitle": "Or enter the key manually",
+  "totpManualHint": "If you cannot scan, choose manual entry in the app and paste this Base32 secret.",
+  "totpShowOtpauth": "Show otpauth:// URL (advanced)",
+  "totpQrAlt": "TOTP setup QR code",
+  "totpQrFailed": "Could not render QR — use the secret key below",
+  "totpSecretCopied": "Secret copied",
+  "hideSecret": "Hide secret",
+  "showSecret": "Show secret",
+  "totpEnabledDesc": "Enabled.",
+  "totpRecoveryRemaining": "{{n}} recovery codes left",
+  "totpResetSummary": "Reset or turn off 2FA…",
+  "totpResetHint": "Reset issues a new QR/secret (old app entries stop working)",
+  "totpDisableCodeHint": "App 6-digit code or recovery code",
+  "disable2fa": "Turn off 2FA",
+  "totpDisabledOk": "Two-factor auth turned off",
+  "reauthPassword": "Re-enter password",
+  "reauthPasswordHint": "Start/reset 2FA requires password again (stolen session protection)",
+  "reauthPasswordRequired": "Enter your login password first",
+  "totpSecretGenerated": "Secret ready — scan the QR or copy the key, then enter the app’s 6-digit code",
+  "reset2fa": "Reset 2FA",
+  "start2fa": "Set up 2FA",
+  "secretLabel": "Secret: ",
+  "confirmCode": "6-digit code from app",
+  "confirmCodeHint": "After scanning, enter the 6 digits currently shown in your authenticator.",
+  "confirmCodeInvalid": "Enter a 6-digit verification code",
+  "totpEnabledSaveCodes": "2FA enabled — save the recovery codes below now (shown once)",
+  "confirmEnable": "Confirm & enable",
+  "recoveryCodesHint": "Recovery codes are shown once only",
+  "copiedRecoveryCodes": "Recovery codes copied",
+  "downloadRecovery": "Download .txt",
+  "recoveryDownloaded": "Recovery codes file downloaded",
+  "copyAll": "Copy all",
+  "savedClose": "I've saved them — done",
+  "sessionsTitle": "Sessions",
+  "sessionsDesc": "",
+  "revokeOtherSessions": "Sign out other devices",
+  "revokedOtherSessions": "Signed out {{count}} other session(s)",
+  "noSessions": "No active sessions",
+  "currentSession": "This device",
+  "revoke": "Sign out",
+  "passkeyTitle": "Passkey / WebAuthn",
+  "passkeyDesc": "",
+  "passkeyRegistered": "Passkey registered",
+  "webauthnFailed": "WebAuthn failed",
+  "webauthnUnsupported": "This page has no WebAuthn API. In Brave/Chrome/Firefox avoid restricted modes; use a password manager if needed, and open the panel on a domain over HTTPS.",
+  "webauthnInsecureContext": "This page is not a secure context ({{origin}}). Browsers require HTTPS or localhost for Passkeys — unrelated to Brave/NordPass. Open https://your-domain instead.",
+  "webauthnIpHost": "You opened the panel via IP ({{origin}}). WebAuthn forbids IP as RP ID, so Brave/NordPass will fail. Bind a domain + HTTPS (e.g. https://panel.example.com) and retry.",
+  "webauthnEnvOk": "Passkey ready ({{origin}})",
+  "webauthnEnvCurrent": "Current page: {{origin}}",
+  "webauthnCancelled": "Cancelled or timed out. Try again.",
+  "webauthnUnavailableHint": "Passkey needs HTTPS + domain.",
+  "registerPasskey": "Register passkey",
+  "noPasskey": "No passkey",
+  "passkeyVerifyOk": "Passkey verified (step-up done)",
+  "verifyFailed": "Verification failed",
+  "verifyWithPasskey": "Verify with passkey (step-up)",
+  "passkeyHint": "For high-risk step-up; needs HTTPS + domain.",
+  "devicesTitle": "Devices / backup",
+  "devicesDesc": "",
+  "viewTrustedDevices": "View trusted devices",
+  "trustedDevicesCount": "Trusted devices: {{count}}",
+  "revokeAllDevices": "Revoke all devices",
+  "revokedAllDevices": "All trusted devices revoked",
+  "export2faBackup": "Export 2FA encrypted backup",
+  "fail2banSnippetMsg": "Fail2ban snippets: {{written}} — {{notes}}",
+  "generateFail2ban": "Generate Fail2ban snippets",
+  "adminPolicyTitle": "Admin 2FA policy",
+  "adminPolicyDesc": "",
+  "requireAdmin2fa": "Require admin 2FA",
+  "strictAdmin2fa": "Strict: block login without 2FA",
+  "confirmTotpPolicy": "Confirm TOTP (when changing policy)",
+  "confirmTotpPolicyHint": "Enabling policy needs step-up",
+  "totp6digitPlaceholder": "6-digit code",
+  "policyUpdated": "Security policy updated",
+  "savePolicy": "Save policy",
+  "recentProbe": "Recent probe",
+  "apiKeysTitle": "API access keys",
+  "apiKeysDesc": "",
+  "createKey": "+ Create key",
+  "colName": "Name",
+  "colPrefix": "Prefix",
+  "colCreated": "Created",
+  "apiKeysEmpty": "No API keys yet",
+  "apiKeysEmptyHint": "Create from the toolbar; then call API with Bearer token",
+  "approve": "Approve",
+  "allowlistTitle": "Allowlist ({{count}})",
+  "allowlistEmpty": "No allowlist tools",
+  "createApiKeyTitle": "Create API key",
+  "createApiKeyDesc": "Full token is shown only once after create",
+  "createKeyBtn": "Create key",
+  "apiKeyNameHint": "Easy to recognize, e.g. CI / backup script",
+  "apiKeyScope": "Scope",
+  "apiKeyScopeHint": "read = read-only (no full mutate)",
+  "scopeFull": "full (full API)",
+  "scopeRead": "read (read-only)",
+  "apiKey2faHint": "If 2FA is on, creating a key requires a verification code (step-up).",
+  "apiKeyCreated": "API key created",
+  "export2faBackupTitle": "Export 2FA backup",
+  "createApiKeyStepUp": "Create API key · step-up",
+  "enterTotpCode": "Enter current TOTP code",
+  "export": "Export",
+  "backupCopied": "Encrypted backup copied to clipboard (store offline)",
+  "digit6Placeholder": "6-digit code",
+  "ssh": {
+    "workspaceTitle": "SSH workspace",
+    "workspaceDesc": "Pick a job first",
+    "subOutbound": "Outbound IDs",
+    "subOutboundHint": "Private keys for panel/project outbound",
+    "subLogin": "Login auth",
+    "subLoginHint": "Who can SFTP/SSH in",
+    "sub2fa": "Login 2FA",
+    "sub2faHint": "SSH TOTP (≠ panel 2FA)",
+    "subSshd": "System sshd",
+    "subSshdHint": "Project user SFTP settings",
+    "jobOutboundTitle": "Connect outbound",
+    "jobOutboundDesc": "Create outbound identity keys · panel peer / project git",
+    "jobLoginTitle": "Allow inbound login",
+    "jobLoginDesc": "Register public keys to project home · authorized_keys",
+    "job2faTitle": "SSH login needs 2FA",
+    "job2faDesc": "Linux user TOTP (separate from panel 2FA)",
+    "jobSshdTitle": "Enable system SFTP",
+    "jobSshdDesc": "Install sshd Match snippets (project users)",
+    "purposePanel": "Panel to other hosts",
+    "purposeUser": "Project user outbound",
+    "purposeUnbound": "Purpose not set",
+    "purposePanelHint": "Cluster peer, backup scp, remote probes",
+    "purposeUserHint": "Project Linux user git / scp / scripts",
+    "purposeDefaultHint": "Bind later",
+    "statusStored": "Stored",
+    "statusInstalled": "On disk",
+    "statusVerified": "Verified",
+    "statusMissing": "Missing on disk",
+    "statusRetired": "Retired",
+    "statusError": "Error",
+    "actionInstall": "Write to disk",
+    "actionTest": "Test connection",
+    "actionCopyPub": "Copy public key",
+    "pipelineStored": "Stored",
+    "pipelineInstalled": "On disk",
+    "pipelineVerified": "Verified",
+    "progressAria": "Progress",
+    "loginTitle": "Login authorization (public keys)",
+    "loginDesc": "Who can come in",
+    "loginAdd": "Add login public key",
+    "loginEmpty": "No login public keys yet",
+    "loginEmptyHint": "Paste a laptop or CI public key, bind to a project user for SFTP/SSH (needs sshd snippet)",
+    "loginAddFirst": "Add first login public key",
+    "boundProject": "Project",
+    "unboundProject": "No project",
+    "loginRemoved": "Public key removed",
+    "remove": "Remove",
+    "loginModalTitle": "Authorize a public key",
+    "loginModalDesc": "After selecting a project, the key is written to that Linux user home/",
+    "addAuth": "Add authorization",
+    "selectOption": "— Select —",
+    "publicKey": "Public key",
+    "publicKeyHint": "Paste full line, e.g. ssh-ed25519 AAAA… comment",
+    "commentOptional": "Comment (optional)",
+    "commentPlaceholder": "laptop / CI",
+    "loginNeedProject": "Create a project first. Binding works best when the system user is ready.",
+    "loginNeedPub": "Select a project and paste a public key starting with ssh-",
+    "loginAdded": "Added",
+    "sshdTitle": "Project user SFTP (sshd)",
+    "sshdDesc": "Let ysks_* / ysk_* project users SFTP with public keys",
+    "sshdStep1": "Add public keys under Login auth for projects",
+    "sshdStep2": "Preview and install system Match snippets here",
+    "sshdStep3": "Install needs system execute rights; will try to reload sshd",
+    "sshdPreview": "Config preview",
+    "loadingSnippet": "(Loading…)",
+    "reloadedCopied": "Reloaded; snippet copied to clipboard",
+    "reloadAndCopy": "Reload and copy",
+    "installedOk": "Installed",
+    "installToSystem": "Install to system",
+    "sshdManualHint": "If execute is blocked, run the control plane with privileges, or place the snippet under",
+    "outboundTitle": "Outbound identity keys",
+    "outboundDesc": "Private keys encrypted in control plane",
+    "outboundAdd": "Add outbound identity",
+    "filterActive": "Active",
+    "filterPanel": "Panel",
+    "filterUser": "Project user",
+    "filterRetired": "Retired",
+    "filterAll": "All",
+    "searchIdentity": "Search name or fingerprint…",
+    "searchIdentityAria": "Search identities",
+    "identityCount": "{{count}} identities",
+    "identityList": "Identities",
+    "outboundEmpty": "No outbound identities yet",
+    "outboundEmptyFilter": "No matching items",
+    "outboundEmptyHint": "Create a key in ~30s: pick purpose → name → done. Use for peer / backup / git.",
+    "outboundEmptyFilterHint": "Try changing filters or clear search",
+    "outboundAddFirst": "Add first outbound identity",
+    "userPrefix": "User {{user}}",
+    "createFailed": "Create failed",
+    "identityCreatedOnce": "Identity created (private key shown once)",
+    "writtenToDisk": "Written to disk",
+    "cannotWriteNeedExecute": "Cannot write to system: enable execute (YSK_EXECUTE)",
+    "notDone": "Not completed",
+    "installFailed": "Install failed",
+    "testPassed": "Connection OK",
+    "testFailed": "Connection failed",
+    "testError": "Test failed",
+    "copiedPubPaste": "Public key copied — paste into peer authorized_keys or Git deploy key",
+    "deletedNamed": "Deleted \"{{name}}\"",
+    "rotated": "Rotated: old key retired, new key created",
+    "detailStatus": "Status",
+    "detailPurpose": "Purpose",
+    "detailLinuxUser": "Linux user",
+    "detailDiskPath": "Disk path",
+    "detailLastTest": "Last test",
+    "suggestFlow": "Suggested: store → write disk → put public key on peer → test connection",
+    "suggestFlowPrefix": "Suggested: store → write disk → put ",
+    "suggestFlowSuffix": " on peer → test connection",
+    "publicKeyStrong": "public key",
+    "copiedPub": "Public key copied",
+    "allowLocalLogin": "Allow local login with this key",
+    "localLoginOk": "Public key added to local login authorization",
+    "testingConnection": "Testing connection…",
+    "rotateKey": "Rotate key",
+    "wizStepPurpose": "What is this key for?",
+    "wizStepProject": "Which project?",
+    "wizStepPanelConfirm": "Confirm panel outbound",
+    "wizStepName": "Name and options",
+    "wizStepPurposeDesc": "Pick purpose so list and install path align",
+    "wizStepProjectDesc": "Key binds to that project's Linux user and home",
+    "wizStepPanelDesc": "Private key stays in control-plane secrets for scp/ssh to other hosts",
+    "wizStepNameDesc": "Name for recognition; advanced options can wait",
+    "prevStep": "Back",
+    "nextStep": "Next",
+    "createIdentity": "Create identity",
+    "purposePanelTitle": "Panel to other hosts",
+    "purposePanelSub": "Cluster peer, remote backup, probes",
+    "purposePanelRec": "Recommended for most admin ops",
+    "purposeUserTitle": "Project user outbound",
+    "purposeUserSub": "git pull, project script scp",
+    "purposeUserPath": "Writes project home/.ssh",
+    "selectProject": "— Select project —",
+    "noProjectsHint": "No projects yet — create a project and system user first",
+    "afterCreatePub": "After create, put the ",
+    "afterCreatePubMid": " on the target host's ",
+    "afterCreatePubEnd": ", then use Test connection.",
+    "privKeyStayLocal": "Private key stays on this control plane; never in lists or logs.",
+    "displayName": "Display name",
+    "displayNameHint": "e.g. peer-prod, myapp-git",
+    "algorithm": "Algorithm",
+    "algoSuggested": "Recommended",
+    "algoLegacy": "Legacy systems",
+    "installImmediately": "Write to disk immediately after create",
+    "installImmediatelyHint": "(needs system execute; otherwise you will be told it cannot apply)",
+    "savePrivTitle": "Save private key now",
+    "savePrivDesc": "After close, full private key will not be shown again",
+    "copiedPriv": "Private key copied",
+    "copyPriv": "Copy private key",
+    "nextInstallDisk": "Next: write to disk",
+    "savedCloseBtn": "Saved — close",
+    "privKeyOnce": "Private key (this time only)",
+    "privSavedConfirm": "I stored the private key safely (password manager / offline backup)",
+    "testConnTitle": "Test connection",
+    "testConnDesc": "Try ssh … true with this identity. Success only means this target is reachable.",
+    "startTest": "Start test",
+    "testTarget": "Target",
+    "testTargetHint": "Format user@host or user@host:port",
+    "deleteIdentityTitle": "Delete identity?",
+    "rotateKeyTitle": "Rotate key?",
+    "deleteIdentityDesc": "Delete \"{{name}}\" and try to remove the private key file on disk",
+    "rotateKeyDesc": "\"{{name}}\" will be retired and a new key created. Update peer authorized_keys.",
+    "rotate": "Rotate",
+    "enrollStatusSecret": "Secret generated",
+    "enrollStatusConfirmed": "App confirmed",
+    "enrollStatusWritten": "Written to home",
+    "enrollStatusRetired": "Retired",
+    "needProjectOrUser": "Select a project or enter a Linux username",
+    "enrollFailed": "Enrollment failed",
+    "totpGenerated": "SSH-only TOTP generated (separate from panel 2FA unless you sync)",
+    "confirmed": "Confirmed",
+    "codeWrong": "Wrong code",
+    "gaWritten": "Wrote .google_authenticator",
+    "needExecute": "Needs system execute enabled",
+    "ssh2faTitle": "SSH login second factor",
+    "ssh2faDesc": "Protects ssh login for Linux users",
+    "ssh2faStep1": "Enroll TOTP for a Linux user (scan QR)",
+    "ssh2faStep2": "Confirm App 6-digit code",
+    "ssh2faStep3": "Write home file",
+    "ssh2faStep4": "Install PAM module and merge snippets (below)",
+    "pkgLabel": "Package {{name}}",
+    "enrollForUser": "Enroll SSH 2FA for user",
+    "ssh2faEmpty": "No Linux user has SSH 2FA yet",
+    "ssh2faEmptyHint": "Prefer key login first;",
+    "startEnroll": "Start enrollment",
+    "fromPanelBadge": "Same as panel",
+    "enterCode": "Enter code",
+    "rewriteHome": "Rewrite home file",
+    "writeHome": "Write home",
+    "retiredOk": "Retired",
+    "retire": "Retire",
+    "pamTitle": "System: PAM / sshd (manual or apply when permitted)",
+    "pamDesc": "nullok avoids locking users without files. File written ≠ TOTP required.",
+    "pamSnippet": "PAM snippet (merge into /etc/pam.d/sshd)",
+    "sshdHint": "sshd hints",
+    "rescueUsers": "Rescue users (comma-separated, never in strict Match)",
+    "strictPreview": "Strict Match preview (publickey+TOTP, password off)",
+    "copiedPam": "PAM snippet copied",
+    "copyPam": "Copy PAM",
+    "applyStrict": "Apply Strict to system",
+    "pamPkgHint": "Package: ",
+    "pamRescueHint": ". Keep at least one rescue admin without a 2FA file (default root).",
+    "enrollModalTitle": "Enroll SSH 2FA",
+    "enrollModalDesc": "Default: independent secret (not shared with panel)",
+    "generateShowSecret": "Generate and show secret",
+    "projectSuggested": "Project (recommended)",
+    "orManualUser": "— or enter user manually —",
+    "linuxUser": "Linux user",
+    "advancedSharePanel": "Advanced: use current panel operator TOTP secret (type SHARED to confirm)",
+    "setupAuthTitle": "Set up authenticator",
+    "setupAuthDesc": "Scan or enter secret, then confirm with App 6-digit code",
+    "later": "Later",
+    "confirmCodeBtn": "Confirm code",
+    "secretBase32": "Secret (base32)",
+    "copiedSecret": "Secret copied",
+    "copySecret": "Copy secret",
+    "scanThenCode": "If already scanned, enter the current 6-digit code.",
+    "verifyCode": "Verification code",
+    "applyStrictStepUp": "Apply Strict · step-up",
+    "enterPanelTotp": "Enter current panel TOTP code",
+    "applyBtn": "Apply",
+    "appliedOk": "Applied",
+    "sharePanelTitle": "Share panel TOTP secret?",
+    "sharePanelDesc": "High risk. Type SHARED to confirm.",
+    "confirmString": "Confirmation string",
+    "enableShare": "Enable sharing"
+  },
+  "sessionsActive": "Active sessions",
+  "sessionsOther": "Other devices",
+  "sessionsHint": "",
+  "noSessionsHint": "When you sign in again, this device will appear here.",
+  "sessionOtherBadge": "Other",
+  "sessionThisDevice": "You’re here",
+  "sessionDeviceOn": "{{browser}} on {{os}}",
+  "sessionIpUnknown": "IP unknown",
+  "sessionLastActive": "Last active {{when}}",
+  "sessionStarted": "Signed in {{when}}",
+  "sessionIdShort": "ID {{id}}…",
+  "sessionJustNow": "just now",
+  "sessionMinAgo": "{{n}} min ago",
+  "sessionHourAgo": "{{n}} h ago",
+  "sessionDayAgo": "{{n}} d ago",
+  "revokeSessionTitle": "Sign out this device?",
+  "revokeSessionDesc": "End session for {{device}} ({{ip}}). That device will need to sign in again.",
+  "revokeOthersTitle": "Sign out all other devices?",
+  "revokeOthersDesc": "This will end {{count}} other session(s). Your current browser stays signed in.",
+  "sessionRevoked": "Session signed out",
+  "mySecurityHint": "",
+  "policyTotpHint": "Site policy: each admin must enable their own 2FA (individual QR)"
+}

package/locales/en/serviceExposure.json

@@ -0,0 +1,31 @@
+{
+  "title": "Network access",
+  "manage": "Manage access",
+  "manageTitle": "Service network access",
+  "manageDesc": "Control how {{service}} is reachable on the host firewall.",
+  "mode": "Access mode",
+  "modePrivate": "Local only",
+  "modePublic": "Public",
+  "modeRestricted": "Restricted",
+  "summaryPrivate": "Not open on the public firewall.",
+  "summaryPublic": "Open · {{ports}}",
+  "summaryRestricted": "Restricted · {{count}} source(s)",
+  "summaryFirewallOff": "Host firewall: {{detail}} — rules not enforced until UFW is active.",
+  "outOfSync": "Out of sync",
+  "firewallOff": "Firewall off",
+  "ufwMissing": "UFW not installed",
+  "ufwInactive": "inactive",
+  "firewallLink": "Firewall",
+  "portsLabel": "Ports",
+  "allowFrom": "Allowed sources (IP / CIDR)",
+  "allowCountries": "Allowed countries (ISO)",
+  "hintPrivate": "Service may still listen on localhost; no public UFW allow rules.",
+  "hintPublic": "Warning: opens this port to the whole Internet. Prefer restricted for databases.",
+  "hintRestricted": "Comma-separated IPs or CIDRs. Only these sources may connect.",
+  "hintCountries": "L2 best-effort via ipset + country zone CIDRs. Requires root, EXECUTE, and ipset. Cloud security groups are separate.",
+  "restrictedNeedIp": "Add at least one IP or CIDR for restricted mode.",
+  "restrictedNeedSource": "Add at least one IP/CIDR or country code for restricted mode.",
+  "privateStartTitle": "Expose {{service}} on the network?",
+  "confirmAndStart": "Confirm and start",
+  "cloudSgNote": "Host firewall only — cloud security groups (AWS/GCP/Azure) are not changed."
+}

package/locales/en/services.json

@@ -0,0 +1,40 @@
+{
+  "enabledBoot": "On boot",
+  "action": {
+    "start": "Start",
+    "stop": "Stop",
+    "restart": "Restart",
+    "reload": "Reload"
+  },
+  "actionDone": "{{action}} done",
+  "runningOf": "{{running}}/{{total}} running",
+  "canMutate": "Mutable",
+  "locked": "Locked",
+  "controlUnit": "Control-plane unit",
+  "logs": "Logs",
+  "dbHa": "Database HA",
+  "clusterCount": "{{count}} cluster(s)",
+  "mariadbCluster": "MariaDB cluster",
+  "probing": "Probing service matrix…",
+  "lifecycleLocked": "Lifecycle actions locked: need root + YSK_EXECUTE. Probes still work. See",
+  "hostSettings": "Host settings",
+  "matrixTab": "Service matrix ({{count}})",
+  "stackTab": "Software stack",
+  "stackTitle": "Host software stack",
+  "stackHint": "Install or remove host components by plan; SQL server engines are exclusive.",
+  "protectionTab": "Protection probe",
+  "knownServices": "Known services",
+  "showing": "Showing {{shown}} / {{total}}",
+  "all": "All",
+  "searchPh": "Name / unit / category",
+  "noMatch": "No matching services",
+  "bootPrefix": "Boot {{state}}",
+  "controlPage": "Control page",
+  "manageRuntime": "Install / update",
+  "protectionTitle": "Protection probe",
+  "protectionSub": "Read-only; does not change firewall / fail2ban",
+  "protectionDoneNote": "Protection probe finished",
+  "probeDone": "Probe complete",
+  "runProtection": "Run protection probe",
+  "notProbedYet": "Not probed yet"
+}

package/locales/en/software.json

@@ -0,0 +1,122 @@
+{
+  "title": "Software",
+  "desc": "All managed software: install status, service health, newer versions, and links to use in projects.",
+  "tabs": {
+    "overview": "Overview",
+    "runtimes": "Runtimes",
+    "databases": "Databases",
+    "edge": "Domains & edge",
+    "mailFiles": "Mail & files",
+    "host": "Host services"
+  },
+  "stat": {
+    "catalog": "Catalog items",
+    "runtimesInstalled": "Runtimes installed",
+    "updates": "Updates / expandable",
+    "attention": "Needs attention"
+  },
+  "quickTitle": "Shortcuts",
+  "quickDesc": "Jump to a section or host tools",
+  "updatesTitle": "Updates & installable versions",
+  "updatesDesc": "Newer upstream or panel pins. Install, then select the runtime on a project.",
+  "allSoftware": "All software",
+  "status": {
+    "unknown": "—",
+    "installed": "Installed",
+    "notInstalled": "Not installed",
+    "running": "Running",
+    "missing": "Not detected",
+    "failed": "Failed",
+    "stopped": "Stopped"
+  },
+  "badge": {
+    "update": "Update available",
+    "upToDate": "Up to date"
+  },
+  "meta": {
+    "installed": "Installed: {{list}}",
+    "default": "Default {{v}}",
+    "remote": "Upstream ~{{v}}",
+    "openManage": "Open manage page to install or configure",
+    "aptCurrentLatest": "Installed {{v}} · repo is latest",
+    "aptVersion": "Installed {{v}}",
+    "aptUpgrade": "{{from}} → {{to}} available",
+    "aptUpgradeMulti": "{{n}} packages upgradable: {{list}}",
+    "aptNotInstalled": "Package not installed (open manage page to install)",
+    "hostUpgradable": "~{{n}} upgradable packages on host",
+    "checking": "Checking versions… or open manage page"
+  },
+  "action": {
+    "manage": "Manage",
+    "useInProject": "Use in project",
+    "useInProjectTitle": "Open projects to set this runtime",
+    "update": "Update",
+    "updateTitle": "Install or switch to {{v}}",
+    "updateTo": "Update to {{v}}",
+    "installVersion": "Install {{v}}",
+    "applyAptTitle": "Confirm update {{pkg}}",
+    "updateN": "Update {{n}} items",
+    "installTitle": "Install {{list}}",
+    "install": "Install",
+    "updateAptTitle": "Open Updates for {{pkg}}"
+  },
+  "apply": {
+    "blockedShort": "Blocked",
+    "failedShort": "Failed",
+    "failed": "Update failed",
+    "blocked": "Blocked",
+    "confirm": "Confirm update",
+    "confirmTitle": "Confirm software update?",
+    "confirmBody": "Update {{pkg}}: {{from}} → {{to}}. Needs system-change rights.",
+    "ok": "Applied {{pkg}}",
+    "progress": "Updating {{n}}/{{total}}: {{pkg}}",
+    "okMulti": "Updated: {{list}}",
+    "okMultiTitle": "{{label}} updated",
+    "partial": "Partial success",
+    "partialTitle": "Some updates failed",
+    "failedTitle": "{{label}} update failed",
+    "progressDetail": "{{from}} → {{to}}",
+    "confirmBodyMulti": "Update {{label}}: {{list}}"
+  },
+  "version": {
+    "loading": "Loading versions…",
+    "installed": "Installed",
+    "latest": "Latest",
+    "upToDate": "Up to date / repo latest",
+    "refresh": "Recheck latest",
+    "pick": "Pick version",
+    "noTarget": "No update target",
+    "needRuntimePage": "Install this version on the runtime page",
+    "noAptCandidate": "No apt candidate version"
+  },
+  "install": {
+    "progress": "Installing: {{list}}…",
+    "progressHint": "May take a minute or two",
+    "blockedTitle": "{{label}} could not install",
+    "ok": "Install queued: {{list}}",
+    "okTitle": "{{label}} installed / queued",
+    "failedTitle": "{{label}} install failed",
+    "confirmTitle": "Confirm software install?",
+    "confirmBody": "Install {{label}}: {{list}}. Needs system-change rights.",
+    "confirm": "Confirm install"
+  },
+  "runtime": {
+    "installing": "Installing/updating {{kind}} {{v}}…",
+    "installingHint": "May take a minute or two",
+    "blockedTitle": "{{kind}} {{v}} could not install",
+    "installed": "Installed/updated {{kind}} {{v}}",
+    "installedDetail": "Select this version on a project",
+    "failedTitle": "{{kind}} {{v}} install failed",
+    "installingShort": "Installing…"
+  },
+  "aptSummaryTitle": "Repo upgrades available",
+  "aptSummaryDesc": "Catalog and host package counts are separate; apply from Updates or a card.",
+  "aptSummary": {
+    "catalog": "Catalog {{n}}",
+    "host": "Host packages {{n}}",
+    "openUpdates": "Open updates"
+  },
+  "navBadgeTitle": "Catalog upgrades: {{n}}",
+  "projectHint": "Runtime {{runtime}} prefilled — create a project",
+  "projectHintWithVersion": "Runtime {{runtime}} {{version}} prefilled — create a project"
+}

package/locales/en/softwareBanner.json

@@ -0,0 +1,14 @@
+{
+  "titleDefault": "Required software is not installed",
+  "missing": "Missing: {{names}}",
+  "nameSep": ", ",
+  "installOneClick": "Install now",
+  "installing": "Installing…",
+  "reprobe": "Re-check",
+  "close": "Close",
+  "resultTitle": "Install result",
+  "probeFailed": "Probe failed",
+  "installIncomplete": "Install incomplete",
+  "installedOne": "Installed {{name}}",
+  "allInstalled": "Required software installed"
+}