ysk-server-shared 1.1.22 → 1.1.24

package/locales/bn/dns.json

@@ -26,7 +26,8 @@
     "cluster": "ক্লাস্টার",
     "dnssec": "DNSSEC",
     "tools": "টুলস",
-    "about": "সম্পর্কে"
+    "about": "সম্পর্কে",
+    "ddns": "DDNS"
   },
   "recentWrite": "সাম্প্রতিক লেখার ফলাফল",
   "zonesTitle": "অঞ্চল ({{count}})",
@@ -236,5 +237,101 @@
   "goStartService": "Start DNS service",
   "startBindHint": "If start returns to stopped, port 53 is often held by systemd-resolved. Use Heal bind below, then start again.",
   "digNotInstalled": "dig is not installed",
-  "digNotInstalledHint": "This tab needs the dig binary (bind9-dnsutils). That is not NXDOMAIN. Install bind9-dnsutils from the host package manager; this page does not auto-install it."
+  "digNotInstalledHint": "This tab needs the dig binary (bind9-dnsutils). That is not NXDOMAIN. Install bind9-dnsutils from the host package manager; this page does not auto-install it.",
+  "aboutDdnsTitle": "DDNS",
+  "aboutDdnsBody": "The DDNS tab updates named A/AAAA records when this host’s WAN address changes. It does not replace zone CRUD. Written is not the same as public resolver truth.",
+  "ddns": {
+    "honesty": "A successful write is not public DNS yet. Resolver caches and registrar NS still apply. Empty or private IPs are never published.",
+    "needExecute": "Provider updates need root and YSK_EXECUTE=1. Detection still runs.",
+    "lastRun": "Last run",
+    "updateNow": "Update now",
+    "updateTitle": "Publish detected WAN addresses?",
+    "updateDesc": "Calls Cloudflare, nsupdate, or the local zone for each enabled record. Type UPDATE to confirm.",
+    "updated": "DDNS update finished",
+    "updateFailed": "DDNS update failed",
+    "saved": "Saved",
+    "saveFailed": "Could not save",
+    "deleted": "Record removed",
+    "emptyTitle": "No DDNS records",
+    "emptyDesc": "Add a hostname below. Cloudflare, RFC 2136, or this host’s PowerDNS zone (managedBy=ddns).",
+    "colFqdn": "Hostname",
+    "colProvider": "Provider",
+    "colPublished": "Published",
+    "zone": "Zone",
+    "zoneHint": "Leave empty to use the last two labels of the hostname",
+    "providerLocal": "Local PowerDNS",
+    "proxied": "Cloudflare proxied",
+    "proxiedHint": "Orange cloud. Leave off for VPN / WireGuard hostnames.",
+    "addRecord": "Add hostname",
+    "interval": "Interval (seconds)",
+    "intervalHint": "60–86400. In-process scheduler; not crontab.",
+    "cfToken": "Cloudflare API token",
+    "cfTokenHint": "Write-only. Env CF_API_TOKEN is used if set. Never shown again.",
+    "updateIdentity": "Remember WAN IPv4",
+    "updateIdentityHint": "Store last public IPv4 in DDNS status for this host",
+    "vpnHint": "VPN Endpoint can use a DDNS hostname (not rewritten automatically).",
+    "sslHint": "Let’s Encrypt HTTP-01 needs the hostname to resolve here. Certificates are not reissued on IP change.",
+    "deleteTitle": "Remove DDNS hostname?",
+    "deleteDesc": "Type {{fqdn}} to confirm. Local managedBy=ddns rows are not deleted from the zone editor.",
+    "nextRun": "Next run",
+    "wanRemembered": "Remembered WAN IPv4",
+    "probe": "Probe WAN",
+    "probed": "WAN probe finished",
+    "probeFailedUi": "WAN probe failed",
+    "forceHint": "Update now republishes even when the address is unchanged. Probe never calls a provider.",
+    "colEnabled": "State",
+    "colFrom": "From",
+    "colTo": "To",
+    "colWhen": "When",
+    "colNote": "Note",
+    "pauseRecord": "Pause",
+    "resumeRecord": "Resume",
+    "statusCard": "WAN status",
+    "recordsCard": "Hostnames",
+    "addCard": "Add hostname",
+    "settingsCard": "Settings",
+    "historyTitle": "Recent updates",
+    "historyEmpty": "No DDNS history yet",
+    "paused": "Scheduler paused",
+    "pausedHint": "Scheduled updates are off. Probe and Update now still run.",
+    "schedulerOn": "Scheduled updates",
+    "schedulerOnHint": "In-process scheduler. Not crontab. Off means no automatic upsert.",
+    "zoneSelectHint": "Local zones on this host. Cloudflare and RFC 2136 can use any zone name.",
+    "noLocalZones": "No local zones yet. Create one on the Zones tab first if you use Local PowerDNS.",
+    "proxiedWarnTitle": "Cloudflare orange cloud?",
+    "proxiedWarnDesc": "A proxied record hides the origin IP. VPN and WireGuard hostnames should stay DNS only. Type PROXY to confirm.",
+    "tokenConfigured": "A Cloudflare token is stored. Leave blank to keep it.",
+    "tokenMissing": "No Cloudflare token stored (env CF_API_TOKEN still applies).",
+    "rfcServer": "RFC 2136 server",
+    "rfcServerHint": "Remote servers need a TSIG key file under the data directory. Loopback may be unsigned. The secret is never passed on argv.",
+    "rfcKeyFile": "TSIG key file",
+    "rfcKeyFileHint": "Relative to the DDNS data directory, or an absolute path under the data directory.",
+    "rfcKeyConfigured": "A key file path is stored. Leave blank to keep it.",
+    "primaryFqdn": "Primary hostname",
+    "primaryFqdnHint": "Used as a VPN endpoint hint. Does not rewrite existing peers.",
+    "err": {
+      "requiresExecute": "Needs root and YSK_EXECUTE=1 to publish.",
+      "missingToken": "Cloudflare API token is missing.",
+      "rfc2136NeedKey": "Remote RFC 2136 needs a TSIG key file under the data directory.",
+      "rfc2136KeyMissing": "TSIG key file is missing or outside the data directory.",
+      "noPublicIpv4": "No public IPv4 detected.",
+      "noPublicIpv6": "No public IPv6 detected.",
+      "notPublicIpv4": "Detected IPv4 is not public.",
+      "notPublicIpv6": "Detected IPv6 is not public.",
+      "probeFailed": "Public IP probe failed.",
+      "localNoZone": "No local DNS zone for this hostname.",
+      "localNeedsDb": "Local provider needs the control-plane database.",
+      "managedByClash": "That name is owned by another feature (not DDNS).",
+      "unknownProvider": "Unknown DDNS provider.",
+      "nsupdateFailed": "nsupdate failed.",
+      "updateFailed": "Provider update failed.",
+      "invalidFqdn": "Invalid hostname.",
+      "invalidType": "Type must be A or AAAA.",
+      "invalidProvider": "Unknown provider.",
+      "notFound": "Record not found.",
+      "confirmMismatch": "Confirm must match the hostname.",
+      "schedulerDisabled": "Scheduled DDNS is paused.",
+      "provider": "Provider returned an error."
+    }
+  }
 }

package/locales/bn/translation.json

@@ -2978,7 +2978,8 @@
       "cluster": "ক্লাস্টার",
       "dnssec": "DNSSEC",
       "tools": "টুলস",
-      "about": "সম্পর্কে"
+      "about": "সম্পর্কে",
+      "ddns": "DDNS"
     },
     "recentWrite": "সাম্প্রতিক লেখার ফলাফল",
     "zonesTitle": "অঞ্চল ({{count}})",
@@ -3188,7 +3189,103 @@
     "goStartService": "Start DNS service",
     "startBindHint": "If start returns to stopped, port 53 is often held by systemd-resolved. Use Heal bind below, then start again.",
     "digNotInstalled": "dig is not installed",
-    "digNotInstalledHint": "This tab needs the dig binary (bind9-dnsutils). That is not NXDOMAIN. Install bind9-dnsutils from the host package manager; this page does not auto-install it."
+    "digNotInstalledHint": "This tab needs the dig binary (bind9-dnsutils). That is not NXDOMAIN. Install bind9-dnsutils from the host package manager; this page does not auto-install it.",
+    "aboutDdnsTitle": "DDNS",
+    "aboutDdnsBody": "The DDNS tab updates named A/AAAA records when this host’s WAN address changes. It does not replace zone CRUD. Written is not the same as public resolver truth.",
+    "ddns": {
+      "honesty": "A successful write is not public DNS yet. Resolver caches and registrar NS still apply. Empty or private IPs are never published.",
+      "needExecute": "Provider updates need root and YSK_EXECUTE=1. Detection still runs.",
+      "lastRun": "Last run",
+      "updateNow": "Update now",
+      "updateTitle": "Publish detected WAN addresses?",
+      "updateDesc": "Calls Cloudflare, nsupdate, or the local zone for each enabled record. Type UPDATE to confirm.",
+      "updated": "DDNS update finished",
+      "updateFailed": "DDNS update failed",
+      "saved": "Saved",
+      "saveFailed": "Could not save",
+      "deleted": "Record removed",
+      "emptyTitle": "No DDNS records",
+      "emptyDesc": "Add a hostname below. Cloudflare, RFC 2136, or this host’s PowerDNS zone (managedBy=ddns).",
+      "colFqdn": "Hostname",
+      "colProvider": "Provider",
+      "colPublished": "Published",
+      "zone": "Zone",
+      "zoneHint": "Leave empty to use the last two labels of the hostname",
+      "providerLocal": "Local PowerDNS",
+      "proxied": "Cloudflare proxied",
+      "proxiedHint": "Orange cloud. Leave off for VPN / WireGuard hostnames.",
+      "addRecord": "Add hostname",
+      "interval": "Interval (seconds)",
+      "intervalHint": "60–86400. In-process scheduler; not crontab.",
+      "cfToken": "Cloudflare API token",
+      "cfTokenHint": "Write-only. Env CF_API_TOKEN is used if set. Never shown again.",
+      "updateIdentity": "Remember WAN IPv4",
+      "updateIdentityHint": "Store last public IPv4 in DDNS status for this host",
+      "vpnHint": "VPN Endpoint can use a DDNS hostname (not rewritten automatically).",
+      "sslHint": "Let’s Encrypt HTTP-01 needs the hostname to resolve here. Certificates are not reissued on IP change.",
+      "deleteTitle": "Remove DDNS hostname?",
+      "deleteDesc": "Type {{fqdn}} to confirm. Local managedBy=ddns rows are not deleted from the zone editor.",
+      "nextRun": "Next run",
+      "wanRemembered": "Remembered WAN IPv4",
+      "probe": "Probe WAN",
+      "probed": "WAN probe finished",
+      "probeFailedUi": "WAN probe failed",
+      "forceHint": "Update now republishes even when the address is unchanged. Probe never calls a provider.",
+      "colEnabled": "State",
+      "colFrom": "From",
+      "colTo": "To",
+      "colWhen": "When",
+      "colNote": "Note",
+      "pauseRecord": "Pause",
+      "resumeRecord": "Resume",
+      "statusCard": "WAN status",
+      "recordsCard": "Hostnames",
+      "addCard": "Add hostname",
+      "settingsCard": "Settings",
+      "historyTitle": "Recent updates",
+      "historyEmpty": "No DDNS history yet",
+      "paused": "Scheduler paused",
+      "pausedHint": "Scheduled updates are off. Probe and Update now still run.",
+      "schedulerOn": "Scheduled updates",
+      "schedulerOnHint": "In-process scheduler. Not crontab. Off means no automatic upsert.",
+      "zoneSelectHint": "Local zones on this host. Cloudflare and RFC 2136 can use any zone name.",
+      "noLocalZones": "No local zones yet. Create one on the Zones tab first if you use Local PowerDNS.",
+      "proxiedWarnTitle": "Cloudflare orange cloud?",
+      "proxiedWarnDesc": "A proxied record hides the origin IP. VPN and WireGuard hostnames should stay DNS only. Type PROXY to confirm.",
+      "tokenConfigured": "A Cloudflare token is stored. Leave blank to keep it.",
+      "tokenMissing": "No Cloudflare token stored (env CF_API_TOKEN still applies).",
+      "rfcServer": "RFC 2136 server",
+      "rfcServerHint": "Remote servers need a TSIG key file under the data directory. Loopback may be unsigned. The secret is never passed on argv.",
+      "rfcKeyFile": "TSIG key file",
+      "rfcKeyFileHint": "Relative to the DDNS data directory, or an absolute path under the data directory.",
+      "rfcKeyConfigured": "A key file path is stored. Leave blank to keep it.",
+      "primaryFqdn": "Primary hostname",
+      "primaryFqdnHint": "Used as a VPN endpoint hint. Does not rewrite existing peers.",
+      "err": {
+        "requiresExecute": "Needs root and YSK_EXECUTE=1 to publish.",
+        "missingToken": "Cloudflare API token is missing.",
+        "rfc2136NeedKey": "Remote RFC 2136 needs a TSIG key file under the data directory.",
+        "rfc2136KeyMissing": "TSIG key file is missing or outside the data directory.",
+        "noPublicIpv4": "No public IPv4 detected.",
+        "noPublicIpv6": "No public IPv6 detected.",
+        "notPublicIpv4": "Detected IPv4 is not public.",
+        "notPublicIpv6": "Detected IPv6 is not public.",
+        "probeFailed": "Public IP probe failed.",
+        "localNoZone": "No local DNS zone for this hostname.",
+        "localNeedsDb": "Local provider needs the control-plane database.",
+        "managedByClash": "That name is owned by another feature (not DDNS).",
+        "unknownProvider": "Unknown DDNS provider.",
+        "nsupdateFailed": "nsupdate failed.",
+        "updateFailed": "Provider update failed.",
+        "invalidFqdn": "Invalid hostname.",
+        "invalidType": "Type must be A or AAAA.",
+        "invalidProvider": "Unknown provider.",
+        "notFound": "Record not found.",
+        "confirmMismatch": "Confirm must match the hostname.",
+        "schedulerDisabled": "Scheduled DDNS is paused.",
+        "provider": "Provider returned an error."
+      }
+    }
   },
   "docker": {
     "title": "Docker",
@@ -14624,6 +14721,9 @@
     "portRequired": "Listen port is required.",
     "importInvalid": "Could not detect a WireGuard or OpenVPN client conf.",
     "qrFailed": "Could not generate a QR code for this config. Download or copy the text instead.",
-    "cfgTitle": "Config — {{name}}"
+    "cfgTitle": "Config — {{name}}",
+    "ddnsFill": "Use DDNS hostname",
+    "ddnsFilled": "Filled endpoint host from DDNS. Peers are unchanged.",
+    "ddnsFillEmpty": "No DDNS primary hostname yet. Add one on the DNS DDNS tab."
   }
 }

package/locales/bn/vpn.json

@@ -156,5 +156,8 @@
   "portRequired": "Listen port is required.",
   "importInvalid": "Could not detect a WireGuard or OpenVPN client conf.",
   "qrFailed": "Could not generate a QR code for this config. Download or copy the text instead.",
-  "cfgTitle": "Config — {{name}}"
+  "cfgTitle": "Config — {{name}}",
+  "ddnsFill": "Use DDNS hostname",
+  "ddnsFilled": "Filled endpoint host from DDNS. Peers are unchanged.",
+  "ddnsFillEmpty": "No DDNS primary hostname yet. Add one on the DNS DDNS tab."
 }

package/locales/en/dns.json

@@ -26,6 +26,7 @@
     "cluster": "Cluster",
     "dnssec": "DNSSEC",
     "tools": "Tools",
+    "ddns": "DDNS",
     "about": "About"
   },
   "recentWrite": "Recent write result",
@@ -227,6 +228,102 @@
   "aboutHealthBody": "Use Tools to probe PowerDNS, heal bind, and open port 53.",
   "aboutStackTitle": "Software",
   "aboutStackBody": "Check/update the PowerDNS package under Software.",
+  "aboutDdnsTitle": "DDNS",
+  "aboutDdnsBody": "The DDNS tab updates named A/AAAA records when this host’s WAN address changes. It does not replace zone CRUD. Written is not the same as public resolver truth.",
+  "ddns": {
+    "honesty": "A successful write is not public DNS yet. Resolver caches and registrar NS still apply. Empty or private IPs are never published.",
+    "needExecute": "Provider updates need root and YSK_EXECUTE=1. Detection still runs.",
+    "lastRun": "Last run",
+    "nextRun": "Next run",
+    "wanRemembered": "Remembered WAN IPv4",
+    "updateNow": "Update now",
+    "updateTitle": "Publish detected WAN addresses?",
+    "updateDesc": "Calls Cloudflare, nsupdate, or the local zone for each enabled record, even if the address is unchanged. Type UPDATE to confirm.",
+    "updated": "DDNS update finished",
+    "updateFailed": "DDNS update failed",
+    "probe": "Probe WAN",
+    "probed": "WAN probe finished",
+    "probeFailedUi": "WAN probe failed",
+    "forceHint": "Update now republishes even when the address is unchanged. Probe never calls a provider.",
+    "saved": "Saved",
+    "saveFailed": "Could not save",
+    "deleted": "Record removed",
+    "emptyTitle": "No DDNS records",
+    "emptyDesc": "Add a hostname below. Cloudflare, RFC 2136, or this host’s PowerDNS zone (managedBy=ddns).",
+    "colFqdn": "Hostname",
+    "colProvider": "Provider",
+    "colPublished": "Published",
+    "colEnabled": "State",
+    "colFrom": "From",
+    "colTo": "To",
+    "colWhen": "When",
+    "colNote": "Note",
+    "pauseRecord": "Pause",
+    "resumeRecord": "Resume",
+    "statusCard": "WAN status",
+    "recordsCard": "Hostnames",
+    "addCard": "Add hostname",
+    "settingsCard": "Settings",
+    "historyTitle": "Recent updates",
+    "historyEmpty": "No DDNS history yet",
+    "paused": "Scheduler paused",
+    "pausedHint": "Scheduled updates are off. Probe and Update now still run.",
+    "schedulerOn": "Scheduled updates",
+    "schedulerOnHint": "In-process scheduler. Not crontab. Off means no automatic upsert.",
+    "zone": "Zone",
+    "zoneHint": "Leave empty to use the last two labels of the hostname. Local provider should pick a zone that already exists.",
+    "zoneSelectHint": "Local zones on this host. Cloudflare and RFC 2136 can use any zone name.",
+    "noLocalZones": "No local zones yet. Create one on the Zones tab first if you use Local PowerDNS.",
+    "providerLocal": "Local PowerDNS",
+    "proxied": "Cloudflare proxied",
+    "proxiedHint": "Orange cloud. Leave off for VPN / WireGuard hostnames.",
+    "proxiedWarnTitle": "Cloudflare orange cloud?",
+    "proxiedWarnDesc": "A proxied record hides the origin IP. VPN and WireGuard hostnames should stay DNS only. Type PROXY to confirm.",
+    "addRecord": "Add hostname",
+    "interval": "Interval (seconds)",
+    "intervalHint": "60–86400. In-process scheduler; not crontab.",
+    "cfToken": "Cloudflare API token",
+    "cfTokenHint": "Write-only. Env CF_API_TOKEN is used if set. Never shown again.",
+    "tokenConfigured": "A Cloudflare token is stored. Leave blank to keep it.",
+    "tokenMissing": "No Cloudflare token stored (env CF_API_TOKEN still applies).",
+    "rfcServer": "RFC 2136 server",
+    "rfcServerHint": "Remote servers need a TSIG key file under the data directory. Loopback may be unsigned. The secret is never passed on argv.",
+    "rfcKeyFile": "TSIG key file",
+    "rfcKeyFileHint": "Relative to the DDNS data directory, or an absolute path under the data directory.",
+    "rfcKeyConfigured": "A key file path is stored. Leave blank to keep it.",
+    "primaryFqdn": "Primary hostname",
+    "primaryFqdnHint": "Used as a VPN endpoint hint. Does not rewrite existing peers.",
+    "updateIdentity": "Remember WAN IPv4",
+    "updateIdentityHint": "Store last public IPv4 in DDNS status for this host",
+    "vpnHint": "VPN Endpoint can use a DDNS hostname (not rewritten automatically).",
+    "sslHint": "Let’s Encrypt HTTP-01 needs the hostname to resolve here. Certificates are not reissued on IP change.",
+    "deleteTitle": "Remove DDNS hostname?",
+    "deleteDesc": "Type {{fqdn}} to confirm. Local managedBy=ddns rows are not deleted from the zone editor.",
+    "err": {
+      "requiresExecute": "Needs root and YSK_EXECUTE=1 to publish.",
+      "missingToken": "Cloudflare API token is missing.",
+      "rfc2136NeedKey": "Remote RFC 2136 needs a TSIG key file under the data directory.",
+      "rfc2136KeyMissing": "TSIG key file is missing or outside the data directory.",
+      "noPublicIpv4": "No public IPv4 detected.",
+      "noPublicIpv6": "No public IPv6 detected.",
+      "notPublicIpv4": "Detected IPv4 is not public.",
+      "notPublicIpv6": "Detected IPv6 is not public.",
+      "probeFailed": "Public IP probe failed.",
+      "localNoZone": "No local DNS zone for this hostname.",
+      "localNeedsDb": "Local provider needs the control-plane database.",
+      "managedByClash": "That name is owned by another feature (not DDNS).",
+      "unknownProvider": "Unknown DDNS provider.",
+      "nsupdateFailed": "nsupdate failed.",
+      "updateFailed": "Provider update failed.",
+      "invalidFqdn": "Invalid hostname.",
+      "invalidType": "Type must be A or AAAA.",
+      "invalidProvider": "Unknown provider.",
+      "notFound": "Record not found.",
+      "confirmMismatch": "Confirm must match the hostname.",
+      "schedulerDisabled": "Scheduled DDNS is paused.",
+      "provider": "Provider returned an error."
+    }
+  },
   "createMailZoneNow": "Created mail zone {{domain}}",
   "toolsFirewallTitle": "Firewall (UFW)",
   "toolsFirewallHint": "Allow or deny port 53. This does not start or stop PowerDNS.",

package/locales/en/translation.json

@@ -2978,6 +2978,7 @@
       "cluster": "Cluster",
       "dnssec": "DNSSEC",
       "tools": "Tools",
+      "ddns": "DDNS",
       "about": "About"
     },
     "recentWrite": "Recent write result",
@@ -3179,6 +3180,102 @@
     "aboutHealthBody": "Use Tools to probe PowerDNS, heal bind, and open port 53.",
     "aboutStackTitle": "Software",
     "aboutStackBody": "Check/update the PowerDNS package under Software.",
+    "aboutDdnsTitle": "DDNS",
+    "aboutDdnsBody": "The DDNS tab updates named A/AAAA records when this host’s WAN address changes. It does not replace zone CRUD. Written is not the same as public resolver truth.",
+    "ddns": {
+      "honesty": "A successful write is not public DNS yet. Resolver caches and registrar NS still apply. Empty or private IPs are never published.",
+      "needExecute": "Provider updates need root and YSK_EXECUTE=1. Detection still runs.",
+      "lastRun": "Last run",
+      "nextRun": "Next run",
+      "wanRemembered": "Remembered WAN IPv4",
+      "updateNow": "Update now",
+      "updateTitle": "Publish detected WAN addresses?",
+      "updateDesc": "Calls Cloudflare, nsupdate, or the local zone for each enabled record, even if the address is unchanged. Type UPDATE to confirm.",
+      "updated": "DDNS update finished",
+      "updateFailed": "DDNS update failed",
+      "probe": "Probe WAN",
+      "probed": "WAN probe finished",
+      "probeFailedUi": "WAN probe failed",
+      "forceHint": "Update now republishes even when the address is unchanged. Probe never calls a provider.",
+      "saved": "Saved",
+      "saveFailed": "Could not save",
+      "deleted": "Record removed",
+      "emptyTitle": "No DDNS records",
+      "emptyDesc": "Add a hostname below. Cloudflare, RFC 2136, or this host’s PowerDNS zone (managedBy=ddns).",
+      "colFqdn": "Hostname",
+      "colProvider": "Provider",
+      "colPublished": "Published",
+      "colEnabled": "State",
+      "colFrom": "From",
+      "colTo": "To",
+      "colWhen": "When",
+      "colNote": "Note",
+      "pauseRecord": "Pause",
+      "resumeRecord": "Resume",
+      "statusCard": "WAN status",
+      "recordsCard": "Hostnames",
+      "addCard": "Add hostname",
+      "settingsCard": "Settings",
+      "historyTitle": "Recent updates",
+      "historyEmpty": "No DDNS history yet",
+      "paused": "Scheduler paused",
+      "pausedHint": "Scheduled updates are off. Probe and Update now still run.",
+      "schedulerOn": "Scheduled updates",
+      "schedulerOnHint": "In-process scheduler. Not crontab. Off means no automatic upsert.",
+      "zone": "Zone",
+      "zoneHint": "Leave empty to use the last two labels of the hostname. Local provider should pick a zone that already exists.",
+      "zoneSelectHint": "Local zones on this host. Cloudflare and RFC 2136 can use any zone name.",
+      "noLocalZones": "No local zones yet. Create one on the Zones tab first if you use Local PowerDNS.",
+      "providerLocal": "Local PowerDNS",
+      "proxied": "Cloudflare proxied",
+      "proxiedHint": "Orange cloud. Leave off for VPN / WireGuard hostnames.",
+      "proxiedWarnTitle": "Cloudflare orange cloud?",
+      "proxiedWarnDesc": "A proxied record hides the origin IP. VPN and WireGuard hostnames should stay DNS only. Type PROXY to confirm.",
+      "addRecord": "Add hostname",
+      "interval": "Interval (seconds)",
+      "intervalHint": "60–86400. In-process scheduler; not crontab.",
+      "cfToken": "Cloudflare API token",
+      "cfTokenHint": "Write-only. Env CF_API_TOKEN is used if set. Never shown again.",
+      "tokenConfigured": "A Cloudflare token is stored. Leave blank to keep it.",
+      "tokenMissing": "No Cloudflare token stored (env CF_API_TOKEN still applies).",
+      "rfcServer": "RFC 2136 server",
+      "rfcServerHint": "Remote servers need a TSIG key file under the data directory. Loopback may be unsigned. The secret is never passed on argv.",
+      "rfcKeyFile": "TSIG key file",
+      "rfcKeyFileHint": "Relative to the DDNS data directory, or an absolute path under the data directory.",
+      "rfcKeyConfigured": "A key file path is stored. Leave blank to keep it.",
+      "primaryFqdn": "Primary hostname",
+      "primaryFqdnHint": "Used as a VPN endpoint hint. Does not rewrite existing peers.",
+      "updateIdentity": "Remember WAN IPv4",
+      "updateIdentityHint": "Store last public IPv4 in DDNS status for this host",
+      "vpnHint": "VPN Endpoint can use a DDNS hostname (not rewritten automatically).",
+      "sslHint": "Let’s Encrypt HTTP-01 needs the hostname to resolve here. Certificates are not reissued on IP change.",
+      "deleteTitle": "Remove DDNS hostname?",
+      "deleteDesc": "Type {{fqdn}} to confirm. Local managedBy=ddns rows are not deleted from the zone editor.",
+      "err": {
+        "requiresExecute": "Needs root and YSK_EXECUTE=1 to publish.",
+        "missingToken": "Cloudflare API token is missing.",
+        "rfc2136NeedKey": "Remote RFC 2136 needs a TSIG key file under the data directory.",
+        "rfc2136KeyMissing": "TSIG key file is missing or outside the data directory.",
+        "noPublicIpv4": "No public IPv4 detected.",
+        "noPublicIpv6": "No public IPv6 detected.",
+        "notPublicIpv4": "Detected IPv4 is not public.",
+        "notPublicIpv6": "Detected IPv6 is not public.",
+        "probeFailed": "Public IP probe failed.",
+        "localNoZone": "No local DNS zone for this hostname.",
+        "localNeedsDb": "Local provider needs the control-plane database.",
+        "managedByClash": "That name is owned by another feature (not DDNS).",
+        "unknownProvider": "Unknown DDNS provider.",
+        "nsupdateFailed": "nsupdate failed.",
+        "updateFailed": "Provider update failed.",
+        "invalidFqdn": "Invalid hostname.",
+        "invalidType": "Type must be A or AAAA.",
+        "invalidProvider": "Unknown provider.",
+        "notFound": "Record not found.",
+        "confirmMismatch": "Confirm must match the hostname.",
+        "schedulerDisabled": "Scheduled DDNS is paused.",
+        "provider": "Provider returned an error."
+      }
+    },
     "createMailZoneNow": "Created mail zone {{domain}}",
     "toolsFirewallTitle": "Firewall (UFW)",
     "toolsFirewallHint": "Allow or deny port 53. This does not start or stop PowerDNS.",
@@ -14526,6 +14623,9 @@
     "listenPortTcp": "Listen port (TCP)",
     "endpoint": "Public endpoint",
     "endpointHint": "Public host:port clients use to connect",
+    "ddnsFill": "Use DDNS hostname",
+    "ddnsFilled": "Filled endpoint host from DDNS. Peers are unchanged.",
+    "ddnsFillEmpty": "No DDNS primary hostname yet. Add one on the DNS DDNS tab.",
     "ensureServer": "Apply server",
     "openFirewall": "Open {{port}}/{{proto}}",
     "presets": "Port presets",

package/locales/en/vpn.json

@@ -58,6 +58,9 @@
   "listenPortTcp": "Listen port (TCP)",
   "endpoint": "Public endpoint",
   "endpointHint": "Public host:port clients use to connect",
+  "ddnsFill": "Use DDNS hostname",
+  "ddnsFilled": "Filled endpoint host from DDNS. Peers are unchanged.",
+  "ddnsFillEmpty": "No DDNS primary hostname yet. Add one on the DNS DDNS tab.",
   "ensureServer": "Apply server",
   "openFirewall": "Open {{port}}/{{proto}}",
   "presets": "Port presets",

package/locales/es/dns.json

@@ -26,7 +26,8 @@
     "cluster": "Grupo",
     "dnssec": "DNSSEC",
     "tools": "Herramientas",
-    "about": "Acerca de"
+    "about": "Acerca de",
+    "ddns": "DDNS"
   },
   "recentWrite": "Resultado de escritura reciente",
   "zonesTitle": "Zonas ({{count}})",
@@ -236,5 +237,101 @@
   "goStartService": "Start DNS service",
   "startBindHint": "If start returns to stopped, port 53 is often held by systemd-resolved. Use Heal bind below, then start again.",
   "digNotInstalled": "dig is not installed",
-  "digNotInstalledHint": "This tab needs the dig binary (bind9-dnsutils). That is not NXDOMAIN. Install bind9-dnsutils from the host package manager; this page does not auto-install it."
+  "digNotInstalledHint": "This tab needs the dig binary (bind9-dnsutils). That is not NXDOMAIN. Install bind9-dnsutils from the host package manager; this page does not auto-install it.",
+  "aboutDdnsTitle": "DDNS",
+  "aboutDdnsBody": "The DDNS tab updates named A/AAAA records when this host’s WAN address changes. It does not replace zone CRUD. Written is not the same as public resolver truth.",
+  "ddns": {
+    "honesty": "A successful write is not public DNS yet. Resolver caches and registrar NS still apply. Empty or private IPs are never published.",
+    "needExecute": "Provider updates need root and YSK_EXECUTE=1. Detection still runs.",
+    "lastRun": "Last run",
+    "updateNow": "Update now",
+    "updateTitle": "Publish detected WAN addresses?",
+    "updateDesc": "Calls Cloudflare, nsupdate, or the local zone for each enabled record. Type UPDATE to confirm.",
+    "updated": "DDNS update finished",
+    "updateFailed": "DDNS update failed",
+    "saved": "Saved",
+    "saveFailed": "Could not save",
+    "deleted": "Record removed",
+    "emptyTitle": "No DDNS records",
+    "emptyDesc": "Add a hostname below. Cloudflare, RFC 2136, or this host’s PowerDNS zone (managedBy=ddns).",
+    "colFqdn": "Hostname",
+    "colProvider": "Provider",
+    "colPublished": "Published",
+    "zone": "Zone",
+    "zoneHint": "Leave empty to use the last two labels of the hostname",
+    "providerLocal": "Local PowerDNS",
+    "proxied": "Cloudflare proxied",
+    "proxiedHint": "Orange cloud. Leave off for VPN / WireGuard hostnames.",
+    "addRecord": "Add hostname",
+    "interval": "Interval (seconds)",
+    "intervalHint": "60–86400. In-process scheduler; not crontab.",
+    "cfToken": "Cloudflare API token",
+    "cfTokenHint": "Write-only. Env CF_API_TOKEN is used if set. Never shown again.",
+    "updateIdentity": "Remember WAN IPv4",
+    "updateIdentityHint": "Store last public IPv4 in DDNS status for this host",
+    "vpnHint": "VPN Endpoint can use a DDNS hostname (not rewritten automatically).",
+    "sslHint": "Let’s Encrypt HTTP-01 needs the hostname to resolve here. Certificates are not reissued on IP change.",
+    "deleteTitle": "Remove DDNS hostname?",
+    "deleteDesc": "Type {{fqdn}} to confirm. Local managedBy=ddns rows are not deleted from the zone editor.",
+    "nextRun": "Next run",
+    "wanRemembered": "Remembered WAN IPv4",
+    "probe": "Probe WAN",
+    "probed": "WAN probe finished",
+    "probeFailedUi": "WAN probe failed",
+    "forceHint": "Update now republishes even when the address is unchanged. Probe never calls a provider.",
+    "colEnabled": "State",
+    "colFrom": "From",
+    "colTo": "To",
+    "colWhen": "When",
+    "colNote": "Note",
+    "pauseRecord": "Pause",
+    "resumeRecord": "Resume",
+    "statusCard": "WAN status",
+    "recordsCard": "Hostnames",
+    "addCard": "Add hostname",
+    "settingsCard": "Settings",
+    "historyTitle": "Recent updates",
+    "historyEmpty": "No DDNS history yet",
+    "paused": "Scheduler paused",
+    "pausedHint": "Scheduled updates are off. Probe and Update now still run.",
+    "schedulerOn": "Scheduled updates",
+    "schedulerOnHint": "In-process scheduler. Not crontab. Off means no automatic upsert.",
+    "zoneSelectHint": "Local zones on this host. Cloudflare and RFC 2136 can use any zone name.",
+    "noLocalZones": "No local zones yet. Create one on the Zones tab first if you use Local PowerDNS.",
+    "proxiedWarnTitle": "Cloudflare orange cloud?",
+    "proxiedWarnDesc": "A proxied record hides the origin IP. VPN and WireGuard hostnames should stay DNS only. Type PROXY to confirm.",
+    "tokenConfigured": "A Cloudflare token is stored. Leave blank to keep it.",
+    "tokenMissing": "No Cloudflare token stored (env CF_API_TOKEN still applies).",
+    "rfcServer": "RFC 2136 server",
+    "rfcServerHint": "Remote servers need a TSIG key file under the data directory. Loopback may be unsigned. The secret is never passed on argv.",
+    "rfcKeyFile": "TSIG key file",
+    "rfcKeyFileHint": "Relative to the DDNS data directory, or an absolute path under the data directory.",
+    "rfcKeyConfigured": "A key file path is stored. Leave blank to keep it.",
+    "primaryFqdn": "Primary hostname",
+    "primaryFqdnHint": "Used as a VPN endpoint hint. Does not rewrite existing peers.",
+    "err": {
+      "requiresExecute": "Needs root and YSK_EXECUTE=1 to publish.",
+      "missingToken": "Cloudflare API token is missing.",
+      "rfc2136NeedKey": "Remote RFC 2136 needs a TSIG key file under the data directory.",
+      "rfc2136KeyMissing": "TSIG key file is missing or outside the data directory.",
+      "noPublicIpv4": "No public IPv4 detected.",
+      "noPublicIpv6": "No public IPv6 detected.",
+      "notPublicIpv4": "Detected IPv4 is not public.",
+      "notPublicIpv6": "Detected IPv6 is not public.",
+      "probeFailed": "Public IP probe failed.",
+      "localNoZone": "No local DNS zone for this hostname.",
+      "localNeedsDb": "Local provider needs the control-plane database.",
+      "managedByClash": "That name is owned by another feature (not DDNS).",
+      "unknownProvider": "Unknown DDNS provider.",
+      "nsupdateFailed": "nsupdate failed.",
+      "updateFailed": "Provider update failed.",
+      "invalidFqdn": "Invalid hostname.",
+      "invalidType": "Type must be A or AAAA.",
+      "invalidProvider": "Unknown provider.",
+      "notFound": "Record not found.",
+      "confirmMismatch": "Confirm must match the hostname.",
+      "schedulerDisabled": "Scheduled DDNS is paused.",
+      "provider": "Provider returned an error."
+    }
+  }
 }