ysk-server-shared 1.1.23 → 1.1.25

package/locales/bn/vnc.json

@@ -119,11 +119,15 @@
   },
   "installHint": "TigerVNC → noVNC; XFCE ঐচ্ছিক",
   "needTigerVnc": "TigerVNC প্রয়োজন",
+  "needXfceFirst": "প্রথমে XFCE ইন্সটল করুন",
+  "needSessionRunning": "সেশন চলছে না - প্রথমে এটি শুরু করুন",
   "needNovnc": "noVNC প্রয়োজন",
   "needXfce": "XFCE (ঐচ্ছিক)",
   "needViewer": "দর্শক (ঐচ্ছিক)",
   "needViewerOrNovnc": "ভিউয়ার বা noVNC",
   "settingsHint": "নতুন অ্যাকাউন্টের জন্য ডিফল্ট",
+  "settingsNeedStack": "TigerVNC (এবং XFCE নির্বাচিত হলে) ইনস্টল করা হলে এই ডিফল্টগুলি প্রযোজ্য হবে। প্রথমে ইন্সটল ট্যাবে এগুলি ইনস্টল করুন।",
+  "clientNeedNovnc": "ব্রাউজারে খুলুন noVNC প্রয়োজন। আপনি এখানে খুলতে চান এমন রিমোট যোগ করার আগে এটি ইনস্টল ট্যাবে ইনস্টল করুন।",
   "defaultDesktop": "ডিফল্ট ডেস্কটপ",
   "defaultGeometry": "ডিফল্ট রেজোলিউশন",
   "defaultDepth": "রঙের গভীরতা",
@@ -169,6 +173,14 @@
   "start": "শুরু করুন",
   "stop": "থামো",
   "startAfterCreate": "তৈরি করার পর শুরু করুন",
+  "hostnameBroken": "এই হোস্ট তার নিজস্ব হোস্টনাম ({{hostname}}) সমাধান করতে পারে না। অধিবেশন শুরু ব্যর্থ হবে.",
+  "hostnameBrokenIdle": "Hostname {{hostname}} does not resolve on this host. Fix /etc/hosts before you create a session.",
+  "hostnameFix": "/etc/hosts-এ হোস্টনাম লিখুন",
+  "hostnameFixTitle": "এই লাইনটি /etc/hosts এ যুক্ত করবেন?",
+  "hostnameFixDesc": "{{line}}",
+  "hostnameFixDone": "হোস্টনাম /etc/hosts আপডেট করা হয়েছে",
+  "startAfterCreateBlocked": "হোস্টনাম সমাধান না হওয়া পর্যন্ত নিষ্ক্রিয়",
+  "startHostnameBlocked": "এই হোস্ট তার হোস্টনাম সমাধান না করা পর্যন্ত শুরু করা যাবে না৷ \"/etc/hosts-এ হোস্টনাম লিখুন\" ব্যবহার করুন।",
   "colName": "নাম",
   "colLinuxUser": "লিনাক্স ব্যবহারকারী",
   "colDisplay": "প্রদর্শন / পোর্ট",
@@ -200,6 +212,10 @@
   "deleteAccountC3User": "লিনাক্স ব্যবহারকারীর বাড়ি সরানো হবে (userdel -r)",
   "deleteAccountC3Keep": "লিনাক্স ব্যবহারকারীদের সিস্টেমে রাখা হবে",
   "removeLinuxUser": "এছাড়াও লিনাক্স ব্যবহারকারী এবং হোম ডিরেক্টরি মুছে ফেলুন",
+  "deleteKeepUserWarn": "লিনাক্স ব্যবহারকারী এতিম হিসাবে হোস্টে থাকবেন। আপনাকে পরে পরিষ্কার করতে হবে।",
+  "bindRfbLine": "RFB {{bind}} :{{port}}",
+  "bindNovncLine": "noVNC 127.0.0.1:{{port}}",
+  "bindNovncHint": "noVNC লোকালহোস্টে শোনে। ডেস্কটপ এই প্যানেলের মাধ্যমে পৌঁছেছে, পাবলিক ইন্টারনেট নয়, যদি না RFB বাইন্ড সমস্ত ইন্টারফেস না হয়।",
   "connection": "সংযোগ করুন",
   "connectionTitle": "সংযোগ উপকরণ",
   "connectionDesc": "ক্লায়েন্টরা কিভাবে {{name}} পৌঁছায়",
@@ -243,21 +259,5 @@
   "editClientTitle": "দূরবর্তী ক্লায়েন্ট সম্পাদনা করুন",
   "editClientDesc": "পাথ, হোস্ট এবং ঐচ্ছিক সংরক্ষিত পাসওয়ার্ড আপডেট করুন।",
   "clientUpdated": "ক্লায়েন্ট প্রোফাইল আপডেট করা হয়েছে",
-  "rememberNeedPassword": "প্রথমে একটি পাসওয়ার্ড দিন।",
-  "settingsNeedStack": "TigerVNC (এবং XFCE নির্বাচিত হলে) ইনস্টল করা হলে এই ডিফল্টগুলি প্রযোজ্য হবে। প্রথমে ইন্সটল ট্যাবে এগুলি ইনস্টল করুন।",
-  "clientNeedNovnc": "ব্রাউজারে খুলুন noVNC প্রয়োজন। আপনি এখানে খুলতে চান এমন রিমোট যোগ করার আগে এটি ইনস্টল ট্যাবে ইনস্টল করুন।",
-  "needXfceFirst": "Install XFCE first",
-  "needSessionRunning": "Session is not running — start it first",
-  "deleteKeepUserWarn": "The Linux user will stay on the host as an orphan. You must clean it up later.",
-  "bindRfbLine": "RFB {{bind}} :{{port}}",
-  "bindNovncLine": "noVNC 127.0.0.1:{{port}}",
-  "bindNovncHint": "noVNC listens on localhost. The desktop is reached through this panel, not the public internet, unless RFB bind is all interfaces.",
-  "hostnameBroken": "This host cannot resolve its own hostname ({{hostname}}). Session start will fail.",
-  "hostnameFix": "Write hostname to /etc/hosts",
-  "hostnameFixTitle": "Append this line to /etc/hosts?",
-  "hostnameFixDesc": "{{line}}",
-  "hostnameFixDone": "Hostname /etc/hosts updated",
-  "startAfterCreateBlocked": "Disabled until the hostname resolves",
-  "hostnameBrokenIdle": "Hostname {{hostname}} does not resolve on this host. Fix /etc/hosts before you create a session.",
-  "startHostnameBlocked": "Cannot start until this host can resolve its hostname. Use “Write hostname to /etc/hosts”."
+  "rememberNeedPassword": "প্রথমে একটি পাসওয়ার্ড দিন।"
 }

package/locales/bn/vpn.json

@@ -58,9 +58,17 @@
   "listenPortTcp": "লিসেন পোর্ট (TCP)",
   "endpoint": "পাবলিক এন্ডপয়েন্ট",
   "endpointHint": "পাবলিক হোস্ট: পোর্ট ক্লায়েন্টরা সংযোগ করতে ব্যবহার করে",
+  "ddnsFill": "DDNS হোস্টনাম ব্যবহার করুন",
+  "ddnsFilled": "DDNS থেকে পরিপূর্ণ এন্ডপয়েন্ট হোস্ট। সহকর্মীরা অপরিবর্তিত।",
+  "ddnsFillEmpty": "এখনও কোন DDNS প্রাথমিক হোস্টনাম নেই। DNS DDNS ট্যাবে একটি যোগ করুন।",
   "ensureServer": "সার্ভার প্রয়োগ করুন",
   "openFirewall": "খোলা {{port}}/{{proto}}",
   "presets": "পোর্ট প্রিসেট",
+  "portHint": {
+    "51820": "ডিফল্ট ওয়্যারগার্ড লিসেন পোর্ট",
+    "51821": "বিকল্প ওয়্যারগার্ড শোনার পোর্ট",
+    "51822": "দ্বিতীয় বিকল্প ওয়্যারগার্ড লিসেন পোর্ট"
+  },
   "proto": "প্রোটোকল",
   "protoUdp": "UDP",
   "protoTcp": "TCP",
@@ -71,7 +79,27 @@
   "peersTitleSs": "অ্যাক্সেস কী",
   "peerName": "নাম",
   "peerNamePlaceholder": "ফোন",
+  "peerNameHint": "অক্ষর, অঙ্ক, . _ - — কোন স্পেস নেই, / অথবা!",
+  "peerNameInvalid": "স্থান, / এবং! অনুমোদিত নয় {{preview}} ব্যবহার করুন বা নাম পরিবর্তন করুন।",
   "addPeer": "+ যোগ করুন",
+  "installEngineFirst": "প্রথমে VPN ইঞ্জিন ইনস্টল করুন",
+  "needServerRunning": "{{engine}} চলছে না — প্রথমে সার্ভারটি প্রয়োগ করুন",
+  "engineSummarySoftware": "{{installed}} ইনস্টল করা হয়েছে · {{running}} চলছে",
+  "privateKeyOnce": "ক্লায়েন্ট ব্যক্তিগত কী শুধুমাত্র এখানে দেখানো হয়. এটি এখনই ডাউনলোড বা অনুলিপি করুন - এটি পরে পুনরুদ্ধার করা যাবে না।",
+  "showPrivateKey": "ব্যক্তিগত কী দেখান",
+  "hidePrivateKey": "ব্যক্তিগত কী লুকান",
+  "deletePeerTitle": "পিয়ার {{name}} মুছবেন?",
+  "deletePeerDesc": "Remove {{name}} ({{address}}). The client disconnects immediately and the config cannot be restored.",
+  "deleteClientTitle": "OpenVPN ক্লায়েন্ট {{name}} মুছবেন?",
+  "deleteClientDesc": "{{name}} ({{address}}) সরান। ক্লায়েন্ট অবিলম্বে সংযোগ বিচ্ছিন্ন এবং প্রোফাইল পুনরুদ্ধার করা যাবে না. OpenVPN সার্ভার আপ থাকে।",
+  "deleteKeyTitle": "Shadowsocks কী {{name}} মুছবেন?",
+  "deleteKeyDesc": "অ্যাক্সেস কী {{name}} ({{address}}) সরান। এই কী ব্যবহার করে ক্লায়েন্ট সংযোগ বিচ্ছিন্ন করে। Shadowsocks সার্ভার আপ থাকে.",
+  "deleteResult": "সরানো হয়েছে {{name}}।",
+  "portInvalid": "লিসেন পোর্ট 1 থেকে 65535 পর্যন্ত একটি পূর্ণসংখ্যা হতে হবে।",
+  "portRequired": "লিসেন পোর্ট প্রয়োজন।",
+  "importInvalid": "একটি WireGuard বা OpenVPN ক্লায়েন্ট কনফ সনাক্ত করা যায়নি৷",
+  "qrFailed": "এই কনফিগারেশনের জন্য একটি QR কোড তৈরি করা যায়নি। পরিবর্তে পাঠ্যটি ডাউনলোড বা অনুলিপি করুন।",
+  "cfgTitle": "কনফিগারেশন — {{name}}",
   "addPeerWg": "+ সহকর্মী যোগ করুন",
   "addPeerOvpn": "+ ক্লায়েন্ট যোগ করুন",
   "addPeerSs": "+ কী যোগ করুন",
@@ -127,34 +155,9 @@
     "lanCidrs": "ল্যান নেটওয়ার্ক",
     "customCidr": "CIDR",
     "addCidr": "যোগ করুন",
-    "cidrRequired": "Enter a CIDR (for example 192.168.1.0/24).",
-    "cidrInvalid": "Enter a valid CIDR, for example 192.168.1.0/24."
+    "cidrRequired": "একটি CIDR লিখুন (উদাহরণস্বরূপ 192.168.1.0/24)।",
+    "cidrInvalid": "একটি বৈধ CIDR লিখুন, উদাহরণস্বরূপ 192.168.1.0/24৷"
   },
   "engineNotInstalled": "এই VPN ইঞ্জিন হোস্টে ইনস্টল নেই।",
-  "serverNotListening": "সার্ভার ইউনিট সক্রিয় নয়। UDP/TCP {{port}} বন্ধ থাকতে পারে।",
-  "installEngineFirst": "প্রথমে VPN ইঞ্জিন ইনস্টল করুন",
-  "portHint": {
-    "51820": "ডিফল্ট ওয়্যারগার্ড লিসেন পোর্ট",
-    "51821": "বিকল্প ওয়্যারগার্ড শোনার পোর্ট",
-    "51822": "দ্বিতীয় বিকল্প ওয়্যারগার্ড লিসেন পোর্ট"
-  },
-  "needServerRunning": "{{engine}} is not running — apply the server first",
-  "engineSummarySoftware": "{{installed}} installed · {{running}} running",
-  "privateKeyOnce": "The client private key is shown only here. Download or copy it now — it cannot be recovered later.",
-  "showPrivateKey": "Show private key",
-  "hidePrivateKey": "Hide private key",
-  "deletePeerTitle": "Delete peer {{name}}?",
-  "deletePeerDesc": "Remove {{name}} ({{address}}). The client disconnects immediately and the config cannot be restored.",
-  "peerNameHint": "Letters, digits, . _ - — no spaces, / or !",
-  "peerNameInvalid": "Spaces, / and ! are not allowed. Use {{preview}} or change the name.",
-  "deleteClientTitle": "Delete OpenVPN client {{name}}?",
-  "deleteClientDesc": "Remove {{name}} ({{address}}). The client disconnects immediately and the profile cannot be restored. The OpenVPN server stays up.",
-  "deleteKeyTitle": "Delete Shadowsocks key {{name}}?",
-  "deleteKeyDesc": "Remove access key {{name}} ({{address}}). Clients using this key disconnect. The Shadowsocks server stays up.",
-  "deleteResult": "Removed {{name}}.",
-  "portInvalid": "Listen port must be an integer from 1 to 65535.",
-  "portRequired": "Listen port is required.",
-  "importInvalid": "Could not detect a WireGuard or OpenVPN client conf.",
-  "qrFailed": "Could not generate a QR code for this config. Download or copy the text instead.",
-  "cfgTitle": "Config — {{name}}"
+  "serverNotListening": "সার্ভার ইউনিট সক্রিয় নয়। UDP/TCP {{port}} বন্ধ থাকতে পারে।"
 }

package/locales/en/cli.json

@@ -12,7 +12,7 @@
   },
   "help": {
     "blurb": "Control plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json",
-    "main": "{{product}} ({{cli}}) v{{version}}\n\nControl plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\nUsage:\n  {{cli}} <command> [options]\n\nCommands:\n  setup                 Init dataDir + admin\n  update                Self-update check/apply\n  serve                 HTTP API + Web UI\n  system unit-install   Install ysk-server.service [--enable]\n  stack                 plans|bundles|status|install|uninstall\n  tools                 List tools; tools run --tool <name> [--dry-run]\n  ask                   NL → AI plan [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  users                 list|create|totp\n  packages              list\n  rbac                  list|show\n  audit                 list\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             App templates\n  hosting               nginx|dns|db|firewall helpers\n  dns                   zone|zones|lookup\n  logs                  sources|query|journal|overview\n  host                  overview|metrics (read-only)\n  nginx                 status|list|test|sync\n  ssl                   list|get (certificates)\n  db-cluster            list|get|create|plan (HA plan-first)\n  ssh-key               list|create|import|public|export|install|delete (SSH identity vault)\n  ssh-2fa               list|enroll|confirm|install|pam|retire (SSH login TOTP ≠ panel 2FA)\n  services              Host service matrix (systemctl probe)\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys (2FA flags · session revoke · API keys)\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register (panel + edge)\n  agent run             Outbound fleet poller (experimental)\n  store                 status|export|import|migrate (json|sqlite|postgres document backends)\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares (sandbox)\n  cron                  list|create|delete|enable|disable|run|install|status\n  email                 domains|mailboxes|deliverability|bootstrap|dns (panel parity)\n  health                Local mode snapshot or --url http://host:port/health\n  notifications         list\n  readiness | doctor    Production readiness (honest)\n  migrate               inventory|host|post|status|resume|orphan-homes (full host migrate)\n  vpn                   WireGuard / OpenVPN\n  vnc                   accounts|clients|share\n  apache                sites|settings\n  network               ifaces|exposure|real-ip\n  real-ip               CDN Real IP\n  updates               inventory|apply\n  software              list|install|uninstall\n  db                    MySQL / MariaDB / PostgreSQL\n  redis                 status|keys|get|set\n  ftp                   accounts|status\n  runtimes              list|install\n  bt-tracker            status|settings\n  validators            list|chains|disk|get (Beta)\n  docker                status|ps|images|compose|prune (engine)\n  version | help\n\nGlobal:\n  --json                JSON stdout (AI)\n  --data-dir PATH       also --data-dir=PATH or YSK_DATA_DIR\n  --config PATH\n  --locale CODE         CLI language (default en). Also YSK_LOCALE.\n                        Codes: en zh-HK zh-CN ja ko hi es ar fr bn pt id ur\n  --limit N --offset N  Slice large JSON lists (software / updates / host metrics / rbac)\n  --help | --version\n\nExit: 0 ok · 1 error · 2 validation · 3 blocked · 4 not found · 5 host error\n\nSafety:\n  Dangerous ops default to dry-run (plan only).\n  Pass --execute (alias --apply) + env YSK_EXECUTE=1 to mutate host.\n  Command names and flags are always English. --locale only translates messages.\n\nExamples:\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run plan\n  {{cli}} projects list --json\n  {{cli}} --locale=zh-HK help\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
+    "main": "{{product}} ({{cli}}) v{{version}}\n\nControl plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\nUsage:\n  {{cli}} <command> [options]\n\nCommands:\n  setup                 Init dataDir + admin\n  update                Self-update check/apply\n  serve                 HTTP API + Web UI\n  system unit-install   Install ysk-server.service [--enable]\n  stack                 plans|bundles|status|install|uninstall\n  tools                 List tools; tools run --tool <name> [--dry-run]\n  ask                   NL → AI plan [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  users                 list|create|totp\n  packages              list\n  rbac                  list|show\n  audit                 list\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             App templates\n  hosting               nginx|dns|db|firewall helpers\n  dns                   zone|zones|lookup|ddns\n  logs                  sources|query|journal|overview\n  host                  overview|metrics (read-only)\n  nginx                 status|list|test|sync\n  ssl                   list|get (certificates)\n  db-cluster            list|get|create|plan (HA plan-first)\n  ssh-key               list|create|import|public|export|install|delete (SSH identity vault)\n  ssh-2fa               list|enroll|confirm|install|pam|retire (SSH login TOTP ≠ panel 2FA)\n  services              Host service matrix (systemctl probe)\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys (2FA flags · session revoke · API keys)\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register (panel + edge)\n  agent run             Outbound fleet poller (experimental)\n  store                 status|export|import|migrate (json|sqlite|postgres document backends)\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares (sandbox)\n  cron                  list|create|update|delete|enable|disable|run|install|status|host\n  email                 domains|mailboxes|deliverability|bootstrap|dns (panel parity)\n  health                Local mode snapshot or --url http://host:port/health\n  notifications         list\n  readiness | doctor    Production readiness (honest)\n  migrate               inventory|host|post|status|resume|orphan-homes (full host migrate)\n  vpn                   WireGuard / OpenVPN\n  vnc                   accounts|clients|share\n  apache                sites|settings\n  network               ifaces|exposure|real-ip\n  real-ip               CDN Real IP\n  updates               inventory|apply\n  software              list|install|uninstall\n  db                    MySQL / MariaDB / PostgreSQL\n  redis                 status|keys|get|set\n  ftp                   accounts|status\n  runtimes              list|install\n  bt-tracker            status|settings\n  validators            list|chains|disk|get|checklist (Beta)\n  docker                status|ps|images|compose|prune (engine)\n  version | help\n\nGlobal:\n  --json                JSON stdout (AI)\n  --data-dir PATH       also --data-dir=PATH or YSK_DATA_DIR\n  --config PATH\n  --locale CODE         CLI language (default en). Also YSK_LOCALE.\n                        Codes: en zh-HK zh-CN ja ko hi es ar fr bn pt id ur\n  --limit N --offset N  Slice large JSON lists (software / updates / host metrics / rbac)\n  --help | --version\n\nExit: 0 ok · 1 error · 2 validation · 3 blocked · 4 not found · 5 host error\n\nSafety:\n  Dangerous ops default to dry-run (plan only).\n  Pass --execute (alias --apply) + env YSK_EXECUTE=1 to mutate host.\n  Command names and flags are always English. --locale only translates messages.\n\nExamples:\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run plan\n  {{cli}} projects list --json\n  {{cli}} --locale=zh-HK help\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
   },
   "usage": {
     "tools": {
@@ -115,7 +115,7 @@
         "--data-dir": {
           "path": {
             "--json": {
-              "0349e6": "Usage: ysk-server cron <sub> [--data-dir PATH] [--json]\n  list [--project-id ID] [--q TEXT]\n  create --schedule \"0 3 * * *\" --command CMD [--project-id ID] [--user USER]\n  delete --id JOB_ID\n  enable|disable --id JOB_ID\n  run --id JOB_ID              # run-now (needs YSK_EXECUTE=1)\n  install                     # load managed crontab (needs EXECUTE)\n  status                      # probe managed file vs host crontab\nHonesty: install blocked without YSK_EXECUTE=1 (file still written).\n"
+              "0349e6": "Usage: ysk-server cron <sub> [--data-dir PATH] [--json]\n  list [--project-id ID] [--q TEXT]\n  create --schedule \"0 3 * * *\" --command CMD [--project-id ID] [--user USER]\n  update --id JOB_ID [--schedule S] [--command CMD] [--user USER] [--project-id ID] [--enable|--disable]\n  delete --id JOB_ID\n  enable|disable --id JOB_ID\n  run --id JOB_ID              # run-now (needs YSK_EXECUTE=1)\n  install                     # load managed crontab (needs EXECUTE)\n  status                      # probe managed file vs host crontab\n  host [list] [--user USER] [--jobs-only]\n  host edit --user USER --old-schedule S --old-command C --schedule S --command C --execute\n  host disable|enable|delete|adopt --user USER --old-schedule S --old-command C --execute\n  host run --user USER --command C --execute\nHonesty: install / host write blocked without YSK_EXECUTE=1.\n"
             }
           }
         }

package/locales/en/cron.json

@@ -167,5 +167,33 @@
   "writtenOnHostHint": "Lines already written to the host crontab",
   "registeredJobsHint": "Jobs registered in the panel (including pending install)",
   "pendingInstallCount": "{{n}} pending install",
-  "systemJobBadge": "No project · system user"
+  "systemJobBadge": "No project · system user",
+  "hostEdit": "Edit",
+  "hostEditTitle": "Edit host crontab line",
+  "hostEditDesc": "Writes this user’s live crontab now. Needs root and YSK_EXECUTE=1. Other lines stay.",
+  "hostSave": "Write crontab",
+  "hostSaveTitle": "Write this crontab line?",
+  "hostSaveDesc": "Replaces the live line for {{user}}. Type EDIT to confirm.",
+  "hostDisable": "Disable",
+  "hostDisableTitle": "Disable host crontab line?",
+  "hostDisableDesc": "Comments the line for {{user}}. Type DISABLE to confirm.",
+  "hostEnable": "Enable",
+  "hostEnableTitle": "Enable host crontab line?",
+  "hostEnableDesc": "Removes the comment for {{user}}. Type ENABLE to confirm.",
+  "hostRunTitle": "Run this host command once?",
+  "hostRunDesc": "Runs as {{user}} now. Does not change crontab. Type RUN to confirm.",
+  "hostAdopt": "Take into panel",
+  "hostAdoptTitle": "Take this host line into the panel?",
+  "hostAdoptDesc": "Tags the live line # ysk:id and registers it. Next install will not duplicate it. Type ADOPT to confirm.",
+  "hostDeleteTitle": "Remove host crontab line?",
+  "hostDeleteDesc": "Removes the live line for {{user}}. Type the command to confirm.",
+  "hostUserLocked": "Crontab owner (cannot move between users here)",
+  "hostLinePreview": "Line that will be written",
+  "disabledJob": "Disabled",
+  "confirmMismatch": "Confirm must match the command.",
+  "writtenHost": "Wrote host crontab",
+  "adoptedHost": "Taken into the panel",
+  "keepDisabledHint": "This line is disabled. Save keeps it commented.",
+  "currentLine": "Current",
+  "nextLine": "Next"
 }

package/locales/en/dns.json

@@ -26,6 +26,7 @@
     "cluster": "Cluster",
     "dnssec": "DNSSEC",
     "tools": "Tools",
+    "ddns": "DDNS",
     "about": "About"
   },
   "recentWrite": "Recent write result",
@@ -227,6 +228,102 @@
   "aboutHealthBody": "Use Tools to probe PowerDNS, heal bind, and open port 53.",
   "aboutStackTitle": "Software",
   "aboutStackBody": "Check/update the PowerDNS package under Software.",
+  "aboutDdnsTitle": "DDNS",
+  "aboutDdnsBody": "The DDNS tab updates named A/AAAA records when this host’s WAN address changes. It does not replace zone CRUD. Written is not the same as public resolver truth.",
+  "ddns": {
+    "honesty": "A successful write is not public DNS yet. Resolver caches and registrar NS still apply. Empty or private IPs are never published.",
+    "needExecute": "Provider updates need root and YSK_EXECUTE=1. Detection still runs.",
+    "lastRun": "Last run",
+    "nextRun": "Next run",
+    "wanRemembered": "Remembered WAN IPv4",
+    "updateNow": "Update now",
+    "updateTitle": "Publish detected WAN addresses?",
+    "updateDesc": "Calls Cloudflare, nsupdate, or the local zone for each enabled record, even if the address is unchanged. Type UPDATE to confirm.",
+    "updated": "DDNS update finished",
+    "updateFailed": "DDNS update failed",
+    "probe": "Probe WAN",
+    "probed": "WAN probe finished",
+    "probeFailedUi": "WAN probe failed",
+    "forceHint": "Update now republishes even when the address is unchanged. Probe never calls a provider.",
+    "saved": "Saved",
+    "saveFailed": "Could not save",
+    "deleted": "Record removed",
+    "emptyTitle": "No DDNS records",
+    "emptyDesc": "Add a hostname below. Cloudflare, RFC 2136, or this host’s PowerDNS zone (managedBy=ddns).",
+    "colFqdn": "Hostname",
+    "colProvider": "Provider",
+    "colPublished": "Published",
+    "colEnabled": "State",
+    "colFrom": "From",
+    "colTo": "To",
+    "colWhen": "When",
+    "colNote": "Note",
+    "pauseRecord": "Pause",
+    "resumeRecord": "Resume",
+    "statusCard": "WAN status",
+    "recordsCard": "Hostnames",
+    "addCard": "Add hostname",
+    "settingsCard": "Settings",
+    "historyTitle": "Recent updates",
+    "historyEmpty": "No DDNS history yet",
+    "paused": "Scheduler paused",
+    "pausedHint": "Scheduled updates are off. Probe and Update now still run.",
+    "schedulerOn": "Scheduled updates",
+    "schedulerOnHint": "In-process scheduler. Not crontab. Off means no automatic upsert.",
+    "zone": "Zone",
+    "zoneHint": "Leave empty to use the last two labels of the hostname. Local provider should pick a zone that already exists.",
+    "zoneSelectHint": "Local zones on this host. Cloudflare and RFC 2136 can use any zone name.",
+    "noLocalZones": "No local zones yet. Create one on the Zones tab first if you use Local PowerDNS.",
+    "providerLocal": "Local PowerDNS",
+    "proxied": "Cloudflare proxied",
+    "proxiedHint": "Orange cloud. Leave off for VPN / WireGuard hostnames.",
+    "proxiedWarnTitle": "Cloudflare orange cloud?",
+    "proxiedWarnDesc": "A proxied record hides the origin IP. VPN and WireGuard hostnames should stay DNS only. Type PROXY to confirm.",
+    "addRecord": "Add hostname",
+    "interval": "Interval (seconds)",
+    "intervalHint": "60–86400. In-process scheduler; not crontab.",
+    "cfToken": "Cloudflare API token",
+    "cfTokenHint": "Write-only. Env CF_API_TOKEN is used if set. Never shown again.",
+    "tokenConfigured": "A Cloudflare token is stored. Leave blank to keep it.",
+    "tokenMissing": "No Cloudflare token stored (env CF_API_TOKEN still applies).",
+    "rfcServer": "RFC 2136 server",
+    "rfcServerHint": "Remote servers need a TSIG key file under the data directory. Loopback may be unsigned. The secret is never passed on argv.",
+    "rfcKeyFile": "TSIG key file",
+    "rfcKeyFileHint": "Relative to the DDNS data directory, or an absolute path under the data directory.",
+    "rfcKeyConfigured": "A key file path is stored. Leave blank to keep it.",
+    "primaryFqdn": "Primary hostname",
+    "primaryFqdnHint": "Used as a VPN endpoint hint. Does not rewrite existing peers.",
+    "updateIdentity": "Remember WAN IPv4",
+    "updateIdentityHint": "Store last public IPv4 in DDNS status for this host",
+    "vpnHint": "VPN Endpoint can use a DDNS hostname (not rewritten automatically).",
+    "sslHint": "Let’s Encrypt HTTP-01 needs the hostname to resolve here. Certificates are not reissued on IP change.",
+    "deleteTitle": "Remove DDNS hostname?",
+    "deleteDesc": "Type {{fqdn}} to confirm. Local managedBy=ddns rows are not deleted from the zone editor.",
+    "err": {
+      "requiresExecute": "Needs root and YSK_EXECUTE=1 to publish.",
+      "missingToken": "Cloudflare API token is missing.",
+      "rfc2136NeedKey": "Remote RFC 2136 needs a TSIG key file under the data directory.",
+      "rfc2136KeyMissing": "TSIG key file is missing or outside the data directory.",
+      "noPublicIpv4": "No public IPv4 detected.",
+      "noPublicIpv6": "No public IPv6 detected.",
+      "notPublicIpv4": "Detected IPv4 is not public.",
+      "notPublicIpv6": "Detected IPv6 is not public.",
+      "probeFailed": "Public IP probe failed.",
+      "localNoZone": "No local DNS zone for this hostname.",
+      "localNeedsDb": "Local provider needs the control-plane database.",
+      "managedByClash": "That name is owned by another feature (not DDNS).",
+      "unknownProvider": "Unknown DDNS provider.",
+      "nsupdateFailed": "nsupdate failed.",
+      "updateFailed": "Provider update failed.",
+      "invalidFqdn": "Invalid hostname.",
+      "invalidType": "Type must be A or AAAA.",
+      "invalidProvider": "Unknown provider.",
+      "notFound": "Record not found.",
+      "confirmMismatch": "Confirm must match the hostname.",
+      "schedulerDisabled": "Scheduled DDNS is paused.",
+      "provider": "Provider returned an error."
+    }
+  },
   "createMailZoneNow": "Created mail zone {{domain}}",
   "toolsFirewallTitle": "Firewall (UFW)",
   "toolsFirewallHint": "Allow or deny port 53. This does not start or stop PowerDNS.",

package/locales/en/notes.json

@@ -2844,7 +2844,27 @@
     "noHostLinesOrEmpty": "No extra non-YSK host crontab lines (or empty).",
     "installReplacesYskOnly": "Install updates YSK-marked jobs only; other host jobs were merged and kept.",
     "hostScanNeedRoot": "Reading other users’ crontabs requires the control plane as root; only the process user’s crontab is listed.",
-    "hostScanSkipUser": "Skipped user {{user}} (no permission)"
+    "hostScanSkipUser": "Skipped user {{user}} (no permission)",
+    "hostUserInvalid": "Invalid crontab user.",
+    "hostScheduleInvalid": "Invalid host cron schedule.",
+    "hostLineNotJob": "That crontab line is not a job.",
+    "hostLineMissing": "No matching crontab line (host crontab may have changed).",
+    "hostLineDuplicate": "That job line appears {{count}} times; edit one unique line first.",
+    "hostReadFailed": "Could not read crontab: {{detail}}",
+    "hostWriteFailed": "crontab write failed: {{detail}}",
+    "hostRewriteNeedExecute": "Writing a host crontab line needs root and YSK_EXECUTE=1. Preview only.",
+    "hostRewriteNeedRoot": "Editing another user’s crontab needs the control plane as root.",
+    "hostPreview": "Next line: {{line}}",
+    "hostPreviewDelete": "Next: remove that line.",
+    "hostRewritten": "Wrote crontab for {{user}}.",
+    "hostRunNeedExecute": "Running a host cron command needs YSK_EXECUTE=1.",
+    "hostRan": "Ran host cron command as {{user}}.",
+    "hostAdoptNeedExecute": "Adopting a host line into the panel needs YSK_EXECUTE=1 (otherwise install would duplicate it).",
+    "hostAdopted": "Host line tagged # ysk:{{id}} and registered in the panel.",
+    "hostConfirmMismatch": "Confirm must match the command.",
+    "hostAdoptOnlyInstallUser": "Take into panel only for the crontab Install writes (root / this process user). Other users would be duplicated on install.",
+    "hostAdoptEnableFirst": "Enable the host line before taking it into the panel.",
+    "hostPercentNewline": "crontab treats unescaped % as a newline. Write date formats as \\%Y (or avoid %)."
   },
   "dbBrowser": {
     "pmaInstalled": "phpMyAdmin installed at {{path}}",