ysk-server-shared 1.1.23 → 1.1.25

package/locales/en/translation.json

@@ -962,7 +962,7 @@
     },
     "help": {
       "blurb": "Control plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json",
-      "main": "{{product}} ({{cli}}) v{{version}}\n\nControl plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\nUsage:\n  {{cli}} <command> [options]\n\nCommands:\n  setup                 Init dataDir + admin\n  update                Self-update check/apply\n  serve                 HTTP API + Web UI\n  system unit-install   Install ysk-server.service [--enable]\n  stack                 plans|bundles|status|install|uninstall\n  tools                 List tools; tools run --tool <name> [--dry-run]\n  ask                   NL → AI plan [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  users                 list|create|totp\n  packages              list\n  rbac                  list|show\n  audit                 list\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             App templates\n  hosting               nginx|dns|db|firewall helpers\n  dns                   zone|zones|lookup\n  logs                  sources|query|journal|overview\n  host                  overview|metrics (read-only)\n  nginx                 status|list|test|sync\n  ssl                   list|get (certificates)\n  db-cluster            list|get|create|plan (HA plan-first)\n  ssh-key               list|create|import|public|export|install|delete (SSH identity vault)\n  ssh-2fa               list|enroll|confirm|install|pam|retire (SSH login TOTP ≠ panel 2FA)\n  services              Host service matrix (systemctl probe)\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys (2FA flags · session revoke · API keys)\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register (panel + edge)\n  agent run             Outbound fleet poller (experimental)\n  store                 status|export|import|migrate (json|sqlite|postgres document backends)\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares (sandbox)\n  cron                  list|create|delete|enable|disable|run|install|status\n  email                 domains|mailboxes|deliverability|bootstrap|dns (panel parity)\n  health                Local mode snapshot or --url http://host:port/health\n  notifications         list\n  readiness | doctor    Production readiness (honest)\n  migrate               inventory|host|post|status|resume|orphan-homes (full host migrate)\n  vpn                   WireGuard / OpenVPN\n  vnc                   accounts|clients|share\n  apache                sites|settings\n  network               ifaces|exposure|real-ip\n  real-ip               CDN Real IP\n  updates               inventory|apply\n  software              list|install|uninstall\n  db                    MySQL / MariaDB / PostgreSQL\n  redis                 status|keys|get|set\n  ftp                   accounts|status\n  runtimes              list|install\n  bt-tracker            status|settings\n  validators            list|chains|disk|get (Beta)\n  docker                status|ps|images|compose|prune (engine)\n  version | help\n\nGlobal:\n  --json                JSON stdout (AI)\n  --data-dir PATH       also --data-dir=PATH or YSK_DATA_DIR\n  --config PATH\n  --locale CODE         CLI language (default en). Also YSK_LOCALE.\n                        Codes: en zh-HK zh-CN ja ko hi es ar fr bn pt id ur\n  --limit N --offset N  Slice large JSON lists (software / updates / host metrics / rbac)\n  --help | --version\n\nExit: 0 ok · 1 error · 2 validation · 3 blocked · 4 not found · 5 host error\n\nSafety:\n  Dangerous ops default to dry-run (plan only).\n  Pass --execute (alias --apply) + env YSK_EXECUTE=1 to mutate host.\n  Command names and flags are always English. --locale only translates messages.\n\nExamples:\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run plan\n  {{cli}} projects list --json\n  {{cli}} --locale=zh-HK help\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
+      "main": "{{product}} ({{cli}}) v{{version}}\n\nControl plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\nUsage:\n  {{cli}} <command> [options]\n\nCommands:\n  setup                 Init dataDir + admin\n  update                Self-update check/apply\n  serve                 HTTP API + Web UI\n  system unit-install   Install ysk-server.service [--enable]\n  stack                 plans|bundles|status|install|uninstall\n  tools                 List tools; tools run --tool <name> [--dry-run]\n  ask                   NL → AI plan [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  users                 list|create|totp\n  packages              list\n  rbac                  list|show\n  audit                 list\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             App templates\n  hosting               nginx|dns|db|firewall helpers\n  dns                   zone|zones|lookup|ddns\n  logs                  sources|query|journal|overview\n  host                  overview|metrics (read-only)\n  nginx                 status|list|test|sync\n  ssl                   list|get (certificates)\n  db-cluster            list|get|create|plan (HA plan-first)\n  ssh-key               list|create|import|public|export|install|delete (SSH identity vault)\n  ssh-2fa               list|enroll|confirm|install|pam|retire (SSH login TOTP ≠ panel 2FA)\n  services              Host service matrix (systemctl probe)\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys (2FA flags · session revoke · API keys)\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register (panel + edge)\n  agent run             Outbound fleet poller (experimental)\n  store                 status|export|import|migrate (json|sqlite|postgres document backends)\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares (sandbox)\n  cron                  list|create|update|delete|enable|disable|run|install|status|host\n  email                 domains|mailboxes|deliverability|bootstrap|dns (panel parity)\n  health                Local mode snapshot or --url http://host:port/health\n  notifications         list\n  readiness | doctor    Production readiness (honest)\n  migrate               inventory|host|post|status|resume|orphan-homes (full host migrate)\n  vpn                   WireGuard / OpenVPN\n  vnc                   accounts|clients|share\n  apache                sites|settings\n  network               ifaces|exposure|real-ip\n  real-ip               CDN Real IP\n  updates               inventory|apply\n  software              list|install|uninstall\n  db                    MySQL / MariaDB / PostgreSQL\n  redis                 status|keys|get|set\n  ftp                   accounts|status\n  runtimes              list|install\n  bt-tracker            status|settings\n  validators            list|chains|disk|get|checklist (Beta)\n  docker                status|ps|images|compose|prune (engine)\n  version | help\n\nGlobal:\n  --json                JSON stdout (AI)\n  --data-dir PATH       also --data-dir=PATH or YSK_DATA_DIR\n  --config PATH\n  --locale CODE         CLI language (default en). Also YSK_LOCALE.\n                        Codes: en zh-HK zh-CN ja ko hi es ar fr bn pt id ur\n  --limit N --offset N  Slice large JSON lists (software / updates / host metrics / rbac)\n  --help | --version\n\nExit: 0 ok · 1 error · 2 validation · 3 blocked · 4 not found · 5 host error\n\nSafety:\n  Dangerous ops default to dry-run (plan only).\n  Pass --execute (alias --apply) + env YSK_EXECUTE=1 to mutate host.\n  Command names and flags are always English. --locale only translates messages.\n\nExamples:\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run plan\n  {{cli}} projects list --json\n  {{cli}} --locale=zh-HK help\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
     },
     "usage": {
       "tools": {
@@ -1065,7 +1065,7 @@
           "--data-dir": {
             "path": {
               "--json": {
-                "0349e6": "Usage: ysk-server cron <sub> [--data-dir PATH] [--json]\n  list [--project-id ID] [--q TEXT]\n  create --schedule \"0 3 * * *\" --command CMD [--project-id ID] [--user USER]\n  delete --id JOB_ID\n  enable|disable --id JOB_ID\n  run --id JOB_ID              # run-now (needs YSK_EXECUTE=1)\n  install                     # load managed crontab (needs EXECUTE)\n  status                      # probe managed file vs host crontab\nHonesty: install blocked without YSK_EXECUTE=1 (file still written).\n"
+                "0349e6": "Usage: ysk-server cron <sub> [--data-dir PATH] [--json]\n  list [--project-id ID] [--q TEXT]\n  create --schedule \"0 3 * * *\" --command CMD [--project-id ID] [--user USER]\n  update --id JOB_ID [--schedule S] [--command CMD] [--user USER] [--project-id ID] [--enable|--disable]\n  delete --id JOB_ID\n  enable|disable --id JOB_ID\n  run --id JOB_ID              # run-now (needs YSK_EXECUTE=1)\n  install                     # load managed crontab (needs EXECUTE)\n  status                      # probe managed file vs host crontab\n  host [list] [--user USER] [--jobs-only]\n  host edit --user USER --old-schedule S --old-command C --schedule S --command C --execute\n  host disable|enable|delete|adopt --user USER --old-schedule S --old-command C --execute\n  host run --user USER --command C --execute\nHonesty: install / host write blocked without YSK_EXECUTE=1.\n"
               }
             }
           }
@@ -2436,7 +2436,35 @@
     "writtenOnHostHint": "Lines already written to the host crontab",
     "registeredJobsHint": "Jobs registered in the panel (including pending install)",
     "pendingInstallCount": "{{n}} pending install",
-    "systemJobBadge": "No project · system user"
+    "systemJobBadge": "No project · system user",
+    "hostEdit": "Edit",
+    "hostEditTitle": "Edit host crontab line",
+    "hostEditDesc": "Writes this user’s live crontab now. Needs root and YSK_EXECUTE=1. Other lines stay.",
+    "hostSave": "Write crontab",
+    "hostSaveTitle": "Write this crontab line?",
+    "hostSaveDesc": "Replaces the live line for {{user}}. Type EDIT to confirm.",
+    "hostDisable": "Disable",
+    "hostDisableTitle": "Disable host crontab line?",
+    "hostDisableDesc": "Comments the line for {{user}}. Type DISABLE to confirm.",
+    "hostEnable": "Enable",
+    "hostEnableTitle": "Enable host crontab line?",
+    "hostEnableDesc": "Removes the comment for {{user}}. Type ENABLE to confirm.",
+    "hostRunTitle": "Run this host command once?",
+    "hostRunDesc": "Runs as {{user}} now. Does not change crontab. Type RUN to confirm.",
+    "hostAdopt": "Take into panel",
+    "hostAdoptTitle": "Take this host line into the panel?",
+    "hostAdoptDesc": "Tags the live line # ysk:id and registers it. Next install will not duplicate it. Type ADOPT to confirm.",
+    "hostDeleteTitle": "Remove host crontab line?",
+    "hostDeleteDesc": "Removes the live line for {{user}}. Type the command to confirm.",
+    "hostUserLocked": "Crontab owner (cannot move between users here)",
+    "hostLinePreview": "Line that will be written",
+    "disabledJob": "Disabled",
+    "confirmMismatch": "Confirm must match the command.",
+    "writtenHost": "Wrote host crontab",
+    "adoptedHost": "Taken into the panel",
+    "keepDisabledHint": "This line is disabled. Save keeps it commented.",
+    "currentLine": "Current",
+    "nextLine": "Next"
   },
   "dashboard": {
     "serviceAria": "{{name}}: {{state}}",
@@ -2978,6 +3006,7 @@
       "cluster": "Cluster",
       "dnssec": "DNSSEC",
       "tools": "Tools",
+      "ddns": "DDNS",
       "about": "About"
     },
     "recentWrite": "Recent write result",
@@ -3179,6 +3208,102 @@
     "aboutHealthBody": "Use Tools to probe PowerDNS, heal bind, and open port 53.",
     "aboutStackTitle": "Software",
     "aboutStackBody": "Check/update the PowerDNS package under Software.",
+    "aboutDdnsTitle": "DDNS",
+    "aboutDdnsBody": "The DDNS tab updates named A/AAAA records when this host’s WAN address changes. It does not replace zone CRUD. Written is not the same as public resolver truth.",
+    "ddns": {
+      "honesty": "A successful write is not public DNS yet. Resolver caches and registrar NS still apply. Empty or private IPs are never published.",
+      "needExecute": "Provider updates need root and YSK_EXECUTE=1. Detection still runs.",
+      "lastRun": "Last run",
+      "nextRun": "Next run",
+      "wanRemembered": "Remembered WAN IPv4",
+      "updateNow": "Update now",
+      "updateTitle": "Publish detected WAN addresses?",
+      "updateDesc": "Calls Cloudflare, nsupdate, or the local zone for each enabled record, even if the address is unchanged. Type UPDATE to confirm.",
+      "updated": "DDNS update finished",
+      "updateFailed": "DDNS update failed",
+      "probe": "Probe WAN",
+      "probed": "WAN probe finished",
+      "probeFailedUi": "WAN probe failed",
+      "forceHint": "Update now republishes even when the address is unchanged. Probe never calls a provider.",
+      "saved": "Saved",
+      "saveFailed": "Could not save",
+      "deleted": "Record removed",
+      "emptyTitle": "No DDNS records",
+      "emptyDesc": "Add a hostname below. Cloudflare, RFC 2136, or this host’s PowerDNS zone (managedBy=ddns).",
+      "colFqdn": "Hostname",
+      "colProvider": "Provider",
+      "colPublished": "Published",
+      "colEnabled": "State",
+      "colFrom": "From",
+      "colTo": "To",
+      "colWhen": "When",
+      "colNote": "Note",
+      "pauseRecord": "Pause",
+      "resumeRecord": "Resume",
+      "statusCard": "WAN status",
+      "recordsCard": "Hostnames",
+      "addCard": "Add hostname",
+      "settingsCard": "Settings",
+      "historyTitle": "Recent updates",
+      "historyEmpty": "No DDNS history yet",
+      "paused": "Scheduler paused",
+      "pausedHint": "Scheduled updates are off. Probe and Update now still run.",
+      "schedulerOn": "Scheduled updates",
+      "schedulerOnHint": "In-process scheduler. Not crontab. Off means no automatic upsert.",
+      "zone": "Zone",
+      "zoneHint": "Leave empty to use the last two labels of the hostname. Local provider should pick a zone that already exists.",
+      "zoneSelectHint": "Local zones on this host. Cloudflare and RFC 2136 can use any zone name.",
+      "noLocalZones": "No local zones yet. Create one on the Zones tab first if you use Local PowerDNS.",
+      "providerLocal": "Local PowerDNS",
+      "proxied": "Cloudflare proxied",
+      "proxiedHint": "Orange cloud. Leave off for VPN / WireGuard hostnames.",
+      "proxiedWarnTitle": "Cloudflare orange cloud?",
+      "proxiedWarnDesc": "A proxied record hides the origin IP. VPN and WireGuard hostnames should stay DNS only. Type PROXY to confirm.",
+      "addRecord": "Add hostname",
+      "interval": "Interval (seconds)",
+      "intervalHint": "60–86400. In-process scheduler; not crontab.",
+      "cfToken": "Cloudflare API token",
+      "cfTokenHint": "Write-only. Env CF_API_TOKEN is used if set. Never shown again.",
+      "tokenConfigured": "A Cloudflare token is stored. Leave blank to keep it.",
+      "tokenMissing": "No Cloudflare token stored (env CF_API_TOKEN still applies).",
+      "rfcServer": "RFC 2136 server",
+      "rfcServerHint": "Remote servers need a TSIG key file under the data directory. Loopback may be unsigned. The secret is never passed on argv.",
+      "rfcKeyFile": "TSIG key file",
+      "rfcKeyFileHint": "Relative to the DDNS data directory, or an absolute path under the data directory.",
+      "rfcKeyConfigured": "A key file path is stored. Leave blank to keep it.",
+      "primaryFqdn": "Primary hostname",
+      "primaryFqdnHint": "Used as a VPN endpoint hint. Does not rewrite existing peers.",
+      "updateIdentity": "Remember WAN IPv4",
+      "updateIdentityHint": "Store last public IPv4 in DDNS status for this host",
+      "vpnHint": "VPN Endpoint can use a DDNS hostname (not rewritten automatically).",
+      "sslHint": "Let’s Encrypt HTTP-01 needs the hostname to resolve here. Certificates are not reissued on IP change.",
+      "deleteTitle": "Remove DDNS hostname?",
+      "deleteDesc": "Type {{fqdn}} to confirm. Local managedBy=ddns rows are not deleted from the zone editor.",
+      "err": {
+        "requiresExecute": "Needs root and YSK_EXECUTE=1 to publish.",
+        "missingToken": "Cloudflare API token is missing.",
+        "rfc2136NeedKey": "Remote RFC 2136 needs a TSIG key file under the data directory.",
+        "rfc2136KeyMissing": "TSIG key file is missing or outside the data directory.",
+        "noPublicIpv4": "No public IPv4 detected.",
+        "noPublicIpv6": "No public IPv6 detected.",
+        "notPublicIpv4": "Detected IPv4 is not public.",
+        "notPublicIpv6": "Detected IPv6 is not public.",
+        "probeFailed": "Public IP probe failed.",
+        "localNoZone": "No local DNS zone for this hostname.",
+        "localNeedsDb": "Local provider needs the control-plane database.",
+        "managedByClash": "That name is owned by another feature (not DDNS).",
+        "unknownProvider": "Unknown DDNS provider.",
+        "nsupdateFailed": "nsupdate failed.",
+        "updateFailed": "Provider update failed.",
+        "invalidFqdn": "Invalid hostname.",
+        "invalidType": "Type must be A or AAAA.",
+        "invalidProvider": "Unknown provider.",
+        "notFound": "Record not found.",
+        "confirmMismatch": "Confirm must match the hostname.",
+        "schedulerDisabled": "Scheduled DDNS is paused.",
+        "provider": "Provider returned an error."
+      }
+    },
     "createMailZoneNow": "Created mail zone {{domain}}",
     "toolsFirewallTitle": "Firewall (UFW)",
     "toolsFirewallHint": "Allow or deny port 53. This does not start or stop PowerDNS.",
@@ -8836,7 +8961,27 @@
       "noHostLinesOrEmpty": "No extra non-YSK host crontab lines (or empty).",
       "installReplacesYskOnly": "Install updates YSK-marked jobs only; other host jobs were merged and kept.",
       "hostScanNeedRoot": "Reading other users’ crontabs requires the control plane as root; only the process user’s crontab is listed.",
-      "hostScanSkipUser": "Skipped user {{user}} (no permission)"
+      "hostScanSkipUser": "Skipped user {{user}} (no permission)",
+      "hostUserInvalid": "Invalid crontab user.",
+      "hostScheduleInvalid": "Invalid host cron schedule.",
+      "hostLineNotJob": "That crontab line is not a job.",
+      "hostLineMissing": "No matching crontab line (host crontab may have changed).",
+      "hostLineDuplicate": "That job line appears {{count}} times; edit one unique line first.",
+      "hostReadFailed": "Could not read crontab: {{detail}}",
+      "hostWriteFailed": "crontab write failed: {{detail}}",
+      "hostRewriteNeedExecute": "Writing a host crontab line needs root and YSK_EXECUTE=1. Preview only.",
+      "hostRewriteNeedRoot": "Editing another user’s crontab needs the control plane as root.",
+      "hostPreview": "Next line: {{line}}",
+      "hostPreviewDelete": "Next: remove that line.",
+      "hostRewritten": "Wrote crontab for {{user}}.",
+      "hostRunNeedExecute": "Running a host cron command needs YSK_EXECUTE=1.",
+      "hostRan": "Ran host cron command as {{user}}.",
+      "hostAdoptNeedExecute": "Adopting a host line into the panel needs YSK_EXECUTE=1 (otherwise install would duplicate it).",
+      "hostAdopted": "Host line tagged # ysk:{{id}} and registered in the panel.",
+      "hostConfirmMismatch": "Confirm must match the command.",
+      "hostAdoptOnlyInstallUser": "Take into panel only for the crontab Install writes (root / this process user). Other users would be duplicated on install.",
+      "hostAdoptEnableFirst": "Enable the host line before taking it into the panel.",
+      "hostPercentNewline": "crontab treats unescaped % as a newline. Write date formats as \\%Y (or avoid %)."
     },
     "dbBrowser": {
       "pmaInstalled": "phpMyAdmin installed at {{path}}",
@@ -13665,7 +13810,7 @@
       "disk": "Disk"
     },
     "cli": {
-      "usage": "Usage: ysk-server validators list|chains|disk|get|status|logs|create|start|stop|restart|clear|upgrade|set-version|versions|policy|mithril|prune|switch-network|snapshot|compose|settings|producer-keys|producer-detach [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--el-tag T] [--cl-tag T] [--node-tag T] [--client ID] [--tag T] [--data-path P] [--rpc-port N] [--id ID] [--upgrade POLICY] [--confirm TOKEN] [--kes-file P] [--vrf-file P] [--opcert-file P] [--accept-low-disk] [--accept-low-mem] [--accept-mainnet] [--refresh] [--execute] [--json]"
+      "usage": "Usage: ysk-server validators list|chains|disk|get|status|checklist|logs|create|start|stop|restart|clear|upgrade|set-version|versions|policy|mithril|prune|switch-network|snapshot|compose|compose-write|rewrite-compose|software|pull|leftover-remove|stats|settings|producer-keys|producer-detach [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--el-tag T] [--cl-tag T] [--node-tag T] [--client ID] [--tag T] [--data-path P] [--rpc-port N] [--id ID] [--path PATH] [--file PATH] [--image REF] [--upgrade POLICY] [--confirm TOKEN] [--kes-file P] [--vrf-file P] [--opcert-file P] [--accept-low-disk] [--accept-low-mem] [--accept-mainnet] [--refresh] [--execute] [--json]"
     },
     "clients": {
       "el": "Execution client",
@@ -13929,31 +14074,57 @@
       "blsPending": "BLS credentials appear after the node answers RPC.",
       "copyAll": "Copy all",
       "copyNamed": "Copy {{label}}",
+      "nearStakeKey": "Stake public key",
+      "nearStakeKeyPending": "Appears after first start (neard init). RPC not ready does not mean the key is missing.",
+      "nearAccountId": "Key file account_id",
+      "nearAccountIdPending": "Often empty until you set it to {pool}{{suffix}} yourself. This panel never writes validator_key.json.",
+      "nearFactory": "Staking-pool factory",
+      "nearPublicAddr": "Public P2P (peers)",
+      "nearPublicAddrPending": "Appears after first start writes WAN:{{port}} into config.json.",
+      "nearCreateCommand": "create_staking_pool command",
+      "nearPointing": "The pool contract does not take this server’s IP. It stores this node’s stake public key. Peers use the Public P2P row above (host port {{port}}). RPC stays on localhost.",
+      "nearAccountIdHint": "After the pool exists, set account_id in validator_key.json to {pool}{{suffix}} yourself. This panel never writes that file.",
+      "cosmosPubkey": "Consensus public key",
+      "cosmosPubkeyPending": "Appears after gaiad init writes priv_validator_key.json. RPC not ready does not mean the key is missing.",
+      "cosmosChainId": "chain-id",
+      "cosmosP2p": "Public P2P (external_address)",
+      "cosmosP2pPending": "Appears after first start writes tcp://WAN:{{port}} into config.toml.",
+      "ethBeacon": "Beacon API (localhost)",
+      "ethBeaconPending": "Beacon HTTP on this host. Point a validator client you run yourself at this URL — this compose has no VC.",
+      "cosmosCreateCommand": "create-validator command",
+      "solIdentity": "Identity pubkey",
+      "solIdentityPending": "Appears after RPC answers getIdentity. This process is --no-voting until you add a vote account yourself.",
+      "adaP2pPort": "Relay P2P port",
+      "adaP2pPending": "Put this host’s public IPv4 and this port in topology.json. This panel does not probe WAN.",
       "notPosTitle": "Not proof-of-stake",
       "notPosBody": "Bitcoin here is a full or pruned node. There is no staking wallet on this page.",
       "eth": {
-        "model": "Deposit 32 ETH on the official launchpad. Signing keystore is not a withdrawal key.",
+        "model": "This compose runs execution + beacon only — not a validator client. Deposit 32 ETH on the official launchpad.",
         "min": "32 ETH + gas",
         "wallets": "MetaMask, Ledger, Trezor — only on the official launchpad",
-        "panel": "Runs the execution and consensus clients",
+        "panel": "Runs EL + beacon. RPC and beacon API on localhost. No validator client in compose.",
+        "honesty": "This instance is execution + beacon only. There is no validator client in the compose file. Copying a keystore into the beacon data directory will not start attesting. The deposit contract does not take this server’s IP.",
         "yskDoes": [
-          "Install and start the execution and consensus clients.",
-          "Show disk, peers, and upgrade status."
+          "Install and start the execution and beacon clients.",
+          "Show disk, peers, and upgrade status.",
+          "Does not run a validator client and does not load a signing keystore."
         ],
         "youDo": [
-          "Create the keystore and withdrawal address yourself.",
-          "Deposit 32 ETH on the official launchpad.",
-          "Copy the keystore into this node’s data directory."
+          "Create the keystore and withdrawal address yourself on the official launchpad or with staking-deposit-cli.",
+          "Deposit 32 ETH on the launchpad for this network.",
+          "Run a validator client yourself (not this compose) against this instance’s localhost beacon API."
         ],
         "steps": [
-          "Offline, use the official launchpad or staking-deposit-cli. Set the withdrawal address to your own ETH wallet.",
-          "On the official launchpad, deposit 32 ETH (keep extra for gas).",
-          "Copy the keystore file into this node’s data directory yourself. The panel never uploads or stores it.",
-          "Watch sync, disk, and upgrade badges on this page."
+          "Wait until execution and beacon are synced.",
+          "Open the official launchpad for this network (Hoodi or Mainnet on this page). Sepolia has no launchpad button here.",
+          "Offline, generate the keystore. Set the withdrawal address to your own ETH wallet.",
+          "Deposit 32 ETH (keep extra for gas).",
+          "Run a validator client yourself. This compose has no VC — putting a keystore in the beacon datadir does not attest."
         ],
         "never": [
           "Never give your seed phrase or withdrawal key to anyone, including this panel.",
-          "Never upload a signing keystore to a hosted cloud."
+          "Never upload a signing keystore to a hosted cloud.",
+          "Do not expect this page to attest after you copy a keystore into the beacon datadir."
         ]
       },
       "avax": {
@@ -13984,19 +14155,23 @@
         "model": "Operate a stake pool with offline cold / KES / VRF keys — not a browser wallet tap.",
         "min": "Pledge is your choice (see official docs)",
         "wallets": "Official stake-pool tooling (cold keys stay offline)",
-        "panel": "Runs cardano-node",
+        "panel": "Runs cardano-node as a relay first; hot keys can be attached on this page.",
+        "honesty": "This instance starts as a relay. On-chain pool registration uses cold keys you keep offline. Peers and topology use this host’s public IPv4 and the P2P port shown here — the panel does not probe WAN.",
         "yskDoes": [
-          "Run cardano-node and Mithril snapshot restore where offered."
+          "Run cardano-node and Mithril snapshot restore where offered.",
+          "Attach KES, VRF, and opcert when you provide them. Cold keys are refused."
         ],
         "youDo": [
           "Generate pool keys offline.",
-          "Register the pool using official Cardano documentation."
+          "Register the pool using official Cardano documentation.",
+          "Put this host’s public IPv4 and the relay P2P port into topology.json."
         ],
         "steps": [
           "Read the official operate-a-stake-pool guide.",
           "Generate cold, KES, and VRF keys on an offline machine.",
           "Register the pool on-chain from those keys.",
-          "On this instance page, attach KES, VRF, and the operational certificate. Do not upload cold keys."
+          "On this instance page, attach KES, VRF, and the operational certificate. Do not upload cold keys.",
+          "Advertise the relay as public-ip:P2P-port (port shown on this card). This panel does not look up the WAN address."
         ],
         "never": [
           "Do not treat this as a MetaMask one-click stake.",
@@ -14004,128 +14179,158 @@
         ]
       },
       "near": {
-        "model": "Stake from your NEAR account into a staking pool contract.",
-        "min": "See official validator docs",
+        "model": "Create a staking-pool contract at the official factory. The contract stores this node’s public key — not the server IP.",
+        "min": "See official validator docs (30 NEAR to create the pool, plus stake)",
         "wallets": "Official NEAR wallet / lockup",
-        "panel": "Runs neard",
+        "panel": "Runs neard; shows the public key, factory, and create_staking_pool command after init",
         "yskDoes": [
-          "Run neard and show disk / sync."
+          "Run neard with RPC on localhost and P2P on 24567.",
+          "After init, show the stake public key, public P2P address, factory, and a copyable create_staking_pool command.",
+          "Never write validator_key.json or broadcast the transaction."
         ],
         "youDo": [
-          "Stake from your NEAR account to your pool using official docs."
+          "Copy the public key and command from this instance page.",
+          "From your own NEAR account, call the official factory.",
+          "After the pool exists, set account_id in validator_key.json to {pool}.{factory} yourself.",
+          "Stake from your wallet into that pool."
         ],
         "steps": [
-          "Bring the node to sync.",
-          "Follow official NEAR validator documentation.",
-          "Stake from your own wallet or lockup into the pool."
+          "Start the node and wait for neard init so the public key appears (RPC not ready is not the same as missing keys).",
+          "Copy the stake public key and the create_staking_pool command.",
+          "From your wallet, call the factory (testnet pool.f863973.m0 / mainnet poolv1.near) with 30 NEAR for storage. The copied command uses --accountId; if your near CLI expects --account_id, follow that CLI’s --help.",
+          "Set account_id in validator_key.json to your new pool account. This panel does not write that file.",
+          "Wait until RPC answers and the node is synced before staking large amounts. Peers use Public P2P :24567 — the contract does not take an IP."
         ],
         "never": [
-          "Do not paste a seed phrase into this panel."
+          "Do not paste a seed phrase into this panel.",
+          "Do not put this server’s IP into the contract.",
+          "Do not expect the panel to send the create_staking_pool transaction."
         ]
       },
       "cosmos": {
-        "model": "create-validator from your operator wallet. Consensus key stays on the node.",
-        "min": "See official Cosmos Hub docs",
+        "model": "create-validator from your operator wallet using this node’s consensus public key — not the server IP.",
+        "min": "See official Cosmos Hub docs (self-delegation in uatom)",
         "wallets": "Keplr or another Cosmos wallet you control",
-        "panel": "Runs gaiad",
+        "panel": "Runs gaiad; shows consensus pubkey and a copyable create-validator command after init",
+        "honesty": "The create-validator transaction stores this node’s consensus public key. Peers use Public P2P on 26656. RPC stays on localhost. This panel does not broadcast the transaction or read priv_key.",
         "yskDoes": [
-          "Run gaiad."
+          "Run gaiad with RPC on localhost and P2P on 26656.",
+          "After init, show the consensus public key, chain-id, public P2P, and a copyable create-validator command.",
+          "Never write priv_validator_key.json or broadcast the transaction."
         ],
         "youDo": [
-          "Keep the operator wallet yourself.",
-          "Broadcast create-validator from that wallet."
+          "Copy the consensus public key and command from this instance page.",
+          "From your operator wallet (Keplr or gaiad keys you control), submit create-validator.",
+          "Do not mix that wallet mnemonic with the consensus key on this host."
         ],
         "steps": [
-          "Sync gaiad.",
-          "Keep the consensus key on this host only.",
-          "From Keplr (or equivalent), submit create-validator.",
-          "Monitor the node so it does not miss too many blocks."
+          "Start the node and wait for gaiad init so the consensus public key appears (RPC not ready is not the same as missing keys).",
+          "Copy the consensus public key and the create-validator command (chain-id is cosmoshub-4 on mainnet, provider on testnet).",
+          "From your operator wallet, broadcast create-validator. Amount and moniker are yours.",
+          "Wait until RPC answers and the node is synced before bonding large amounts. Peers use tcp://WAN:26656 — the transaction does not take an IP."
         ],
         "never": [
           "Do not mix the operator wallet mnemonic with the consensus key.",
-          "Do not enter wallet mnemonics here."
+          "Do not enter wallet mnemonics here.",
+          "Do not put this server’s IP into create-validator."
         ]
       },
       "sol": {
-        "model": "Vote account, identity, and authorized withdrawer — created with official Solana tools.",
+        "model": "This compose runs Agave with --no-voting. Vote account and withdrawer are created with official Solana tools — not this panel.",
         "min": "See official operations docs (hardware and disk are heavy)",
         "wallets": "Official Solana CLI / wallet you control",
-        "panel": "Runs Agave; mainnet needs multiple tebibytes",
+        "panel": "Runs Agave as a catch-up node (--no-voting). Can show identity pubkey after RPC answers.",
+        "honesty": "This process is --no-voting. It will not vote or earn stake until you create a vote account with official Agave CLI and change how the process is started. This panel does not remove --no-voting.",
         "yskDoes": [
-          "Run the Agave client and warn about disk."
+          "Run the Agave client and warn about disk.",
+          "Show the identity pubkey once RPC answers getIdentity.",
+          "Does not create a vote account and does not start voting."
         ],
         "youDo": [
-          "Create vote and withdrawer keys with official Solana tools."
+          "Create vote and authorized-withdrawer keys with official Solana tools on a machine you control.",
+          "Create the vote account with the official CLI, using this identity pubkey.",
+          "Only then run a voting validator — this compose stays --no-voting."
         ],
         "steps": [
           "Confirm this host has enough disk and IOPS (mainnet is typically 2 TiB+).",
-          "Follow official Solana operations documentation.",
-          "Create the vote account and authorized withdrawer yourself.",
-          "Point the running validator at those keys on disk."
+          "Wait until RPC answers, then copy the identity pubkey shown here.",
+          "Follow official vote-account and stake guides (links below).",
+          "This compose keeps --no-voting. Do not expect this page to start voting after you create a vote account."
         ],
         "never": [
-          "Do not expect a browser wallet button in this panel."
+          "Do not expect a browser wallet button in this panel.",
+          "Do not paste identity or vote keypairs into this panel."
         ]
       },
       "dot": {
-        "model": "Session keys from the node; bind them in Polkadot.js from your stash.",
+        "model": "This compose is a full node (no --validator). Session keys and setKeys are official Polkadot.js steps — not this panel.",
         "min": "See the official wiki",
         "wallets": "Polkadot.js",
-        "panel": "Runs the Polkadot client",
+        "panel": "Runs polkadot as a full node. RPC on localhost. No --validator flag.",
+        "honesty": "This process is not started with --validator. The panel does not call author_rotateKeys (that would change the keystore). Becoming a validator needs the official node flag and a rotateKeys call you make against localhost RPC.",
         "yskDoes": [
-          "Run polkadot and expose RPC on localhost."
+          "Run polkadot and expose RPC on localhost.",
+          "Does not pass --validator and does not rotate session keys."
         ],
         "youDo": [
-          "Rotate session keys on the node and set them from Polkadot.js."
+          "Follow the official set-up-a-validator guide.",
+          "If you add --validator yourself, call rotateKeys on localhost RPC and bind the result in Polkadot.js from your stash."
         ],
         "steps": [
-          "Sync the node.",
-          "Generate session keys on this host.",
-          "In Polkadot.js, set those keys on your stash / controller.",
-          "Follow the official validate guide for bonding."
+          "Sync this full node.",
+          "Read the official validate guide. This compose is not a validator process.",
+          "Do not paste the stash mnemonic here. If you later run with --validator, rotate keys yourself on http://127.0.0.1 (RPC port on this instance).",
+          "In Polkadot.js, set those session keys on your stash / controller, then follow official bonding steps."
         ],
         "never": [
-          "Do not paste the stash mnemonic into this panel."
+          "Do not paste the stash mnemonic into this panel.",
+          "Do not expect this page to generate session keys or to have started --validator."
         ]
       },
       "sui": {
-        "model": "Follow official Sui validator operator docs with your operator wallet.",
+        "model": "This compose is a Sui fullnode (fullnode.yaml), not a validator node.",
         "min": "See official Sui docs",
         "wallets": "Official Sui operator wallet",
-        "panel": "Runs sui-node",
+        "panel": "Runs sui-node as a fullnode. RPC on localhost.",
+        "honesty": "This process cannot sign as a Sui validator. Validator setup uses a different config and keys. Official validator docs are linked; this panel does not switch the node to validator mode.",
         "yskDoes": [
-          "Run the shipped sui-node image."
+          "Run the shipped sui-node image as a fullnode."
         ],
         "youDo": [
-          "Complete registration using official Sui validator docs."
+          "Use this instance as a fullnode.",
+          "To become a validator, follow official Sui validator docs on a validator config — not this compose."
         ],
         "steps": [
-          "Sync sui-node.",
-          "Open the official validator operator guide.",
-          "Use your own operator wallet — not this panel — to register."
+          "Sync this fullnode.",
+          "Treat it as a fullnode: it re-executes checkpoints but does not sign consensus.",
+          "Open the official validator operator guide only if you are building a separate validator process."
         ],
         "never": [
-          "Do not send SUI to this panel."
+          "Do not send SUI to this panel.",
+          "Do not expect this fullnode process to register as a validator."
         ]
       },
       "aptos": {
-        "model": "Follow official Aptos staking / validator docs with your operator wallet.",
+        "model": "This compose is an Aptos public fullnode (role full_node), not a validator.",
         "min": "See official Aptos docs",
         "wallets": "Official Aptos operator wallet",
-        "panel": "Runs the Aptos validator image",
+        "panel": "Runs aptos-node as a public fullnode. RPC on localhost.",
+        "honesty": "Public fullnodes do not participate in consensus. A validator needs a different role, keys, and usually a validator fullnode. This panel does not switch the node to validator mode.",
         "yskDoes": [
-          "Run the shipped Aptos image."
+          "Run the shipped Aptos image as a public fullnode."
         ],
         "youDo": [
-          "Stake and operate from official Aptos documentation."
+          "Use this instance as a public fullnode.",
+          "To run a validator, follow official Aptos validator-node docs — not this compose."
         ],
         "steps": [
-          "Sync the node.",
-          "Read official Aptos staking documentation.",
-          "Use your own operator wallet to register."
+          "Sync this public fullnode.",
+          "Treat it as a PFN: it serves ledger data, it does not vote.",
+          "Open official validator docs only if you are building a separate validator + VFN pair."
         ],
         "never": [
-          "Do not enter operator keys in this panel."
+          "Do not enter operator keys in this panel.",
+          "Do not expect this fullnode process to register as a validator."
         ]
       },
       "btc": {
@@ -14526,6 +14731,9 @@
     "listenPortTcp": "Listen port (TCP)",
     "endpoint": "Public endpoint",
     "endpointHint": "Public host:port clients use to connect",
+    "ddnsFill": "Use DDNS hostname",
+    "ddnsFilled": "Filled endpoint host from DDNS. Peers are unchanged.",
+    "ddnsFillEmpty": "No DDNS primary hostname yet. Add one on the DNS DDNS tab.",
     "ensureServer": "Apply server",
     "openFirewall": "Open {{port}}/{{proto}}",
     "presets": "Port presets",