feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery
- keepalived: pg_role='standby' hat Vorrang vor role für BACKUP-Bestimmung - keepalived-master.sh: gecrasht Dienste beim MASTER-Übergang starten (nicht nur reload) - confighash: ip_addresses per Interface-Name hashen statt per FK (Cross-Node-Drift-Fix) - TOTP/2FA: RFC 6238 — Setup-Flow, QR-Code, Admin-Disable; two-step Login - Firewall-UI: Enterprise-Design — auto-Beschreibung, icon-only Actions, zero-hit Indikator - fe80-Filter: Link-local IPv6 aus NTP/DNS Listen-Dropdowns entfernen - VIP-Dashboard, Dual-Path VRRP, GW-Tracking (Migrations 0033/0034) - Forward Proxy + DNS erweiterte Einstellungen (Migrations 0031/0032) - unbound-control: edgeguard in unbound-Gruppe via postinst Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
@@ -152,7 +152,10 @@
|
||||
"emptyTitle": "No custom firewall rules yet.",
|
||||
"emptyDesc": "The system rules above keep SSH (rate-limited), HTTPS :443 and the mgmt UI :3443 open (anti-lockout). Add custom rules for app-specific inbound ports or cross-zone forwards.",
|
||||
"logEnabled": "Logging active — matched packets are written to the firewall log",
|
||||
"ruleDisabled": "Rule disabled"
|
||||
"ruleDisabled": "Rule disabled",
|
||||
"enabled": "Active",
|
||||
"unnamed": "(unnamed)",
|
||||
"zeroHitHint": "No hits since last restart — possibly unused or shadowed rule"
|
||||
},
|
||||
"kpi": {
|
||||
"policyRules": "Policy Rules",
|
||||
@@ -281,7 +284,12 @@
|
||||
"loggedInAs": "Signed in as",
|
||||
"forgotPassword": "Forgot your password?",
|
||||
"viewerBadge": "Read-only",
|
||||
"viewerHint": "Your account has viewer role — all changes are blocked. Contact an admin to change your role."
|
||||
"viewerHint": "Your account has viewer role — all changes are blocked. Contact an admin to change your role.",
|
||||
"totp": {
|
||||
"prompt": "Enter the 6-digit code from your authenticator app.",
|
||||
"verify": "Verify code",
|
||||
"invalidCode": "Invalid code"
|
||||
}
|
||||
},
|
||||
"reset": {
|
||||
"title": "Reset admin password",
|
||||
@@ -392,6 +400,17 @@
|
||||
"backends": "Backends",
|
||||
"attached": "{{count}}/{{total}} domains have a primary backend"
|
||||
},
|
||||
"vipCard": {
|
||||
"title": "VIP / VRRP",
|
||||
"noVips": "No VIPs configured",
|
||||
"keepalivedInactive": "keepalived not running",
|
||||
"state": {
|
||||
"MASTER": "MASTER",
|
||||
"BACKUP": "BACKUP",
|
||||
"FAULT": "FAULT",
|
||||
"UNKNOWN": "Unknown"
|
||||
}
|
||||
},
|
||||
"systemCard": {
|
||||
"title": "System",
|
||||
"version": "Version",
|
||||
@@ -399,9 +418,16 @@
|
||||
"ifaces": "Interfaces",
|
||||
"wg": "WireGuard"
|
||||
},
|
||||
"networkServicesCard": {
|
||||
"title": "Network services",
|
||||
"configure": "Configure"
|
||||
},
|
||||
"alertsCard": {
|
||||
"title": "Recent alerts",
|
||||
"viewAll": "View all"
|
||||
"title": "Active alerts",
|
||||
"viewAll": "View all",
|
||||
"summary": "{{critical}} critical · {{warning}} warning",
|
||||
"summaryWarning": "{{warning}} warning",
|
||||
"summaryCritical": "{{critical}} critical"
|
||||
},
|
||||
"downBackendsAlert": "{{count}} backend(s) completely down — no server UP",
|
||||
"maintenanceAlert": "{{count}} domain(s) in maintenance mode",
|
||||
@@ -664,7 +690,18 @@
|
||||
"hintPrimary": "On primary: edgeguard-ctl cluster-init-replication",
|
||||
"hintStandby": "On secondary: edgeguard-ctl cluster-setup-standby <primary-ip>",
|
||||
"hintKeepalived": "Keepalived on both nodes: sudo systemctl enable --now keepalived",
|
||||
"hintFailover": "On failover: edgeguard-ctl promote (on the secondary node)"
|
||||
"hintFailover": "On failover: edgeguard-ctl promote (on the secondary node)",
|
||||
"splitBrainSection": "Split-brain protection (dual-path VRRP + gateway tracking)",
|
||||
"hbInterface": "Heartbeat interface",
|
||||
"hbInterfaceHelp": "Second interface for VI_HB instance — VRRP advertisements run here independently of VI_1. Leave empty to disable.",
|
||||
"hbSrcIp": "Heartbeat source IP",
|
||||
"hbSrcIpHelp": "Own IP on the heartbeat interface (unicast_src_ip for VI_HB).",
|
||||
"hbPeerIp": "Heartbeat peer IP",
|
||||
"hbPeerIpHelp": "Peer IP on the heartbeat interface (unicast_peer for VI_HB).",
|
||||
"hbRouterId": "Heartbeat router ID",
|
||||
"hbRouterIdHelp": "VRRP virtual_router_id for VI_HB — must differ from main Router ID. Default: 52.",
|
||||
"gwCheckIp": "Gateway check IP",
|
||||
"gwCheckIpHelp": "Upstream gateway IP to ping every 5 s. If unreachable: priority drops by 110 → failover triggers. Leave empty to disable."
|
||||
},
|
||||
"loadTitle": "Per-node resources (mTLS aggregator)",
|
||||
"loadEmpty": "No node resources available — agent listener unreachable?",
|
||||
@@ -699,7 +736,27 @@
|
||||
"step3SetupDesc": "Open the setup wizard on the new node (https://<node-fqdn>:3443/setup), choose \"Join existing cluster\", enter the primary FQDN ({{primaryFqdn}}) and paste the token above.",
|
||||
"generateNewToken": "Generate new token",
|
||||
"setupWizardHint": "Open the setup wizard on the new node",
|
||||
"newNodeFqdnLabel": "New node FQDN"
|
||||
"newNodeFqdnLabel": "New node FQDN",
|
||||
"vipTest": {
|
||||
"cardTitle": "VIP failover test",
|
||||
"cardDesc": "Temporarily move a VIP to the secondary to test that services respond correctly. Keepalived is not involved — this is a raw ip addr add/del test.",
|
||||
"colAddress": "VIP address",
|
||||
"colInterface": "Interface",
|
||||
"colActiveOn": "Active on",
|
||||
"swingBtn": "→ Secondary",
|
||||
"restoreBtn": "← Primary",
|
||||
"swingOk": "VIP successfully moved to secondary",
|
||||
"restoreOk": "VIP restored to primary",
|
||||
"swingFailed": "VIP swing failed",
|
||||
"restoreFailed": "VIP restore failed",
|
||||
"noVips": "No VIPs configured (ip_addresses with is_vip=true)",
|
||||
"steps": "Steps",
|
||||
"stepOk": "OK",
|
||||
"stepFail": "Failed",
|
||||
"confirmSwing": "Move {{addr}} to secondary?",
|
||||
"confirmRestore": "Restore {{addr}} to primary?",
|
||||
"unknown": "unknown"
|
||||
}
|
||||
},
|
||||
"ssl": {
|
||||
"title": "SSL certificates",
|
||||
@@ -1126,7 +1183,16 @@
|
||||
"flushCacheFailed": "Flush failed",
|
||||
"upstreamForwardsInvalid": "Each forwarder must be a valid IP (e.g. 1.1.1.1 or 9.9.9.9)",
|
||||
"accessACLInvalid": "Each entry must be a valid IP or CIDR (e.g. 10.0.0.0/8 or 192.168.1.0/24)",
|
||||
"cacheTTLError": "Cache max-TTL must be ≥ cache min-TTL"
|
||||
"cacheTTLError": "Cache max-TTL must be ≥ cache min-TTL",
|
||||
"cacheSection": "Cache",
|
||||
"prefetch": "Prefetch popular records",
|
||||
"prefetchExtra": "Re-fetch records before TTL expires if queried frequently — reduces latency for hot names.",
|
||||
"serveExpired": "Serve expired records",
|
||||
"serveExpiredExtra": "Return stale cache entries when upstream resolvers are unreachable. Reduces SERVFAIL during outages.",
|
||||
"msgCacheSizeMB": "Message cache (MB)",
|
||||
"msgCacheSizeMBExtra": "RAM for DNS response cache (msg-cache-size). Default 64 MB.",
|
||||
"rrsetCacheSizeMB": "RRset cache (MB)",
|
||||
"rrsetCacheSizeMBExtra": "RAM for resource-record cache (rrset-cache-size). Should be ~2x message cache. Default 128 MB."
|
||||
}
|
||||
},
|
||||
"fwd": {
|
||||
@@ -1180,6 +1246,28 @@
|
||||
"dstdom_regex": "dstdom_regex — destination domain regex",
|
||||
"srcdom_regex": "srcdom_regex — source domain regex",
|
||||
"browser": "browser — User-Agent regex"
|
||||
},
|
||||
"settings": {
|
||||
"title": "Proxy settings",
|
||||
"listenAddresses": "Listen addresses",
|
||||
"listenAddressesExtra": "Comma-separated IPs Squid listens on (e.g. 10.0.5.1, 10.0.20.1). Leave empty to listen on all interfaces.",
|
||||
"listenPort": "Port",
|
||||
"listenPortExtra": "Default: 3128.",
|
||||
"saveFailed": "Settings could not be saved.",
|
||||
"cacheSection": "Cache",
|
||||
"cacheMemMB": "In-memory cache (MB)",
|
||||
"cacheMemMBExtra": "RAM used by Squid for caching (cache_mem). Default 64 MB.",
|
||||
"cacheDirMB": "Disk cache (MB)",
|
||||
"cacheDirMBExtra": "Disk space for the UFS cache. Default 100 MB.",
|
||||
"maxObjSizeMB": "Max. object size (MB)",
|
||||
"maxObjSizeMBExtra": "Largest object Squid will cache. Objects above this are fetched fresh. Default 4 MB.",
|
||||
"timeoutSection": "Timeouts",
|
||||
"connectTimeout": "Connect timeout (s)",
|
||||
"connectTimeoutExtra": "Seconds to wait when opening a connection to the upstream server.",
|
||||
"readTimeout": "Read timeout (s)",
|
||||
"readTimeoutExtra": "Seconds Squid waits between consecutive reads from the upstream.",
|
||||
"requestTimeout": "Request timeout (s)",
|
||||
"requestTimeoutExtra": "Maximum time for a complete request/response cycle."
|
||||
}
|
||||
},
|
||||
"common": {
|
||||
@@ -1205,6 +1293,8 @@
|
||||
"retry": "Retry",
|
||||
"close": "Close",
|
||||
"refresh": "Refresh",
|
||||
"back": "Back",
|
||||
"next": "Next",
|
||||
"up": "UP",
|
||||
"down": "DOWN",
|
||||
"relTime": {
|
||||
@@ -1542,7 +1632,24 @@
|
||||
"errorEmailTaken": "This email address is already in use.",
|
||||
"cannotDeleteSelf": "You cannot delete your own account.",
|
||||
"you": "You",
|
||||
"never": "Never"
|
||||
"never": "Never",
|
||||
"totp": {
|
||||
"on": "2FA",
|
||||
"off": "–",
|
||||
"setup": "Set up 2FA",
|
||||
"manage": "Manage 2FA",
|
||||
"disable": "Disable 2FA",
|
||||
"disableFor": "Disable 2FA for {{email}}",
|
||||
"enabled": "2FA has been enabled",
|
||||
"disabled": "2FA has been disabled",
|
||||
"setupTitle": "Set up two-factor authentication",
|
||||
"manageTitle": "Two-factor authentication",
|
||||
"scanHint": "Scan the QR code with Google Authenticator, Authy, or any compatible app.",
|
||||
"enterCode": "Enter the 6-digit code from your authenticator app:",
|
||||
"confirm": "Confirm & activate",
|
||||
"alreadyEnabled": "2FA is active for this account.",
|
||||
"disableHint": "Click 'Disable 2FA' to remove two-factor authentication from this account."
|
||||
}
|
||||
},
|
||||
"audit": {
|
||||
"title": "Audit log",
|
||||
|
||||
Reference in New Issue
Block a user