{
  "app": {
    "title": "EdgeGuard",
    "subtitle": "Native reverse-proxy / VPN / firewall"
  },
  "nav": {
    "dashboard": "Dashboard",
    "domains": "Domains",
    "backends": "Backends",
    "routing": "Routing",
    "networks": "Network interfaces",
    "ipAddresses": "IP addresses",
    "ssl": "SSL certificates",
    "vpn": "VPN",
    "firewall": "Firewall",
    "cluster": "Cluster",
    "settings": "Settings",
    "section": {
      "overview": "Overview",
      "routing": "Routing",
      "network": "Network",
      "security": "Security",
      "system": "System"
    }
  },
  "fw": {
    "title": "Firewall",
    "intro": "Fortigate-style: rules built from zones × address objects/groups × services/service groups × action. NAT is separate. Top-down, first-match.",
    "tabs": {
      "rules": "Rules",
      "nat": "NAT",
      "zones": "Zones",
      "addrObj": "Address objects",
      "addrGrp": "Address groups",
      "services": "Services",
      "svcGrp": "Service groups"
    },
    "zone": {
      "name": "Name",
      "description": "Description",
      "builtin": "built-in",
      "builtinHint": "Built-in zones cannot be deleted — the renderer and anti-lockout rules depend on them.",
      "builtinNameLocked": "Name is built-in — cannot be changed because existing rules and interfaces reference it.",
      "namePattern": "Lowercase letters, digits, _ and -; must start with a letter, up to 32 chars.",
      "add": "Add zone",
      "edit": "Edit zone",
      "deleteConfirm": "Really delete zone {{name}}?"
    },
    "ao": {
      "name": "Name", "kind": "Kind", "value": "Value", "description": "Description",
      "add": "Add address object", "edit": "Edit address object",
      "deleteConfirm": "Really delete address object {{name}}?"
    },
    "ag": {
      "name": "Name", "members": "Members", "description": "Description",
      "add": "Add address group", "edit": "Edit address group",
      "selectMembers": "Select address objects",
      "deleteConfirm": "Really delete address group {{name}}?"
    },
    "svc": {
      "name": "Name", "proto": "Protocol", "ports": "Ports",
      "portStart": "Port (start)", "portEnd": "Port (end)",
      "description": "Description", "builtinHint": "Built-in — not editable",
      "add": "Add service", "edit": "Edit service",
      "deleteConfirm": "Really delete service {{name}}?"
    },
    "sg": {
      "name": "Name", "members": "Members", "description": "Description",
      "add": "Add service group", "edit": "Edit service group",
      "selectMembers": "Select services",
      "deleteConfirm": "Really delete service group {{name}}?"
    },
    "rule": {
      "name": "Name", "priority": "Priority", "enabled": "Enabled", "log": "Log",
      "action": "Action", "src": "Source", "dst": "Destination", "service": "Service",
      "srcZone": "Source zone", "dstZone": "Dest. zone",
      "srcKind": "Source kind", "dstKind": "Dest. kind",
      "object": "Address object", "group": "Address group",
      "serviceKind": "Service kind", "serviceGroup": "Service group",
      "comment": "Comment",
      "add": "Add rule", "edit": "Edit rule",
      "deleteConfirm": "Really delete this rule?"
    },
    "nat": {
      "name": "Name", "priority": "Priority", "kind": "Kind", "enabled": "Enabled",
      "match": "Match", "target": "Target",
      "inZone": "Ingress zone", "outZone": "Egress zone", "proto": "Protocol",
      "matchSrcCidr": "Source CIDR (match)", "matchDstCidr": "Dest. CIDR (match)",
      "matchDstCidrHint": "empty = any dest IP (e.g. box's public IP)",
      "dportStart": "Port (start)", "dportEnd": "Port (end)",
      "targetAddr": "Target address", "targetPortStart": "Target port (start)", "targetPortEnd": "Target port (end)",
      "comment": "Comment",
      "add": "Add NAT rule", "edit": "Edit NAT rule",
      "deleteConfirm": "Really delete this NAT rule?"
    },
    "sys": {
      "title": "System rules (always active)",
      "chain": "Chain", "match": "Match", "action": "Action", "note": "Note",
      "policy": "Default policy",
      "policyValue": "Input DROP — everything must be explicitly allowed.",
      "order": "Evaluation",
      "orderValue": "System rules first, then operator rules top-down (priority asc, first-match).",
      "lockout": "Anti-lockout",
      "lockoutValue": "SSH (22) and the management UI (443) are always reachable — even the operator can't accidentally lock themselves out."
    }
  },
  "networks": {
    "title": "Network interfaces",
    "intro": "Manage WAN, LAN, VLAN and bond interfaces. Read-only kernel discovery above; declared configuration below — runtime apply via systemd-networkd lands in a later release.",
    "systemDiscovered": "System interfaces (read-only)",
    "addInterface": "Add interface",
    "editInterface": "Edit interface",
    "name": "Name",
    "type": "Type",
    "parent": "Parent interface",
    "selectParent": "Select parent",
    "vlan": "VLAN",
    "vlanId": "VLAN ID",
    "composition": "Composition",
    "members": "Member interfaces",
    "selectMembers": "Select physical interfaces",
    "membersRequired": "At least one member interface is required",
    "membersHintBridge": "A bridge joins multiple physical ports at L2 — typically two ports for a software switch.",
    "membersHintBond": "A bond aggregates multiple physical ports into one logical link (LACP / active-backup).",
    "role": "Zone",
    "roleHint": "Zones are managed in Firewall → Zones. Custom zones (e.g. iot, guest) can be added there.",
    "mtu": "MTU",
    "active": "Active",
    "description": "Description",
    "actions": "Actions",
    "deleteConfirm": "Really delete interface {{name}}?"
  },
  "ips": {
    "title": "IP addresses",
    "intro": "Addresses the kernel currently has (read-only above) plus addresses EdgeGuard additionally manages — including VIPs that follow the active cluster node on failover.",
    "systemDiscovered": "Kernel addresses (read-only)",
    "managedTitle": "Managed addresses",
    "family": "Family",
    "addAddress": "Add address",
    "editAddress": "Edit address",
    "interface": "Interface",
    "selectInterface": "Select interface",
    "address": "Address",
    "prefix": "Prefix",
    "vip": "VIP",
    "vipFlag": "Mark as VIP",
    "vipPriority": "VIP priority (cluster failover)",
    "active": "Active",
    "description": "Description",
    "actions": "Actions",
    "deleteConfirm": "Really delete address {{addr}}?"
  },
  "auth": {
    "loginTitle": "Sign in",
    "email": "Email",
    "password": "Password",
    "login": "Sign in",
    "logout": "Sign out",
    "loginFailed": "Sign-in failed",
    "loggedInAs": "Signed in as"
  },
  "setup": {
    "title": "First-time setup",
    "intro": "Create the admin account, declare the public FQDN, and — optionally — paste a license key. Without one, a 30-day trial starts.",
    "adminEmail": "Admin email",
    "adminPassword": "Admin password",
    "passwordRule": "At least 12 characters.",
    "fqdn": "Public FQDN",
    "acmeEmail": "ACME / Let's Encrypt email",
    "licenseKey": "License key (optional)",
    "submit": "Finish setup",
    "successTitle": "Setup complete",
    "successHint": "Redirecting you to sign-in."
  },
  "dashboard": {
    "title": "Dashboard",
    "welcomeHint": "Overview of all running EdgeGuard components."
  },
  "domains": {
    "title": "Domains",
    "addDomain": "Add domain",
    "editDomain": "Edit domain",
    "name": "Name",
    "active": "Active",
    "primaryBackend": "Primary backend",
    "primaryBackendHint": "Catch-all backend for requests with no matching routing rule. Optional — leave empty if all traffic is routed via routing rules.",
    "selectBackend": "Select backend",
    "noBackend": "no backend",
    "httpToHttps": "HTTP→HTTPS",
    "hsts": "HSTS",
    "notes": "Notes",
    "actions": "Actions",
    "edit": "Edit",
    "delete": "Delete",
    "deleteConfirm": "Really delete domain {{name}}?"
  },
  "backends": {
    "title": "Backends",
    "addBackend": "Add backend",
    "editBackend": "Edit backend",
    "name": "Name",
    "scheme": "Scheme",
    "address": "Address",
    "port": "Port",
    "target": "Target",
    "healthCheck": "Health check path",
    "active": "Active",
    "usedBy": "Used by",
    "noDomain": "no domain",
    "actions": "Actions",
    "deleteConfirm": "Really delete backend {{name}}?"
  },
  "routing": {
    "title": "Routing rules",
    "addRule": "Add rule",
    "editRule": "Edit rule",
    "domain": "Domain",
    "pathPrefix": "Path prefix",
    "backend": "Backend",
    "priority": "Priority",
    "active": "Active",
    "actions": "Actions",
    "selectDomain": "Select domain",
    "selectBackend": "Select backend",
    "deleteConfirm": "Really delete this routing rule?"
  },
  "cluster": {
    "title": "Cluster",
    "intro": "{{count}} node(s) registered. Multi-node cluster (KeyDB Active-Active + PG streaming replication) coming in a later release.",
    "id": "Node ID",
    "fqdn": "FQDN",
    "role": "Role",
    "joinedAt": "Joined",
    "self": "this node"
  },
  "ssl": {
    "title": "SSL certificates",
    "intro": "Manage TLS certs — let EdgeGuard issue them via Let's Encrypt or upload your own PEM. HAProxy reloads automatically after each change.",
    "tabLE": "Let's Encrypt",
    "tabUpload": "Custom certificate",
    "leIntro": "Pick a domain, click Issue — EdgeGuard solves HTTP-01 over the ACME webroot, writes the PEM into /etc/edgeguard/tls/, and reloads HAProxy.",
    "uploadIntro": "Upload your own certificate. Format: PEM-encoded. Cert + optional chain + private key. EdgeGuard validates cert/key match before writing.",
    "uploadHint": "Tip: for Let's Encrypt renewals don't upload here — use the LE tab.",
    "domain": "Domain",
    "selectDomain": "Select domain",
    "issuer": "Issuer",
    "status": "Status",
    "expiresIn": "Expires in",
    "expiredAgo": "expired {{days}} days ago",
    "actions": "Actions",
    "issueButton": "Issue certificate",
    "uploadButton": "Upload",
    "issueSuccess": "Certificate issued + installed.",
    "uploadSuccess": "Certificate uploaded + installed.",
    "deleteConfirm": "Delete certificate for {{domain}}? HAProxy falls back to the default cert for this domain.",
    "installedTitle": "Installed certificates",
    "certPem": "Certificate (PEM)",
    "chainPem": "Chain (PEM, optional)",
    "keyPem": "Private key (PEM)"
  },
  "settings": {
    "title": "Settings",
    "intro": "System information and setup status. Editable values come in a later release.",
    "systemInfo": "System",
    "version": "Version",
    "status": "Status",
    "setupInfo": "Setup",
    "adminEmail": "Admin email",
    "fqdn": "FQDN",
    "setupCompleted": "Setup completed"
  },
  "update": {
    "available": "Update available: {{pkg}} {{installed}} → {{available}}",
    "applyNow": "Apply now",
    "applying": "Update in progress …",
    "started": "Update has started — the server will restart shortly."
  },
  "common": {
    "yes": "Yes",
    "no": "No",
    "save": "Save",
    "cancel": "Cancel",
    "loading": "Loading …",
    "error": "Error",
    "edit": "Edit",
    "delete": "Delete",
    "search": "Search …",
    "totalRows": "{{count}} rows"
  }
}