{ "common": { "save": "Save", "actions": "Actions", "statusOnline": "Online", "statusOffline": "Offline", "statusDisabled": "Disabled", "skipToContent": "Skip to content", "cancel": "Cancel", "close": "Close", "requestFailed": "Request failed", "loading": "Loading…", "refresh": "Refresh", "saveFailed": "Saving failed", "saving": "Saving…", "deleteFailed": "Deleting failed", "description": "Description", "versionLabel": "OPNexus {version} “{codename}”", "delete": "Delete" }, "settings": { "language": { "label": "Language", "de": "German", "en": "English", "saved": "Language saved." }, "notify": { "saved": "Notification settings saved.", "testSent": "Test notification sent via {channel}.", "channelWebhook": "webhook", "channelEmail": "email", "testFailed": "Test failed", "title": "Notifications", "intro": "Host offline, certificate expiring, rule drift in the cluster and failed rollbacks are checked regularly (every {seconds}s) and reported through the enabled channels.", "webhook": "Webhook", "webhookUrl": "Webhook URL", "signingSecret": "Signing secret {state}", "isSet": "(set)", "notSet": "(not set)", "keepUnchanged": "leave unchanged…", "optional": "optional", "removeSecret": "Remove secret", "sending": "Sending…", "testWebhook": "Test webhook", "email": "Email (SMTP)", "smtpHost": "SMTP host", "port": "Port", "security": "Encryption", "securityNone": "None", "username": "Username", "password": "Password {state}", "removePassword": "Remove password", "from": "Sender address", "to": "Recipients (comma-separated)", "testEmail": "Test email", "events": "Events", "event": { "hostOffline": "Host unreachable", "certExpiring": "Certificate expiring", "ruleDrift": "Rule drift in the cluster", "revertFailed": "Failed rollback", "maintenanceUnknown": "Maintenance outcome unclear", "carpHealth": "CARP state critical (split-brain / no master)", "natDrift": "NAT drift in the cluster", "carpAutoRevertFailed": "CARP auto-revert failed", "scheduledFailed": "Scheduled maintenance did not run", "backupFailed": "No recent backup / offsite copy failed", "complianceAlerts": "Critical or high security finding (off by default)", "networkDrift": "Network differences in the cluster", "gatewayDown": "Gateway failing (offline, packet loss or latency above the limit)", "resourceThreshold": "Resource threshold exceeded (disk, memory, swap, CPU load; off by default)", "serviceDown": "Watched service stopped (off by default)", "rolloutProblems": "Rollout paused or not started automatically", "apiRights": "API rights missing (gateway or service status not readable)", "serverDisk": "Disk of the OPNexus server almost full" }, "pollInterval": "Check interval (seconds)", "pollHint": "At least 60 seconds, so the firewalls are not queried needlessly.", "monitoring": "Thresholds and debouncing", "monitoringHint": "Alerts for gateways, resources and services use the measurements OPNexus records every minute. An alert opens only when the latest measurements are all bad and closes only when they are all good again, so single spikes and flapping links do not send messages. 0 switches a single threshold off.", "limit": { "gatewayLoss": "Gateway: packet loss from (%)", "gatewayDelay": "Gateway: latency from (ms)", "diskLimit": "Disk from (% used)", "memoryLimit": "Memory from (% used)", "swapLimit": "Swap from (% used)", "loadLimit": "CPU load from (load per thread)", "confirmSamples": "Gateways and services: consecutive measurements", "resourceSamples": "Resources: consecutive measurements", "watchlist": "Watched services", "watchlistHint": "OPNsense service names, comma-separated. OPNexus reports a service only if it ran before and has stopped now. Remove services you stopped on purpose.", "serverDiskLimit": "OPNexus server: disk full from (%)" } }, "logs": { "saved": "Log ingest settings saved.", "title": "Log collection", "intro": "OPNexus regularly fetches firewall logs from all hosts and stores them in its own database (see “Logs”). Longer retention means more storage, depending on the traffic volume of the connected firewalls — on heavily used hosts, even a few days can take up several gigabytes.", "enabled": "Log collection active", "pollInterval": "Fetch interval (seconds)", "retention": "Retention (days)", "maxSize": "Max. storage (GB)", "maxSizeHint": "0 = unlimited. When the limit is reached the oldest entries are deleted. The value is estimated from the table size; Postgres does not hand freed space back to the file system but reuses it for new logs.", "usage": "Used: {used} of {limit}", "unlimited": "unlimited", "usageAria": "Used log storage", "stored": "{count} entries stored", "storedSince": "{count} entries stored (since {date})" }, "title": "Settings", "appearance": "Appearance", "appearanceSaved": "Appearance saved.", "appearanceHint": "The selection is saved for your account. “System” follows your device's display settings.", "colorScheme": "Color scheme", "theme": { "light": "Light", "dark": "Dark", "system": "System" }, "passwordMismatch": "New passwords do not match.", "passwordChanged": "Password changed.", "passwordFailed": "Password change failed", "account": "Account", "currentPassword": "Current password", "newPassword": "New password", "repeatPassword": "Repeat new password", "changePassword": "Change password", "operational": "Operational settings", "deployWindow": "Deploy confirmation window", "seconds": "{n} seconds", "sessionLifetime": "Session lifetime", "days": "{n} days", "serverManaged": "These values are set centrally by the server configuration.", "about": "About OPNexus", "version": "Version", "development": "Development", "changelogNote": "The change history and version scheme are in {file}.", "update": { "title": "Update OPNexus", "hint": "Pulls the new images, switches the services and checks that everything is healthy. If that fails, OPNexus rolls back to the previous version automatically.", "installed": "Installed", "latest": "Latest version", "upToDate": "OPNexus is up to date.", "notes": "Release notes", "checked": "Last checked: {time}", "feedOff": "The version check is off. Switch it on above so OPNexus can detect new versions.", "feedTitle": "Check for new versions", "feedHint": "Regularly asks the release feed whether a newer version has been published. Only a plain request (GET) carrying your own version number is sent, nothing else. Off by default.", "feedToggle": "Enable version check", "feedUrl": "Feed address", "feedSave": "Save", "feedSaved": "Saved.", "feedManaged": "The version check is fixed by UPDATE_CHECK_URL in the server's .env and cannot be changed here.", "feedError": "The release feed is currently unreachable.", "notEnabledTitle": "Updates from the web interface are not enabled.", "notEnabledBody": "They need a small separate service (the updater) with access to Docker — deliberately optional. To enable it:", "notEnabledStep1": "Add to the .env on the server:", "notEnabledStep2": "Then run:", "notEnabledImages": "This only works with release images (release bundle, or OPNEXUS_IMAGE_REPO in the .env). If you build OPNexus from source, update with “git pull” and “docker compose up -d --build”.", "notEnabledCli": "Until then, update on the server with “opnexus update”.", "unreachable": "The updater does not respond. Check on the server: docker compose ps updater", "localMode": "This installation does not use release images (OPNEXUS_IMAGE_REPO is not set in the .env). Update on the server with “git pull” and “docker compose up -d --build”.", "majorChange": "Version {latest} is a major version jump. Please read the release notes first, then update on the server with “opnexus update {latest}”.", "button": "Update to {latest}", "confirmTitle": "Update to {latest}?", "confirmBody": "OPNexus pulls the new images and restarts itself. The interface is unavailable for about one to two minutes; the managed firewalls are not affected.", "confirmSafety": "A backup is taken automatically before a database migration. If the new version does not become healthy, OPNexus rolls back to the previous version on its own.", "confirm": "Update now", "startFailed": "Could not start the update", "running": "Updating to {target} …", "rollingBack": "Rolling back …", "reconnecting": "Reconnecting — this is normal while the services restart.", "phase": { "pulling": "Pulling new images", "switching": "Switching services", "waiting": "Waiting for healthy services", "stopping": "Stopping services", "restoring": "Restoring the database", "rolled_back": "Rolled back", "done": "Done" }, "result": { "succeededUpdate": "OPNexus is now running {version}. Reloading the page …", "succeededRollback": "OPNexus was rolled back to {version}. Reloading the page …", "rolledBack": "The update to {target} failed. OPNexus was rolled back to the previous version automatically.", "failed": "The operation failed. Check the log and the server state (on the server: opnexus status)." }, "showLog": "Log", "rollback": { "button": "Roll back to previous version", "hint": "Undoes the last update (back to {version}).", "confirmTitle": "Roll back to {version}?", "dataLoss": "The update migrated the database. Rolling back restores the state from before the update: changes made since the update and the log history are lost.", "noDataLoss": "The database was not migrated — no data is lost.", "confirm": "Roll back" }, "badge": "Update available", "resultTime": "Result from {time}" }, "setup": { "title": "Setup assistant", "intro": "Walks you step by step through password, two-factor sign-in and connecting a firewall.", "open": "Open assistant" }, "channels": { "title": "More channels", "hint": "ntfy, Gotify, Telegram, Microsoft Teams and Matrix receive the same messages as webhook and email. Credentials are stored apart from the database and are never shown.", "add": "Add channel", "edit": "Edit channel", "type": "Type", "name": "Name", "enabled": "Active", "disabled": "Off", "enable": "Turn on", "disable": "Turn off", "test": "Test", "editAction": "Edit", "deleteAction": "Delete", "empty": "No further channels set up yet", "saved": "Channel saved.", "deleted": "Channel “{name}” deleted.", "confirmDelete": "Really delete channel “{name}”?", "testSent": "Test message sent through “{name}”.", "loadFailed": "Channels could not be loaded", "removeSecret": "Remove access token", "types": { "ntfy": "ntfy", "gotify": "Gotify", "telegram": "Telegram", "teams": "Microsoft Teams", "matrix": "Matrix" }, "field": { "server_url": "Server address", "topic": "Topic", "priority": "Priority", "chat_id": "Chat ID", "api_base": "API address (optional)", "homeserver_url": "Homeserver address", "room_id": "Room ID" }, "secret": { "ntfy": "Access token (optional)", "gotify": "App token", "telegram": "Bot token", "teams": "Workflow webhook address", "matrix": "Access token" } }, "system": { "intro": "These values used to live only in the server's .env. A value set there still applies and is locked here. Addresses, TLS and database access deliberately stay in the .env: a wrong value would lock you out of this very interface.", "saved": "Settings saved", "changed": "changed", "fromServer": "from server ({env})", "reset": "Reset to default", "remove": "Remove", "secretSet": "set (enter a new URL to change it)", "pemFromServer": "Set by the server through SMTP_CA_FILE.", "defaultIs": "Default: {value}", "bounds": "allowed {min}–{max}", "group": { "security": "Sign-in and sessions", "operation": "Rollouts and firewall access", "monitoring": "Sampling and retention", "integrations": "External monitoring and mail" }, "groupHint": { "security": "Protection against guessed passwords and how long sign-ins last.", "operation": "The safety net when rolling out and patience with slow firewalls.", "monitoring": "How often OPNexus measures and how long it keeps the data. Shorter intervals mean more requests to the firewalls.", "integrations": "Heartbeat for an external watcher and trust for a mail server with its own CA." }, "unit": { "seconds": "seconds", "minutes": "minutes", "hours": "hours", "days": "days", "count": "count" }, "field": { "session_lifetime_days": { "label": "Session lifetime", "hint": "How long a sign-in stays valid. Applies to new sign-ins." }, "login_max_attempts": { "label": "Failed attempts per account", "hint": "This many wrong passwords per account and sender, then it is locked." }, "login_ip_max_attempts": { "label": "Failed attempts per sender", "hint": "This many failed sign-ins from one address (across all accounts), then it is locked." }, "login_window_seconds": { "label": "Window for failed attempts", "hint": "Failed attempts are counted within this period." }, "login_lockout_seconds": { "label": "Lockout duration", "hint": "How long a lock lasts after too many failed attempts." }, "deploy_confirm_window_seconds": { "label": "Confirmation window when rolling out", "hint": "How long you have after a rollout to confirm a change. Without confirmation OPNexus reverts it automatically (lockout protection). Applies to new rollouts." }, "opnsense_timeout": { "label": "Timeout for firewall requests", "hint": "How long OPNexus waits for the firewall API to answer. Raise it for slow links (tunnels, mobile)." }, "migration_backup_keep": { "label": "Backups kept before updates", "hint": "How many automatic database backups taken before schema changes are kept." }, "resource_poll_interval_seconds": { "label": "Resource sampling interval", "hint": "How often memory, load, disk, gateways and services of the firewalls are measured." }, "resource_sample_retention_days": { "label": "Keep resource samples", "hint": "How long resource samples are stored." }, "rule_observe_interval_seconds": { "label": "Rule history interval", "hint": "How often the firewalls' rules and counters are read for the history and the rule analysis." }, "update_check_interval_hours": { "label": "Version check interval", "hint": "How often OPNexus asks for a new version (only while the version check is on)." }, "heartbeat_url": { "label": "Heartbeat URL", "hint": "Ping URL of an external watcher (healthchecks.io, Uptime Kuma, ntfy). OPNexus calls it after every successful check cycle; when the calls stop, the watcher raises the alarm. https:// only. The URL is not shown and never logged." }, "smtp_ca_pem": { "label": "Mail server CA", "hint": "Only needed when the mail server (or the TLS syslog of the audit export) uses a certificate from a private CA. Paste the CA certificate in PEM format." }, "notification_smtp_timeout_seconds": { "label": "Mail timeout", "hint": "How long OPNexus waits for the mail server." } } }, "nav": { "label": "Settings areas", "account": "My account", "accountHint": "Appearance, language, password and two-factor sign-in for your own account.", "notifications": "Notifications", "notificationsHint": "Which events to report, through which channels, from which thresholds. Plus the heartbeat for an external watcher and the mail CA.", "access": "Sign-in & access", "accessHint": "Session lifetime and protection against guessed passwords, SSO sign-in, separation of duties and remote access to the firewall web interface.", "operation": "Operation", "operationHint": "The safety net when rolling out, sampling intervals and retention, log collection and rule cleanup.", "data": "Backup & export", "dataHint": "Scheduled backups of the firewall configurations (offsite too) and forwarding the audit log to syslog or a webhook.", "system": "System", "systemHint": "Update OPNexus, reopen the setup assistant and version information." } }, "nav": { "aboutTitle": "About OPNexus — fleet status & versions", "mainNavigation": "Main navigation", "subNavigation": "Section navigation", "readOnly": "Read-only", "readOnlyDescription": "This role can view everything but cannot save changes or perform actions.", "search": "Search (Ctrl/⌘+K)", "logout": "Sign out", "groups": { "overview": "Overview", "policy": "Policy", "network": "Network", "vpn": "VPN", "certificates": "Certificates", "monitoring": "Monitoring", "system": "System", "hostsystem": "Host system" }, "items": { "dashboard": "Dashboard", "hosts": "Hosts", "cluster": "Cluster", "rules": "Rules", "policy-hierarchy": "Policy hierarchy", "groups": "Groups", "aliases": "Aliases", "nat": "NAT", "network-interfaces": "Interfaces", "network-vlans": "VLANs", "network-vips": "Virtual IPs", "network-gateways": "Gateways", "network-routes": "Routes", "network-dns": "DNS", "network-dhcp": "DHCP", "ipsec": "IPsec VPN", "openvpn": "OpenVPN", "wireguard": "WireGuard", "certificates": "Certificates", "logs": "Logs", "audit": "Audit", "security": "Security posture", "updates": "Update Center", "settings": "Settings", "users": "Users", "overlay": "Management tunnel", "tokens": "API tokens", "network-devices": "Devices", "network-compare": "Compare", "hostsystem-tunables": "Tunables", "hostsystem-cron": "Cron", "hostsystem-syslog": "Syslog", "hostsystem-snapshots": "Snapshots", "hostsystem-diagnostics": "Diagnostics", "setup": "Setup", "rollouts": "Rollouts", "analysis": "Rule analysis", "config": "Configuration as code" } }, "dashboard": { "securityPosture": "Security posture", "postureNone": "No security check has run yet.", "postureOpen": "Open", "subtitle": "Fleet status, pending actions, and security warnings at a glance.", "managedHosts": "Managed hosts", "online": "Online", "pendingActions": "Pending actions", "securityWarnings": "Security warnings", "fleetHealth": "Fleet/CARP health", "noHosts": "No hosts yet", "toHosts": "Go to hosts", "startSetup": "Start the setup assistant", "nothingPending": "Nothing pending", "nothingPendingDescription": "No pending confirmations, errors, or unclear maintenance operations.", "securityAndExpiryWarnings": "Security & expiry warnings", "noWarnings": "No warnings", "noWarningsDescription": "No offline hosts, expiring certificates, rule drift, or pending updates.", "activity": "Activity", "noActivity": "No activity yet", "viewAudit": "View full audit history", "justNow": "just now", "minutesAgo": "{count} min ago", "hoursAgo": "{count} hr ago", "certificate": "Certificate", "certExpired": "{name} — expired", "certExpiresIn": "{name} — expires in {count} days", "certExpiresSoon": "{name} — expires soon", "expired": "Expired", "expires": "Expiring", "kinds": { "rule": "Firewall rule", "port_forward": "Port forward", "one_to_one": "1:1 NAT", "outbound_nat": "Outbound NAT", "policyHierarchy": "Policy hierarchy", "alias": "Alias", "ipsec": "IPsec tunnel", "openvpn": "OpenVPN instance", "wireguard": "WireGuard tunnel", "hostMaintenance": "Host maintenance", "carpAutoRevert": "CARP auto-revert" }, "statuses": { "pending": "Confirmation pending", "error": "Error", "revertFailed": "Rollback failed", "starting": "Submitting", "submitted": "Submitted to firewall", "unknown": "Outcome unclear", "active": "Window active" }, "hostIsOffline": "{name} is offline", "hostOffline": "Host offline", "driftLine": "{cluster}: {count} rule(s) drift between the nodes", "driftBadge": "Drift", "majorAvailable": "Major upgrade available", "stableAvailable": "Stable update available", "updateBadge": "Update", "loadFailed": "Could not load dashboard", "gateways": "Gateways", "noGateways": "No gateway data", "noGatewaysDescription": "Once the firewalls' measurements are in (every minute), status, loss and latency appear here.", "alert": { "gateway_down": "Gateway", "resource_threshold": "Resource", "service_down": "Service", "api_rights_missing": "API rights", "server_disk": "OPNexus disk" }, "moreGateways": "+ {count} more gateways (on the firewall page)", "apiRightsLine": "{name}: API right missing ({read})", "serverDiskLine": "Disk of the OPNexus server {pct} % full ({free} GB free)" }, "hosts": { "add": "Add host", "name": "Name", "address": "Address", "status": "Status", "cluster": "Cluster", "policyHierarchy": "Policy hierarchy", "empty": "No hosts yet.", "loadFailed": "Could not load hosts", "createFailed": "Could not create host", "created": "Host “{name}” created", "saved": "Host “{name}” saved", "deleted": "Host “{name}” deleted", "deleteConfirm": "Delete this host? Rules or aliases that are still active on it must be removed first.", "openInOpnsense": "Open in OPNsense", "edit": "Edit", "delete": "Delete", "baseUrl": "Base URL", "clusterOptional": "Cluster (optional)", "clusterPlaceholder": "e.g. ha-pair-1 — hosts with the same name appear together in the cluster view", "clusterShortPlaceholder": "e.g. ha-pair-1", "policyGroupOptional": "Policy hierarchy group (optional)", "none": "(none)", "verifyTls": "Verify TLS certificate", "saving": "Saving…", "create": "Create host", "editTitle": "Edit host: {name}", "active": "Active", "baseUrlEditHint": "Enter the new address if the firewall got a different IP (e.g. after changing its management interface). History and assignments are kept.", "connection": { "credentials": "the API key or secret was rejected (401)", "forbidden": "the API key does not have enough rights (403)", "tls": "the TLS certificate does not match (pin or check the certificate)", "unreachable": "no connection (check address, port, network and rules)", "other": "unexpected answer" }, "createAnyway": "Create anyway, without the connection check (for example when the firewall behind NAT is not reachable yet).", "deleteTitle": "Delete host", "deleteTypeName": "To confirm, type the host name: {name}", "deleteTypeNameAria": "Type the host name to confirm" }, "rules": { "title": "Firewall rules", "groupTitle": "Rules · {name}", "new": "New rule", "managed": "Centrally managed", "live": "Live across all hosts", "retry": "Retry", "loading": "Loading rules…", "loadFailed": "Could not load rules", "searchLabel": "Search rules", "searchPlaceholder": "Name, source, destination, port …", "groupFilter": "Filter by device group", "allGroups": "All device groups and individual rules", "stateFilter": "Filter by rule state", "allStates": "All states", "subtitle": "Maintain central policies as drafts, review changes, and deploy them to selected hosts or device groups.", "groupSummary": "{members} group members · {rules} assigned rules · ", "manageMembers": "Manage memberships", "showAllInGroup": "All rules of this group", "showAll": "Show all rules", "countDraft": "{count} with pending changes", "countReview": "{count} to review", "countSynced": "{count} deployed", "groupGone": "This device group no longer exists.", "groupEmpty": "No rule is assigned to this group yet.", "none": "No central rules created yet.", "noMatch": "No rules match this selection.", "createFirst": "Create first rule", "createFirstForGroup": "Create first rule for this group", "resetSelection": "Reset selection", "targets": "{active} active target hosts of {total}", "retainedTargets": " · {count} former targets", "disabledSuffix": " · rule disabled", "hierarchyTag": "Hierarchy: {name}", "groupTag": "Group: {name}", "confirm": "Confirm", "confirming": "Confirming…", "edit": "Edit", "reviewPush": "Review & push", "historyTitle": "Rule history", "history": "History", "duplicateTitle": "Duplicate rule", "duplicate": "Duplicate", "delete": "Delete", "deployResult": "Deploy result", "expiresIn": "— expires in {seconds}s unless confirmed", "revertedNote": "— not confirmed, rolled back automatically", "revertFailed": "— rollback failed: {message}", "confirmed": "Deployment confirmed", "confirmFailed": "Confirmation failed", "deleteConfirm": "Really delete this rule? It will also be removed from all target hosts.", "deletedNamed": "Rule “{name}” deleted", "deleted": "Rule deleted", "createFailed": "Could not create rule", "interfacesUnavailable": "Interfaces of {failed} of {total} host(s) unavailable — list may be incomplete.", "copySuffix": " (copy)", "staleTargets": "Targets that no longer exist were removed from the draft. Please review the target selection before saving.", "editDraft": "Edit rule draft", "pickFromList": "Pick from list", "enterManually": "Enter manually", "interfaceMismatch": "Does not mean the same network on all firewalls ({label}) — push is blocked until the rule or targets are adjusted.", "netPlaceholder": "any, IP/CIDR or alias", "active": "Rule active", "deviceGroups": "Device groups", "createGroupsHint": "Create groups under “Groups”.", "groupHosts": "{name} ({count} hosts)", "hierarchyOptional": "Policy hierarchy (optional)", "noInheritance": "No inheritance", "andSubgroups": "{name} and subgroups", "additionalTargets": "Additional target hosts", "noHosts": "No hosts available.", "coveredBy": "(already covered via {groups} — selecting it here is only needed so the rule keeps this host if it is later removed from the group)", "saveDraft": "Save draft", "actionPass": "allow", "actionBlock": "block", "actionReject": "reject", "dirIn": "inbound", "dirOut": "outbound", "adopt": { "button": "Adopt from firewall", "title": "Adopt rules from the firewall", "intro": "These rules were created directly in OPNsense. Once adopted you can edit and deploy them from OPNexus. Adopting itself changes nothing on the firewall.", "host": "Firewall", "none": "No unmanaged rules found.", "action": "Adopt", "adopted": "Adopted “{name}”.", "failed": "Adopting failed", "loadFailed": "Could not load rules.", "notPossible": "Cannot be adopted", "reasons": { "automatic": "System rule", "already_managed": "Already managed", "interface_not_single": "Several or no interface (floating rule)", "negated_interface": "Interface is inverted", "negated_source": "Source is inverted (NOT)", "negated_destination": "Destination is inverted (NOT)", "received_on": "Uses “received on”", "not_quick": "Not a quick rule (last match wins)", "direction_unsupported": "Direction is neither in nor out", "action_unsupported": "Action not supported", "ipprotocol_unsupported": "IPv4 and IPv6 in one rule", "no_description": "Description missing – please set one in OPNsense" } }, "logPackets": "Log matching packets" }, "adopt": { "button": "Adopt from firewall", "noHosts": { "title": "No active firewall", "description": "There is no active firewall to adopt anything from. Add a firewall under “Hosts” or enable an existing one." }, "title": { "aliases": "Adopt aliases from the firewall", "portForward": "Adopt port forwards from the firewall", "oneToOne": "Adopt 1:1 NAT rules from the firewall", "outboundNat": "Adopt outbound NAT rules from the firewall" }, "intro": "These objects were created directly in OPNsense. Once adopted you manage them in OPNexus. Adopting itself changes nothing on the firewall.", "host": "Firewall", "none": "Nothing adoptable found. Everything is already managed.", "action": "Adopt", "all": "Adopt all adoptable ({count})", "adopted": "Adopted “{name}”.", "allDone": "{count} adopted, {skipped} skipped.", "linked": "“{name}” linked to the existing object.", "allDoneLinked": "{count} adopted ({linked} of them linked), {skipped} skipped.", "confirm": { "title": "Adopt everything adoptable", "summary": "Link {link}, adopt {created} as new, {left} not adoptable.", "note": "Only objects that exactly equal an existing central object are linked. Nothing is changed on the firewall.", "go": "Confirm and adopt" }, "link": { "badge": "Already exists centrally", "found": "Equals the existing object “{name}” (firewalls: {hosts}). Linking adds this firewall there as another target instead of creating a second object.", "choose": "Link to", "action": "Link", "linkTip": "Adds this firewall as another target of the existing object. Nothing is changed on the firewall; later changes are rolled out to all firewalls together.", "adoptNew": "Adopt as own object", "newTip": "Creates a second, independent object. Only useful if this firewall should keep its own values for good.", "newBlockedTip": "An object with this name already exists, so only linking is possible. To keep it separate, rename it on the firewall first.", "similar": "Similar: “{name}” (firewalls: {hosts}) differs and is therefore not linked.", "similarNext": "Make the object on the firewall or the central object match, then it can be linked. Or adopt it separately.", "diffValues": "central “{central}”, on the firewall “{live}”", "variableMissing": "This firewall has no value for the variable {names}. Enter it in the host variables.", "yes": "Yes", "no": "No", "fields": { "name": "Name", "type": "Type", "content": "Content", "description": "Description", "enabled": "Enabled", "interface": "Interface", "direction": "Direction", "ipprotocol": "IP version", "protocol": "Protocol", "action": "Action", "source_net": "Source", "source_port": "Source port", "destination_net": "Destination", "destination_port": "Destination port", "log": "Log packets", "target": "Target IP", "local_port": "Target port", "target_port": "Target port (NAT)", "natreflection": "NAT reflection", "external": "External address", "source_not": "Source inverted", "destination_not": "Destination inverted", "variables": "Variables" } }, "failed": "Adopting failed", "loadFailed": "Could not load objects.", "notPossible": "Cannot be adopted", "bulkOnly": "Only via “Adopt all”", "entries": "Entries: {count}", "towards": "to {destination}", "interfaceAddress": "interface address", "systemNote": "{count} OPNsense system aliases (e.g. bogons, interface networks) are never adopted.", "kept": "Stays unchanged on the firewall: {fields}", "keptFields": { "log": "Logging", "poolopts": "Pool options", "poolopts_sourcehashkey": "Source hash key", "tag": "Tag", "tagged": "Tagged", "nosync": "No sync", "categories": "Categories", "staticnatport": "Static NAT port", "endpoint-independent": "Endpoint-independent" }, "reasons": { "system": "OPNsense system object", "already_managed": "Already managed", "unsupported_type": "OPNexus does not support type “{detail}”", "name_invalid": "The name contains characters OPNexus does not allow (letters, digits, _ only)", "name_exists": "OPNexus already has an alias with this name", "twin_busy": "The identical central object is still waiting for a confirmation. Try again afterwards", "content_too_large": "Content too large (over 8000 characters)", "proto_set": "Has an IPv4/IPv6 restriction OPNexus cannot represent", "value_too_long": "A value is longer than OPNexus stores", "references_unmanaged_alias": "Refers to aliases that are not adopted: {detail}", "interface_not_single": "Several or no interface", "ipprotocol_unsupported": "IP version cannot be represented (IPv4 or IPv6 only)", "protocol_any": "Protocol “any” is not supported", "protocol_missing": "Protocol missing", "no_redirect": "“No redirect” rule (No RDR)", "no_target": "No target set", "filter_rule_linked": "Creates or is linked to an associated filter rule", "negated_source": "Source is inverted (NOT)", "negated_destination": "Destination is inverted (NOT)", "natreflection_unsupported": "NAT reflection value is not supported", "type_unsupported": "Rule type is not supported", "incomplete": "Required fields missing", "no_nat_rule": "“No NAT” rule (nonat) is not supported", "no_description": "Description missing – please set one in OPNsense" } }, "login": { "prompt": "Please sign in", "username": "Username", "password": "Password", "signIn": "Sign in", "signingIn": "Signing in…", "failed": "Sign-in failed", "developedBy": "Developed by {maintainer}", "code": "Two-factor code", "codeHint": "6-digit code from your authenticator app, or a recovery code.", "back": "Back to sign-in", "sso": { "button": "Sign in with {name}", "errors": { "no_role": "Your account is not in any group that may use OPNexus.", "state": "The sign-in expired or was already used. Please try again.", "token": "The identity provider's answer could not be verified.", "provider": "The identity provider could not be reached or refused.", "throttled": "Too many failed attempts. Please wait a few minutes.", "disabled": "Single sign-on is not available.", "failed": "Single sign-on failed." } } }, "errors": { "BACKUP_EMPTY": "The backup file is empty.", "BACKUP_INVALID_XML": "The backup file is not valid XML.", "BACKUP_TOO_LARGE": "The backup file exceeds the limit of {limit} MiB.", "BACKUP_WRONG_ROOT": "Unexpected root element “{root}” — this is not an OPNsense configuration backup.", "ACCOUNT_MUSS_ZUERST_AUF_DIE_FIREWALL_GESCHRIEBEN_WERDEN_EEEA04A9": "The account must be pushed to the firewall first", "ACCOUNT_NICHT_GEFUNDEN": "Account not found", "ACCOUNT_WIRD_NOCH_VON_MINDESTENS_EINER_ZERTIFIKATSANFRAGE_REFERENZIERT": "The account is still referenced by at least one certificate request", "ACME_ACCOUNT_GEHOERT_ZU_EINEM_ANDEREN_HOST": "The ACME account belongs to another host", "ACME_ACCOUNT_NICHT_GEFUNDEN": "ACME account not found", "ACTION_NOT_ALLOWED": "Action not allowed: {reason}", "AKTUELLES_PASSWORT_IST_FALSCH": "Current password is incorrect", "ALIAS_CONTENT_DIFFERS": "The {field_label} alias “{alias}” does not have the same content on all targets ({detail}). Correct the rule or restrict its targets before pushing.", "ALIAS_HAT_KEINE_ZIEL_HOSTS": "The alias has no target hosts", "ALIAS_MIT_DIESEM_NAMEN_EXISTIERT_BEREITS": "An alias with this name already exists", "ALIAS_NICHT_GEFUNDEN": "Alias not found", "ALIAS_NOCH_NICHT_BESTAETIGT": "The alias “{alias}” is still unconfirmed on {hosts}. Confirm the alias first, then deploy this rule — otherwise the alias's automatic rollback fails once the rule uses it.", "ALIAS_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_5A2C1888": "The alias changed in the meantime. Reload and review the changes again.", "BACKUP_NICHT_GEFUNDEN": "Backup not found", "BENUTZERNAME_BEREITS_VERGEBEN": "Username is already in use", "BENUTZER_NICHT_GEFUNDEN": "User not found", "CARP_VORSCHAU_NICHT_GEFUNDEN": "CARP preview not found", "CARP_ZUSTAND_WURDE_VERAENDERT_VORSCHAU_ERNEUT_OEFFNEN": "The CARP state changed. Open the preview again.", "DAS_NEUE_PASSWORT_MUSS_SICH_VOM_AKTUELLEN_UNTERSCHEIDEN": "The new password must differ from the current password", "DEPLOYMENT_NICHT_GEFUNDEN": "Deployment not found", "DEPLOYMENT_WURDE_GEAENDERT_VORSCHAU_AKTUALISIEREN": "The deployment changed. Refresh the preview.", "DER_EIGENE_ACCOUNT_KANN_NICHT_GELOESCHT_WERDEN": "You cannot delete your own account", "EINE_REGEL_DARF_IN_DER_REIHENFOLGE_NUR_EINMAL_F05DF47C": "A rule may occur only once in the ordering", "EINTRAG_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_B5A5CE87": "The entry changed in the meantime. Reload and review the changes again.", "EIN_ODER_MEHRERE_ZIELE_WURDEN_NICHT_GEFUNDEN": "One or more targets were not found", "ENTFERNEN_FEHLGESCHLAGEN_DIE_ZUORDNUNG_BLEIBT_FUER_EINEN_NEUEN_4CF90E4C": "Removal failed. The assignment is retained for another attempt.", "ENTWURF_ODER_ZIELE_WURDEN_GEAENDERT_VORSCHAU_ERNEUT_OEFFNEN": "The draft or its targets changed. Open the preview again.", "ERROR_1_1_NAT_REGEL_NICHT_GEFUNDEN": "1:1 NAT rule not found", "FIRMWARE_AUFTRAG_LAEUFT_BEREITS_ODER_ZUSTAND_IST_UNBEKANNT": "A firmware job is already running or its state is unknown", "FUER_DIESEN_TUNNEL_IST_NOCH_KEIN_PRE_SHARED_4AE1FC63": "No pre-shared key has been stored for this tunnel", "FUER_DIESEN_TUNNEL_IST_NOCH_KEIN_SERVER_PRIVATSCHLUESSEL_D7527998": "No server private key has been stored for this tunnel", "FUER_DIESES_ZIEL_LIEGT_KEIN_WIEDERHOLBARER_ROLLBACK_VOR": "No repeatable rollback exists for this target", "GEPLANTE_WARTUNG_NICHT_GEFUNDEN": "Scheduled maintenance not found", "GEPLANTE_WARTUNG_NUR_AUF_DEM_CARP_BACKUP_MOEGLICH": "Scheduled maintenance is only possible on the CARP BACKUP. This firewall is currently MASTER – enable CARP maintenance mode first or schedule the partner node", "CARP_UEBERGABE_BRAUCHT_EINEN_CLUSTER": "Automatic CARP switchover is only available for hosts in a cluster", "GROUP_HAS_ASSIGNED_ITEMS": "The group still has assigned {label}. Move or delete them first.", "GRUPPENMITGLIEDER_ODER_REGELN_WURDEN_GEAENDERT_AUSWIRKUNGEN_ERNEUT_PRUEFEN": "Group members or rules changed. Review the impact again.", "GRUPPENNAME_BEREITS_VERGEBEN": "Group name is already in use", "GRUPPE_HAT_NOCH_UNTERGRUPPEN_DIESE_ZUERST_VERSCHIEBEN_ODER_9FFFD853": "The group still has child groups. Move or delete them first.", "GRUPPE_HAT_NOCH_ZUGEORDNETE_REGELN_DIESE_ZUERST_VERSCHIEBEN_2CCBC48B": "The group still has assigned rules. Move or delete them first.", "GRUPPE_NICHT_GEFUNDEN": "Group not found", "GRUPPE_WIRD_NOCH_VON_ALIASEN_VERWENDET": "The group is still used by aliases", "GRUPPE_WIRD_NOCH_VON_NAT_REGELN_VERWENDET": "The group is still used by NAT rules", "GRUPPE_WIRD_NOCH_VON_REGELN_VERWENDET": "The group is still used by rules", "HOSTNAMEN_EXAKT_EINGEBEN": "Enter the host name exactly", "HOSTZUSTAND_WURDE_VERAENDERT_VORSCHAU_ERNEUT_OEFFNEN": "The host state changed. Open the preview again.", "HOST_HAT_EINE_OFFENE_WARTUNGSAKTION_ZUERST_PRUEFEN_UND_8CC5FBE0": "The host has an open maintenance action. Review and finish it first.", "HOST_HAT_NOCH_AKTIVE_ALIAS_DEPLOYMENTS_DIESE_ZUERST_F4A3ED46": "The host still has active alias deployments. Remove them first or the aliases will remain active and untracked.", "HOST_HAT_NOCH_AKTIVE_POLICY_HIERARCHIE_DEPLOYMENTS_DIESE_ADD78845": "The host still has active policy hierarchy deployments. Remove them first or the rules will remain active and untracked.", "HOST_HAT_NOCH_AKTIVE_REGEL_DEPLOYMENTS_DIESE_ZUERST_0BF41721": "The host still has active rule deployments. Remove them first or the firewall rules will remain active and untracked.", "HOST_HAT_NOCH_NAT_DEPLOYMENTS_DIESE_ZUERST_GEZIELT_0C2A9E85": "The host still has NAT deployments. Remove them explicitly first.", "HOST_HAT_NOCH_VPN_ODER_ZERTIFIKATS_OBJEKTE_DIESE_ZUERST_ENTFERNEN": "The host still has VPN, certificate or ACME objects on the firewall. Remove them first or they will remain active and unmanaged.", "HOST_IST_DEAKTIVIERT": "Host is disabled", "HOST_MIT_DIESEM_NAMEN_EXISTIERT_BEREITS": "A host with this name already exists", "HOST_MUSS_ERREICHBAR_SEIN_UND_FIRMWARE_AUFTRAG_BEENDET_BCE1390B": "The host must be reachable and the firmware job must be finished", "HOST_NICHT_GEFUNDEN": "Host not found", "HOST_REQUEST_FAILED": "Request to host “{host}” failed", "INSTANZ_HAT_KEINE_ZIEL_HOSTS": "The instance has no target hosts", "INSTANZ_NICHT_GEFUNDEN": "Instance not found", "INSTANZ_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_DB923B59": "The instance changed in the meantime. Reload and review the changes again.", "INTERFACE_MEANING_DIFFERS": "Interface “{interface}” does not represent the same network on all targets ({detail}). Correct the rule or restrict its targets before pushing.", "KEINE_OFFENE_WARTUNGSAKTION": "No open maintenance action", "KEIN_OFFENER_RESTORE_VORSCHAU_VORGANG": "No open restore preview operation", "KEIN_OFFENER_UEBERGEBENER_RESTORE_VORGANG": "No open handed-off restore operation", "MAINTENANCE_WAIT_REQUIRED": "The maintenance job was just submitted. Wait at least {seconds} seconds.", "MINDESTENS_EINE_REGEL_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_932925BD": "At least one rule changed in the meantime. Reload and reorder the list.", "MINDESTENS_EIN_ADMIN_ACCOUNT_MUSS_BESTEHEN_BLEIBEN": "At least one admin account must remain", "NICHT_AUTHENTIFIZIERT": "Not authenticated", "NORMALBETRIEB_NOCH_NICHT_BESTAETIGT_WARTUNGSMODUS_MUSS_AUS_UND_8AF9290B": "Normal operation not confirmed: maintenance mode must be off and MASTER/BACKUP must be healthy", "NUR_AUSSTEHENDE_GEPLANTE_WARTUNGEN_KOENNEN_ABGEBROCHEN_WERDEN": "Only pending scheduled maintenance can be cancelled", "NUR_FRUEHERE_AKTIVE_ZIELE_KOENNEN_BEREINIGT_WERDEN": "Only previous active targets can be cleaned up", "NUR_FRUEHERE_AKTIVE_ZIELE_OHNE_OFFENEN_ROLLBACK_KOENNEN_06DE0ADB": "Only previous active targets without an open rollback can be cleaned up", "OFFENES_DEPLOYMENT_ZUERST_BESTAETIGEN_ODER_ROLLBACK_KLAEREN": "Confirm the open deployment or resolve its rollback first", "OFFENES_DEPLOYMENT_ZUERST_KLAEREN": "Resolve the open deployment first", "ORDERING_FAILED": "The ordering could not be established everywhere: {reason}", "OUTBOUND_NAT_REGEL_NICHT_GEFUNDEN": "Outbound NAT rule not found", "PEER_PRE_SHARED_KEY_IST_AKTIVIERT_ABER_ES_FCFAC129": "Peer pre-shared key is enabled, but no key material has been stored", "POLICY_HIERARCHIE_GRUPPE_NICHT_GEFUNDEN": "Policy hierarchy group not found", "PORT_FORWARD_REGEL_NICHT_GEFUNDEN": "Port-forward rule not found", "REGELLISTE_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_ERNEUT_529D7203": "The rule list changed in the meantime. Reload and reorder it.", "REGEL_HAT_KEINE_ZIEL_HOSTS": "The rule has no target hosts", "REGEL_NICHT_GEFUNDEN": "Rule not found", "REGEL_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_BF51B6B0": "The rule changed in the meantime. Reload and review the changes again.", "RESTORE_VORGANG_NICHT_GEFUNDEN": "Restore operation not found", "ROLLBACK_ERNEUT_FEHLGESCHLAGEN_PRUEFE_DIE_ERREICHBARKEIT_DER_FIREWALL": "Rollback failed again. Check whether the firewall is reachable.", "ROLLENWECHSEL_NOCH_NICHT_BESTAETIGT_DIESER_HOST_MUSS_IM_4676309B": "Role switch not confirmed: this host must be BACKUP in maintenance mode and its peer must be MASTER", "RULEBASE_NICHT_GEFUNDEN": "Rulebase not found", "SICHERUNG_NICHT_GEFUNDEN": "Backup not found", "SICHERUNG_WURDE_SEIT_DER_VORSCHAU_VERAENDERT_ODER_IST_2732C4DD": "The backup changed or disappeared after the preview. Open the preview again.", "TLS_HARDENING_IST_AKTIVIERT_ABER_ES_WURDE_NOCH_F53C81DD": "TLS hardening is enabled, but no key material has been stored", "TOO_MANY_LOGIN_ATTEMPTS": "Too many failed attempts. Try again in {wait} seconds.", "TUNNEL_HAT_KEINE_ZIEL_HOSTS": "The tunnel has no target hosts", "TUNNEL_NICHT_GEFUNDEN": "Tunnel not found", "TUNNEL_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_50830F70": "The tunnel changed in the meantime. Reload and review the changes again.", "UEBERGEORDNETE_GRUPPE_NICHT_GEFUNDEN": "Parent group not found", "UNGUELTIGER_BENUTZERNAME_ODER_PASSWORT": "Invalid username or password", "UPSTREAM_REQUEST_FAILED": "Request to the target service failed", "VERKNUEPFTER_ACME_ACCOUNT_NICHT_GEFUNDEN": "Linked ACME account not found", "VORGANG_KANN_NICHT_MEHR_ABGEBROCHEN_WERDEN": "The operation can no longer be cancelled", "VORSCHAU_ABGELAUFEN_BITTE_ERNEUT_OEFFNEN": "The preview expired. Open it again.", "VORSCHAU_ABGELAUFEN_ODER_BEREITS_VERWENDET": "The preview expired or has already been used", "WARTUNGSAKTION_NICHT_GEFUNDEN": "Maintenance action not found", "WARTUNGSVORSCHAU_NICHT_GEFUNDEN": "Maintenance preview not found", "ZEITPUNKT_MUSS_IN_DER_ZUKUNFT_LIEGEN": "The time must be in the future", "ZERTIFIKATSANFRAGE_MUSS_ZUERST_AUF_DIE_FIREWALL_GESCHRIEBEN_WERDEN_F684C449": "The certificate request must be pushed to the firewall first", "ZERTIFIKATSANFRAGE_NICHT_GEFUNDEN": "Certificate request not found", "ZERTIFIKATSANFRAGE_WURDE_NOCH_NICHT_AUF_DIE_FIREWALL_GESCHRIEBEN": "The certificate request has not been pushed to the firewall yet", "ZERTIFIKAT_NICHT_GEFUNDEN": "Certificate not found", "ZIELE_ODER_DEPLOYMENT_WURDEN_GEAENDERT_VORSCHAU_AKTUALISIEREN": "The targets or deployment changed. Refresh the preview.", "ZIEL_HOST_NICHT_GEFUNDEN": "Target host not found", "OUTBOUND_MODE_UNREADABLE": "Outbound mode on {host} not readable: {reason}", "INVALID_CHARACTERS": "The input contains a character that cannot be stored (e.g. a NUL character)", "UPSTREAM_REJECTED": "The firewall rejected the request: {reason}", "SERVICE_NOT_FOUND": "{service}: service not found on this firewall", "SERVICE_LOCKED": "{service}: service is locked and cannot be controlled via the API", "OUTBOUND_MODE_BLOCKS_PUSH": "{host}: outbound NAT mode “{mode}” does not allow a push. Switch the mode to Hybrid/Manual in OPNsense itself. OPNexus does not change this mode.", "GROUP_CANNOT_BE_OWN_PARENT": "A group cannot be its own parent", "GROUP_HIERARCHY_CYCLE": "This assignment would create a cycle in the group hierarchy", "OPEN_DEPLOYMENT_DRAFT_UNCHANGED": "Resolve the open confirmation or failed rollback first; the draft remains unchanged", "OPEN_HOST_MAINTENANCE_BLOCKS_DEPLOY": "Check and complete the open host maintenance before deploying rules.", "OPEN_RESTORE_BLOCKS_DEPLOY": "A restore is open for this host. Please confirm or cancel it first.", "OPEN_CLEANUP_BLOCKS_DEPLOY": "A rule cleanup is running or waiting for this host. Please confirm, revert or finish it first.", "READ_ONLY_ACCESS": "Read-only access: this action requires the “Admin” role.", "CROSS_ORIGIN_BLOCKED": "Request from a foreign origin blocked", "CROSS_SITE_REQUEST_BLOCKED": "Request from another site blocked (Sec-Fetch-Site). Open OPNexus directly at its own address.", "GUI_SESSION_REQUIRED": "The firewall interface can only be opened from a signed-in browser session, not with an API token.", "GUI_GATEWAY_NOT_CONFIGURED": "GUI access is not set up on this server (HTTPS cookies, gateway token and slot addresses required).", "GUI_REQUIRES_HTTPS": "GUI access requires an HTTPS sign-in (COOKIE_SECURE). Please sign in again.", "GUI_ACCESS_DISABLED": "GUI access is switched off. An admin can switch it on in the settings.", "GUI_HOST_NOT_ELIGIBLE": "This firewall cannot be opened through OPNexus: it must be enabled, reachable via https:// and use a verified or pinned certificate.", "GUI_NO_FREE_SLOT": "All {slots} slots for firewall interfaces are in use. Close an open interface or wait until it expires.", "GUI_SLOT_COOLING_DOWN": "A slot was just released but is only reassigned to a different firewall after {minutes} min (protection in case a window is still open there). Open the same firewall again or wait a moment.", "GUI_TOO_MANY_SESSIONS": "Too many firewall interfaces are open at the same time (at most {max}). Wait for one to end or close one you no longer need.", "TLS_PROBE_FAILED": "The firewall's certificate could not be retrieved", "TLS_PEM_INVALID": "Not a valid PEM certificate", "TLS_PIN_MISMATCH": "The firewall presents a different certificate than the pinned one", "TOTP_REQUIRED": "Two-factor code required", "TOTP_INVALID": "Invalid two-factor code", "TOTP_ALREADY_ENABLED": "Two-factor authentication is already enabled", "TOTP_NOT_ENABLED": "Two-factor authentication is not enabled", "TOTP_SETUP_MISSING": "No setup has been started", "RULE_NOT_ADOPTABLE": "This rule cannot be adopted ({reasons})", "OBJECT_NOT_ADOPTABLE": "This object cannot be adopted ({reasons})", "ADOPT_OBJECT_NOT_FOUND": "The object was not found on the firewall. Reload the list.", "ADOPT_LINK_TARGET_NOT_FOUND": "The central object no longer exists. Reload the list.", "ADOPT_LINK_TARGET_CHANGED": "The central object and the firewall differ now ({fields}). Reload the list and check.", "ADOPT_LINK_HOST_HAS_OBJECT": "This firewall already manages this object under another UUID. Reload the list.", "ADOPT_LINK_BUSY": "The object has an open confirmation or rollback. Confirm or resolve it first, then link.", "OUTBOUND_MODE_BLOCKS_ADOPT": "{host}: in outbound NAT mode “{mode}” OPNsense does not list manual rules. Switch the mode to Hybrid/Manual in OPNsense itself, then they can be adopted. OPNexus does not change this mode.", "NETWORK_ACK_REQUIRED": "This change can cut the connection to the firewall and must be confirmed explicitly ({reasons})", "NETWORK_APPLY_UNCERTAIN": "The change was written, but applying it on “{host}” failed or is unclear. Check the firewall; backup: {backup_id}", "NETWORK_BACKUP_FAILED": "Backup of “{host}” before the change failed – nothing was changed", "NETWORK_CHANGE_BLOCKED": "The change is not possible ({reasons})", "NETWORK_FIELD_INVALID": "Invalid field: {field}", "NETWORK_ITEM_NOT_FOUND": "The object does not exist on the firewall (any more)", "UPDATER_UNAVAILABLE": "The updater is not enabled or not reachable.", "UPDATER_BUSY": "An update or rollback is already running.", "UPDATER_REJECTED": "The updater rejected the request ({reason}).", "UPDATE_NOT_OFFERED": "This version is not offered for installation — only the latest stable version.", "UPDATE_MAJOR_CHANGE": "Please run major version jumps deliberately on the server with “opnexus update”.", "UPDATE_CHECK_MANAGED_BY_SERVER": "The version check is fixed by UPDATE_CHECK_URL in the server's .env and cannot be changed here.", "UPDATE_CHECK_URL_INVALID": "The feed address must start with http:// or https:// and must not contain spaces.", "ADMIN_REQUIRED": "This function requires the “Admin” role.", "API_TOKEN_LIMIT_REACHED": "At most {limit} API tokens are allowed per user. Revoke tokens you no longer need first.", "BACKUP_UNLESBAR": "The backup cannot be read: {reason}", "DEPLOY_NEEDS_ADMIN": "Only an administrator may roll out here (separation of duties). Prepare the change and have it approved.", "OVERLAY_INVALID": "Invalid value: {reason}", "OVERLAY_SUBNET_LOCKED": "The overlay network cannot be changed while firewalls are registered. Delete the entries first.", "OVERLAY_NAME_TAKEN": "This name is already taken.", "OVERLAY_PEER_NOT_FOUND": "Overlay entry not found", "VARIABLES_MISSING": "Values for variables are missing: {details}. Enter them on the host page under “Variables”.", "VARIABLE_INVALID": "Invalid variable: {reason}", "OIDC_TEST_FAILED": "The identity provider test failed: {reason}", "OIDC_MANAGED_USER": "This account is managed by single sign-on: change role and password at the identity provider.", "OFFSITE_TEST_FAILED": "The offsite target test failed: {reason}", "API_TOKEN_NOT_FOUND": "API token not found", "API_TOKEN_SCOPE_FORBIDDEN": "This API token (scope “{scope}”) is not allowed to perform this action.", "API_TOKEN_SCOPE_TOO_HIGH": "Your role does not allow a token with this scope (read-only: read, operator: up to deploy).", "NOTIFICATION_CHANNEL_INVALID": "Invalid value: {reason}", "NOTIFICATION_CHANNEL_NOT_FOUND": "The notification channel was not found.", "NOTIFICATION_CHANNEL_NAME_TAKEN": "A channel with this name already exists.", "NOTIFICATION_CHANNEL_TEST_FAILED": "Test message not delivered: {reason}", "NOTIFICATION_WEBHOOK_URL_INVALID": "Invalid webhook address: {reason}", "WINDOW_NOT_FOUND": "Maintenance window not found.", "WINDOW_INVALID": "Invalid maintenance window (field: {field}).", "WINDOW_NAME_TAKEN": "A maintenance window with this name already exists.", "WINDOW_IN_USE": "A rollout plan uses this window. Change or delete the plan first.", "WINDOW_EXCEPTION_INVALID": "Invalid exception (field: {field}). Only future occurrences of the window can be skipped or moved.", "WINDOW_EXCEPTION_EXISTS": "This occurrence already has an exception.", "WINDOW_EXCEPTION_NOT_FOUND": "Exception not found.", "ROLLOUT_PLAN_NOT_FOUND": "Rollout plan not found.", "ROLLOUT_INVALID": "Invalid rollout plan (field: {field}).", "ROLLOUT_NAME_TAKEN": "A rollout plan with this name already exists.", "ROLLOUT_PLAN_INVALID": "The plan cannot start like this: {reason}. Check the preview.", "ROLLOUT_PREVIEW_STALE": "The plan, its groups or its window changed since the preview. Reload the preview.", "ROLLOUT_PLAN_BUSY": "A rollout of this plan is in progress. Finish or abort it first.", "ROLLOUT_GROUP_IN_USE": "The group is a wave of a rollout plan. Change the plan first.", "ROLLOUT_RUN_NOT_FOUND": "Rollout run not found.", "ROLLOUT_ALREADY_ACTIVE": "A rollout is already in progress ({plan}). Only one runs at a time.", "ROLLOUT_CONFIRM_NAME": "Type the exact name to confirm.", "ROLLOUT_ACTION_NOT_ALLOWED": "Not possible while the run is “{status}”.", "ROLLOUT_HOST_NOT_IN_RUN": "This host is not part of this rollout.", "ROLLOUT_HOST_RUNNING": "The action on {host} is already running; it is finished in a controlled way and cannot be skipped.", "ROLLOUT_HOST_FAILED": "Failed: {hosts}. Check it and skip the host first, then resume.", "ANALYSE_ADRESSE_UNGUELTIG": "Not a valid IP address ({field}: {value}). Enter a single IPv4 or IPv6 address, not a host name.", "ANALYSE_FAMILIEN_MISCHUNG": "Source and destination must both be IPv4 or both IPv6.", "ANALYSE_INTERFACE_UNBEKANNT": "Interface \"{interface}\" does not exist on this firewall. Available: {known}.", "ANALYSE_PARAMETER_UNGUELTIG": "Invalid value for {field}: {value}.", "ANALYSE_FIREWALL_NICHT_LESBAR": "Could not read this firewall's rules. Is it reachable?", "API_RIGHTS_MISSING": "The API user lacks the right to read the gateway status", "GATEWAY_NAME_INVALID": "Invalid gateway name", "GATEWAY_UNKNOWN": "OPNexus does not know this gateway on the firewall (check the name and its case)", "GATEWAY_MUTE_LIMIT": "At most {limit} gateways can be muted", "BEREINIGUNG_NICHT_GEFUNDEN": "Cleanup not found.", "BEREINIGUNG_AUSWAHL_UNGUELTIG": "Invalid selection ({field}).", "BEREINIGUNG_VORSCHAU_VERALTET": "The firewall changed since the preview ({uuids}). Nothing was written; open the preview again.", "BEREINIGUNG_REGEL_NICHT_AENDERBAR": "Rule {uuid} on {host} cannot be cleaned up (reason: {reason}).", "BEREINIGUNG_OFFENE_OPERATION": "Something is still open on the host/cluster ({reason}). Confirm, revert or finish it first.", "BEREINIGUNG_ZU_VIELE_REGELN": "At most {max} rules per cleanup (selected: {count}).", "BEREINIGUNG_BESTAETIGUNG_FEHLT": "These rules need an explicit acknowledgement: {uuids}.", "BEREINIGUNG_VERWALTUNGSQUELLEN_FEHLEN": "First enter the management sources in the settings (addresses the firewalls are managed from). Without them the cleanup is locked.", "BEREINIGUNG_CLUSTER_UNVOLLSTAENDIG": "Cluster incomplete or roles unclear ({reason}). The cleanup needs every node, exactly one MASTER and the same rule UUID on every node.", "BEREINIGUNG_FRIST_ABGELAUFEN": "The confirmation window has passed or the cleanup is no longer open.", "BEREINIGUNG_NICHT_BESTAETIGBAR": "This cleanup cannot be confirmed ({status}): at least one rule failed or is unclear. Revert now or wait for the automatic revert.", "BEREINIGUNG_LIVESTAND_ABWEICHEND": "These rules look different on the firewall than expected: {uuids}. Not confirmed; check or revert.", "BEREINIGUNG_FIREWALL_NICHT_ERREICHBAR": "{host} cannot be reached or read. Do not confirm while the firewall does not answer: the automatic revert restores the previous state.", "BEREINIGUNG_WARTEZEIT_NICHT_ERREICHT": "Rule {uuid} on {host} has not been switched off long enough yet ({days} more day(s)).", "BEREINIGUNG_SNAPSHOT_FEHLT": "There is no backup of this rule's content; it is not deleted or cannot be restored.", "BEREINIGUNG_POSITION_NICHT_WIEDERHERSTELLBAR": "The rule was restored, but not at its old position: it is at the end of its group. Check its position in OPNsense.", "BEREINIGUNG_AKTION_NICHT_MOEGLICH": "This action is not possible in the current state ({status}).", "BEREINIGUNG_NICHT_AUSGEFUEHRT": "Not executed: the cleanup stopped earlier.", "BEREINIGUNG_ANWENDEN_FEHLGESCHLAGEN": "The change was saved, but applying it on the firewall failed.", "BEREINIGUNG_AUSGANG_UNKLAR": "The firewall did not answer clearly; the state was read back.", "BEREINIGUNG_ABGEBROCHEN_VERWAIST": "The run was interrupted (OPNexus restarted?). Read the firewall's state with “Check again”.", "BEREINIGUNG_EINSTELLUNG_UNGUELTIG": "Invalid cleanup setting ({field}: {reason}).", "BEREINIGUNG_BESTAETIGUNGSTEXT_VERALTET": "The acknowledgement text of this page is outdated. Reload the page and acknowledge the rules again.", "CONFIG_INVALID": "The configuration file is invalid. See the list of errors.", "CONFIG_TOO_LARGE": "The configuration file is too large (at most 1 MiB).", "CONFIG_UNSUPPORTED_VERSION": "OPNexus does not know this version of the file format.", "CONFIG_PLAN_STALE": "Something changed since the plan was made. Please plan again.", "CONFIG_BLOCKED": "The plan contains blocked objects and cannot be applied.", "CONFIG_APPLY_SELFCHECK": "The import was rolled back: the database did not match the plan afterwards. Nothing was changed.", "CONFIG_BUSY": "OPNexus is checking another configuration file right now. Please try again shortly.", "GRUPPE_WIRD_NOCH_VON_VPN_VERWENDET": "Group is still used by VPN connections", "HOST_URL_EXISTS": "This address already belongs to the host “{host}”.", "HOST_CONNECTION_FAILED": "The firewall could not be reached with these details: {reason}", "ZIEL_HOST_NACH_AUSROLLEN_FEST": "The target host can no longer be changed once the entry has been deployed. Delete the entry (this also removes it from the firewall) and create it again for the new host.", "ACME_KONTO_WIRD_VON_ANFRAGEN_VERWENDET": "This ACME account is used by certificate requests; you can only change its host once no request uses it any more.", "VPN_DEPLOY_LAEUFT_BEREITS": "A deployment or removal is already running for this VPN. Wait a moment and try again.", "SETTING_INVALID": "Setting “{setting}”: {reason}" }, "workflow": { "attention": "Check errors", "pending": "Confirmation pending", "cleanup": "Review former targets", "unassigned": "Targets missing", "disabled": "Target hosts disabled", "draft": "Changes pending", "synced": "Deployed", "tooltip": "Shows what OPNexus rolled out last. The firewall is not queried live for this." }, "certStatus": { "expired": "Expired", "expiring_soon": "Expiring soon", "valid": "Valid", "unknown": "Unknown" }, "outboundModes": { "title": "Outbound mode of the firewalls", "refresh": "Refresh mode", "unavailable": "Unavailable", "pushBlocked": " · Push blocked", "hint": "Manual rules only take effect in Hybrid/Manual mode. You can only change the mode in OPNsense itself; it is re-checked before every push." }, "liveNat": { "firewallSelect": "Firewall for live NAT view", "description": "Current firewall state, read-only. Automatic OPNsense rules are shown separately.", "noEntries": "No entries.", "configured": "Configured rules ({count})", "automatic": "Automatic rules · read-only ({count})", "noDescription": "(no description)" }, "hostResource": { "loadFailed": "Could not load usage data", "title": "System usage (24h)", "empty": "No measurements yet. Recording runs in the background every 60 seconds.", "cpu": "CPU load (1 min)", "memory": "Memory", "disk": "Disk (/)" }, "loginBanner": { "failedOne": "{count} failed login attempt since your last sign-in.", "failedMany": "{count} failed login attempts since your last sign-in.", "lastLogin": "Last sign-in: {time}", "fromIp": " from {ip}", "welcome": "Welcome, {username}.", "sessionUntil": "Session valid until {time}." }, "updateBanner": { "title": "OPNexus {latest} is available (installed: {current}).", "notes": "Release notes", "how": "Update in the settings or on the server with “opnexus update”.", "dismiss": "Hide this notice for this version", "settings": "Go to settings" }, "acme": { "externalCaWarning": "Contacts the real certificate authority (e.g. Let's Encrypt) over the internet — not a purely local change. Counts against its rate limits (e.g. issuances per domain per week). Use a *_test CA (e.g. letsencrypt_test) for testing.", "actionFailed": "Action failed", "warningUnderstood": "Warning understood — continue", "areYouSure": "Are you sure? “{action}” will be executed now.", "yes": "Yes, {action}" }, "hostServices": { "loadFailed": "Could not load services", "actionFailed": "Action failed", "confirm": "Really {verb} service “{name}”? This may briefly affect connectivity or other functions of this host.", "verb": { "start": "start", "stop": "stop", "restart": "restart" }, "done": "Service “{name}” {result}", "result": { "start": "started", "stop": "stopped", "restart": "restarted" }, "title": "Services", "empty": "No services reported.", "service": "Service", "description": "Description", "status": "Status", "running": "running", "stopped": "stopped", "locked": "This service is locked in OPNsense and cannot be controlled here.", "startTitle": "Start", "stopTitle": "Stop", "restartTitle": "Restart" }, "acmeAccount": { "caCustom": "Custom CA URL", "edit": "Edit ACME account", "new": "New ACME account", "localNote": "Creating and saving is a purely local configuration change with no external contact. Only the separate “Register” action contacts the certificate authority.", "host": "Host", "name": "Name", "description": "Description", "email": "Email", "ca": "Certificate authority", "customCaUrl": "Custom CA URL", "eabKid": "EAB key ID (optional)", "eabHmacKeep": "EAB HMAC — leave empty = unchanged", "eabHmac": "EAB HMAC (optional)", "active": "Account active" }, "review": { "actions": { "create": "Create new", "update": "Change", "unchanged": "Unchanged", "disabled": "Disabled · skipped", "retained": "Former target · stays in place", "missing_variable": "Variable missing · skipped", "missing_cert": "No certificate/CA selected · skipped" }, "loadFailed": "Loading failed", "pushFailed": "Push failed", "actionFailed": "Action failed", "previewTitle": "Review & deploy changes", "reload": "Reload", "removeFromHost": "Remove from this host", "retryRollback": "Retry rollback", "actionsRequireHost": "For actions, the host must be enabled and any open deployment must be resolved.", "viewHost": "View host", "colField": "Field", "colBefore": "Before", "colDraft": "Draft", "pushInfo": "Push applies the changes. You must then confirm them within the displayed window, otherwise OPNexus tries to restore the previous state.", "allInSync": "All active targets match the saved draft. No push necessary.", "pushing": "Push running…", "deployNow": "Deploy now", "version": "Version {n}", "adoptAsDraft": "Adopt as draft", "assignTargets": "Assign targets", "rollbackDone": "Rollback on {host} succeeded.", "historyHint": "An earlier version is loaded into the edit form. Save first, then review and deploy the changes.", "rule": { "deployed": "Rule “{name}” deployed", "removeConfirm": "Remove rule “{name}” from “{host}” only? The change is applied immediately and has no automatic rollback.", "rollbackConfirm": "Restore the previous rule state on “{host}” again?", "removed": "Rule removed from {host}.", "historyTitle": "Rule history", "noTargets": "No target hosts. Assign hosts or a device group to the rule.", "noHistory": "For this existing rule, history is recorded from the first edit onwards." }, "alias": { "deployed": "Alias “{name}” deployed", "removeConfirm": "Remove alias “{name}” from “{host}” only? The change is applied immediately and has no automatic rollback.", "rollbackConfirm": "Restore the previous alias state on “{host}” again?", "removed": "Alias removed from {host}.", "historyTitle": "Alias history", "noTargets": "No target hosts. Assign hosts or a device group to the alias.", "noHistory": "For this existing alias, history is recorded from the first edit onwards.", "pushInfo": "Push applies the changes. You must then confirm them within the displayed window, otherwise OPNexus tries to restore the previous state — every rule that uses this alias is already affected until then." }, "tunnel": { "deployed": "Tunnel “{name}” deployed", "removeConfirm": "Remove tunnel “{name}” from “{host}” only? The change is applied immediately and has no automatic rollback.", "removed": "Tunnel removed from {host}.", "historyTitle": "Tunnel history", "noTargets": "No target hosts. Assign hosts or a device group to the tunnel.", "noHistory": "For this existing tunnel, history is recorded from the first edit onwards." }, "instance": { "deployed": "Instance “{name}” deployed", "removeConfirm": "Remove instance “{name}” from “{host}” only? The change is applied immediately and has no automatic rollback.", "removed": "Instance removed from {host}.", "historyTitle": "Instance history", "noTargets": "No target hosts. Assign hosts or a device group to the instance.", "noHistory": "For this existing instance, history is recorded from the first edit onwards." }, "historyHintGroups": "An earlier version is loaded into the edit form. Save first, then review and deploy the changes. Group memberships are resolved at push time.", "armWarning": "Warning understood — prepare push", "armSure": "Are you sure? Config write and service reload happen in a single step, with no possibility of an automatic rollback.", "yesDeploy": "Yes, deploy now", "hierarchy": { "noTargets": "No target hosts. Assign hosts to this rule's group (directly or via a subgroup).", "editRule": "Edit rule", "pushInfo": "Push applies the changes and then restores the pre/post ordering on every affected host. You must then confirm within the displayed window, otherwise OPNexus tries to restore the previous state." }, "historyHintPsk": "An earlier version is loaded into the edit form (the pre-shared key itself is never part of the history — only whether one was set). Save first, then review and deploy the changes.", "historyHintStaticKey": "An earlier version is loaded into the edit form (the static key material itself is never part of the history — only whether any was set). Save first, then review and deploy the changes.", "historyHintKeys": "An earlier version is loaded into the edit form (key material itself is never part of the history — only whether it was set). Save first, then review and deploy the changes.", "originalPort": "original port", "outboundMode": "{host}: outbound mode {mode}", "outboundBlocked": " – push blocked. Switch to Hybrid/Manual in OPNsense.", "historyTitle": "Version history", "pushShort": "Confirm within the time limit after pushing, otherwise an automatic rollback follows." }, "fields": { "description": "Description", "enabled": "Active", "action": "Action", "interface": "Interface", "direction": "Direction", "ipprotocol": "IP version", "protocol": "Protocol", "source_net": "Source", "source_port": "Source port", "destination_net": "Destination", "destination_port": "Destination port", "quick": "Quick", "log": "Logging", "name": "Name", "type": "Type", "content": "Content" }, "carp": { "peerInMaintenance": "{peer} is already in CARP maintenance mode. Click “Restore CARP normal operation” there first instead of switching again here.", "previewFailed": "CARP preview failed", "outcomeUnclear": "CARP outcome unclear. Check the roles and do not click again.", "switchToPartner": "Switch CARP to partner", "restoreNormal": "Restore CARP normal operation", "trafficHandover": "Traffic handover", "leaveMaintenance": "Leave maintenance mode", "enterDescription": "{host} will be demoted persistently. The reachable BACKUP partner should take over the virtual IPs as MASTER.", "leaveDescription": "{host} leaves persistent CARP maintenance mode. The normal CARP election may shift the roles, and with them the active traffic, again.", "previewValid": "Preview valid until {time}. After a timeout, never retry blindly: check both CARP roles first.", "autoRevertRunning": "Already running with an automatic switch-back at {time}.", "autoRevertAfter": "Switch back automatically after", "minutes": "{n} minutes", "never": "Never (permanent, as before)", "autoRevertHint": "Safety net against a forgotten maintenance mode — switches back to normal operation automatically unless ended manually before.", "confirmHostname": "Enter the host name to confirm", "confirmHostnameAria": "Confirm host name for CARP", "ackEnter": "The BACKUP partner is updated and tested. ", "ackLeave": "Both nodes are updated and tested. ", "ackCommon": "I have checked reachability, console access and the expected target MASTER; a brief traffic interruption is accepted.", "executeEnter": "Perform role switch now", "executeLeave": "Restore normal operation now", "handoverShort": "{host} hands MASTER over to the partner", "leaveShort": "The normal CARP election decides the roles again", "expectedRole": "expected role", "previewValidShort": "Preview valid until {time}", "previewValidTip": "After a timeout never retry blindly: check both CARP roles first.", "ackEnterShort": "Partner is updated and tested; console access and a brief interruption are planned for.", "ackLeaveShort": "Both nodes are updated and tested; console access and a brief interruption are planned for." }, "maint": { "action": { "reboot": "Reboot", "update": "Firmware update", "major_update": "Major upgrade", "carp_enter": "CARP handover", "carp_leave": "CARP normal operation", "firmware_rollback": "Firmware rollback" }, "reason": { "haOrder": "HA order: this host is MASTER. Update the BACKUP first, then switch the roles with “Switch CARP to partner”.", "backupRequired": "Backup required: create a local backup that is at most 24 hours old before installing.", "noStableUpdate": "No stable package update reported. Run the update check.", "noMajorUpgrade": "No major upgrade reported. Run the update check.", "haPartnerNotReady": "HA partner not ready: the other node must be online and CARP MASTER." }, "loadFailed": "Loading failed", "scheduleFailed": "Scheduling failed", "cancelFailed": "Cancelling failed", "previewFailed": "Preview failed", "outcomeUnclear": "Outcome unclear. Check the maintenance status.", "finishFailed": "Completion failed", "checkFailed": "Update check failed", "logFailed": "Log not readable", "jobSubmitted": "Job submitted.", "checkRequested": "Update check requested. Refresh the status after a short while.", "title": "Host maintenance", "close": "Close maintenance", "open": "Open maintenance", "intro": "Reboot and stable firmware update apply to this host. In clusters the CARP BACKUP is updated first; the safeguarded role switch can then be performed directly here.", "installed": "Installed: {version}", "firmwareJob": "Firmware job: {state}", "lastCheck": "Last update check: {value}", "unknown": "unknown", "backup": "Backup: {value}", "noBackup": "none", "checkUpdates": "Check for updates", "previewReboot": "Review reboot", "previewUpdate": "Review update", "previewMajor": "Review major upgrade", "scheduleLater": "Run later…", "refreshStatus": "Refresh status", "hints": "Notes", "scheduled": "Scheduled maintenance", "scheduleStatus": { "pending": "pending", "running": "running", "succeeded": "submitted", "cancelled": "cancelled", "failed": "failed", "completed": "completed" }, "history": "History", "opStatus": { "acknowledged": "completed manually", "cancelled": "cancelled", "unknown": "Outcome unclear", "starting": "Handover started", "submitted": "Submitted to firewall" }, "confirmFinish": "Confirm completion", "cancelOperation": "Cancel operation", "readLog": "Read update log", "confirmTitle": "Confirm {action}", "majorWarning": "Major upgrade: switch to a new major version. Takes longer and is riskier than a plain package update, possibly with larger behaviour changes. Have a fresh backup and console access ready.", "downtimeNote": "The host will be temporarily unreachable. Ongoing connections may drop{reboot}. There is no automatic rollback for this maintenance action.", "andReboot": " and the update requires a reboot", "previewValid": "Preview valid until {time}.", "confirmHostname": "Enter the host name to confirm", "confirmHostnameAria": "Confirm host name", "windowReady": "Maintenance window and console access are ready; I accept the interruption.", "submitting": "Submitting…", "executeNow": "Run {action} now", "finishCarpTitle": "Complete CARP role switch", "finishTitle": "Complete maintenance", "finishCarpCheck": "Check the CARP roles and reachability of both cluster nodes. ", "finishCheckPre": "Check reachability, version and services on ", "finishNote": "This confirmation documents your check; it does not trigger any firewall action.", "finishHostnameAria": "Confirm host name for completion", "finishChecked": "I have verified the completion on the firewall.", "saveFinish": "Save verified completion", "cancelWarnPre": "This does ", "cancelWarnStrong": "not confirm", "cancelWarnPost": " a successful completion — it only closes the record so the host/cluster is no longer locked. Use this only if the expected state demonstrably never occurred (e.g. a CARP role switch is stuck).", "cancelHostnameAria": "Confirm host name to cancel", "reasonLabel": "Reason (for the audit log)", "reasonPlaceholder": "e.g. CARP role switch did not happen after several minutes", "closeWithoutConfirm": "Close operation without confirmation", "scheduleTitle": "Run maintenance later", "actionLabel": "Action", "timeLabel": "Time", "unattendedWarning": "Runs unattended at the chosen time. For updates, OPNexus takes a configuration backup itself right before. The other prerequisites are only re-checked then — if one is not met, the action is not executed and is marked as failed, without a retry.", "unattendedAck": "I understand that nobody will be present when the action runs.", "scheduling": "Scheduling…", "scheduleIt": "Schedule maintenance", "unattendedShort": "Runs unattended at the chosen time", "scheduleMasterBlocked": "This firewall is currently the CARP MASTER. Scheduled maintenance only runs on the BACKUP node, otherwise traffic would drop. Schedule the partner node instead, or enable CARP maintenance mode on this host first.", "handoverOption": "Switch to the partner first and switch back afterwards (CARP)", "handoverHint": "Flow: maintenance mode on this host, the partner becomes MASTER (verified), then the action runs, and once the host is back the maintenance mode is left again. If anything goes wrong the partner stays MASTER and a notification is sent. When switching back, the host may take the MASTER role back depending on the CARP settings (a short second switchover).", "handoverBadge": "with CARP switchover", "phase": { "handover_wait": "waiting for the partner to take over", "job_wait": "job running", "leave": "switching back", "leave_wait": "verifying normal operation", "verify": "checking the result" }, "autoVerifyOption": "Check the result automatically and close the operation", "autoVerifyHint": "After the job OPNexus checks by itself: firmware idle again, the expected reboot happened, version readable. Then the maintenance is closed and no longer locks the host. If anything is unclear it stays open (outcome unclear) and you are notified.", "rolloutBadge": "Rollout", "openRollout": "Open rollout", "autoVerifiedBadge": "checked automatically", "previewRollback": "Back to previous firmware", "tipRollback": "Activates the rollback point (boot environment) OPNexus created before the last firmware update and reboots the firewall. Shows a preview first.", "rollbackWarn": "The firewall restarts with the state from before the last update (version {version}, rollback point {point}).", "rollbackLoses": "The configuration is rolled back too: everything changed on the firewall since the rollback point is gone afterwards.", "rollbackChanges": "{n} deployments by OPNexus since the point are lost. They are marked as unclear. Afterwards, redeploy the central objects through the preview.", "rollbackNoChanges": "OPNexus has not deployed anything to this firewall since the rollback point.", "rollbackBackup": "OPNexus saves the current configuration locally first." }, "restore": { "handoffWarning": "OPNexus does NOT perform the restore itself. After the handover you must import the backup manually in the OPNsense web interface. While this operation is open, rule/alias/NAT pushes and host maintenance are blocked for this host.", "previewFailed": "Preview failed", "handoffFailed": "Handover failed", "confirmFailed": "Confirmation failed", "cancelFailed": "Cancelling failed", "title": "Restore", "hostBackup": "{host} · backup {backup}", "checking": "Checking backup…", "hostname": "Hostname", "domain": "Domain", "unknown": "unknown", "haSync": "HA sync", "active": "active", "inactive": "not active", "secretFields": "Secret fields", "secretsFound": "{count} found, not shown", "understood": "Warning understood — prepare handover", "typeHostname": "Enter host name “{host}” to confirm", "back": "Back", "handingOff": "Handover in progress…", "yesHandoff": "Yes, hand over now", "noteOptional": "Note (optional)", "cancel": "Cancel restore", "confirming": "Confirming…", "confirm": "Confirm restore", "cancelled": "Restore cancelled.", "typeHostnameAria": "Enter the host name to confirm" }, "certAction": { "import": "Import (certificate + optional key)", "internal": "Create internally (self-signed or CA-signed)", "external": "Create CSR (to be signed externally)", "sign_csr": "Sign CSR with an existing internal CA", "import_csr": "Import signed certificate", "reissue": "Reissue (no service restart)", "manual": "Manual (paste text only)" }, "certForm": { "edit": "Edit certificate", "new": "New trust store certificate", "host": "Host", "action": "Action", "description": "Description", "commonName": "Common name", "country": "Country (ISO code)", "state": "State / province", "city": "City", "organization": "Organization", "email": "Email", "keyType": "Key type", "digest": "Digest", "lifetime": "Validity (days)", "carefRequired": "CA reference (caref) — required", "carefOptional": "CA reference (caref) — empty = self-signed", "carefPlaceholder": "Refid of an existing internal CA on this host", "carefChoose": "Please choose", "carefSelfSigned": "Self-signed (no CA)", "csr": "CSR (PEM)", "certificate": "Certificate (PEM)", "privateKeyKeep": "Private key (PEM) — leave empty = unchanged", "privateKeyOptional": "Private key (PEM, optional)", "privateKeyAria": "Private key (PEM)", "privateKeyNote": "Never stored in the database, only as a file on the OPNexus server (accessible only to the server process, mode 0600)." }, "acmeRequest": { "edit": "Edit ACME certificate request", "new": "New ACME certificate request", "localNote": "Creating and saving is a purely local configuration change. Only the separate “Issue now” action contacts the certificate authority.", "account": "ACME account", "chooseAccount": "Choose account…", "noAccount": "No ACME account exists for this host yet — create one first.", "commonName": "Common name / FQDN", "altNames": "Alternative names (comma-separated, optional)", "validation": "Validation method (UUID — configured in OPNsense itself under ACME Client > Validation)", "validationPlaceholder": "UUID of the validation method on this host", "keyLength": "Key length", "renewInterval": "Renewal after (days since last issuance)", "renewWarning": "Note: days SINCE the last issuance, not days BEFORE expiry.", "ocsp": "OCSP Must-Staple", "autoRenewal": "Automatic renewal (OPNsense's own cron)", "active": "Active" }, "drift": { "loadRulesFailed": "Could not load live rules", "noHosts": "No hosts yet.", "onlyDiffs": "Show differences only", "comparingRules": "Comparing rules from {count} hosts…", "rulesTotal": "{count} rules in total", "someDiffer": ", {count} differ", "allIdentical": ", all identical on all hosts", "noDiffs": "No differences found.", "noRules": "No rules found.", "colDescription": "Description", "colInterface": "Interface", "colSourceDest": "Source → destination", "colAction": "Action", "automatic": "(automatic)", "noCluster": "No cluster", "noClusterHint": "No drift detection without a comparison host — view rules individually:", "loadAliasesFailed": "Could not load live aliases", "comparingAliases": "Comparing aliases from {count} hosts…", "aliasesIdentical": "{same} of {total} aliases identical on all hosts", "noAliases": "No aliases found.", "colName": "Name", "colType": "Type", "empty": "(empty)", "noClusterAliasesHint": "No drift detection without a comparison host — view aliases individually:", "loadNatFailed": "Could not load live NAT", "comparing": "comparing…", "natIdentical": "{same} of {total} identical on all hosts", "noClusterNatHint": "No drift detection without a comparison host — view NAT rules individually:" }, "palette": { "category": { "navigation": "Pages", "hosts": "Hosts", "rules": "Rules", "aliases": "Aliases", "nat": "NAT", "vpn": "VPN", "certificates": "Certificates", "groups": "Groups", "policy-hierarchy": "Policy hierarchy" }, "dialog": "Search", "placeholder": "Search pages, hosts, rules, aliases, NAT, VPN …", "noResults": "No results" }, "nat": { "liveTab": "Live on firewall", "externalNet": "External network (IP/CIDR)", "reflectionDefault": "System default", "reflectionEnabled": "Enabled", "reflectionDisabled": "Disabled", "invertSource": " Invert source", "invertDestination": " Invert destination", "type": "NAT type", "binat": "BINAT · bidirectional", "natOutbound": "NAT · outbound", "hierarchyHint": "The NAT rule additionally applies to all current and future hosts in the subtree.", "protocol": "Protocol", "sourcePortOptional": "Source port (optional)", "destinationPortOptional": "Destination port (optional)", "ipVersion": "IP version", "translationTarget": "Translation target (IP or alias)", "translationTargetOptional": "Translation target (empty = interface address)", "translatedPort": "Translated port", "filterRuleNote": "A matching filter rule must exist separately. Port forward does not create it automatically.", "loading": "Loading NAT…", "liveDrift": "Live drift", "filterRuleShort": "Create the filter rule separately" }, "groups": { "loading": "Loading groups…", "loadFailed": "Could not load groups", "deleteConfirm": "Delete device group “{name}”? The hosts are kept.", "deleted": "Device group “{name}” deleted", "title": "Device groups", "titleNamed": "Device groups · {name}", "new": "New group", "subtitle": "Shared policies for sites, environments or functions. A host can belong to several groups. HA clusters remain independent of this.", "statGroups": "Device groups", "statHosts": "Assigned hosts", "statRules": "Rules with group targets", "statAliases": "Aliases with group targets", "savedNote": "Group “{name}” saved. ", "checkRules": "Review or create related rules →", "showAll": "Show all groups", "searchLabel": "Search groups", "searchPlaceholder": "Search groups …", "emptyTitle": "Shared rules start with a group", "emptyText": "For example, create “Sites” or “Data center” and pick the matching firewalls.", "createFirst": "Create first group", "noMatch": "No group matches your search.", "resetSearch": "Reset search", "editAria": "Edit {name}", "deleteAria": "Delete {name}", "deleteInUse": "Remove the rule/alias assignments first", "deleteTitle": "Delete group", "assignHosts": "Assign hosts", "centralRules": "{count} central rules →", "onlyHosts": "So far the group only bundles hosts. Assign a central rule to it now.", "createRule": "Create rule for this group", "centralAliases": "{count} central aliases →", "createAlias": "Create alias for this group", "editTitle": "Edit device group", "newTitle": "New device group", "namePlaceholder": "e.g. Branch offices", "descPlaceholder": "Shared base rules for all sites", "members": "Members", "disabled": "(disabled)", "createHostsFirst": "Create hosts first.", "membershipNote": "Memberships take effect at the next push. Saving does not change any firewall. Rules that are already deployed remain on removed members.", "impactTitle": "Impact on central rules", "added": "Added: {names}", "removed": "Removed: {names}", "noMembers": "no members", "impactEmpty": "No rules or aliases are assigned to the group yet. The change only affects its members and description.", "newRuleTargets": "{added} new rule targets · {removed} removed rule targets", "retainedCopies": "{count} already deployed copies remain. After saving, clean them up selectively under “Review & push”.", "aliasPrefix": "Alias: {name}", "newTargets": "{added} new targets · {removed} removed targets", "natPrefix": "NAT: {name}", "natRetained": "{count} deployed copies remain. Clean them up selectively under NAT.", "otherGroupNote": "Hosts that remain a target of the same rule through another group or directly are not counted as removed rule targets.", "changeSelection": "Change selection", "wait": "Please wait…", "checkImpact": "Review impact", "save": "Save group" }, "aliases": { "loading": "Loading aliases…", "loadFailed": "Could not load aliases", "createFailed": "Could not create alias", "deleteConfirm": "Really delete this alias? It will also be removed from all target hosts.", "deletedNamed": "Alias “{name}” deleted", "deleted": "Alias deleted", "title": "Firewall aliases", "titleNamed": "Aliases · {name}", "showAll": "Show all aliases", "new": "New alias", "subtitle": "Centrally managed objects (hosts, networks, ports) — maintain once, deploy to several firewalls instead of keeping each one in sync individually.", "searchLabel": "Search aliases", "searchPlaceholder": "Name, description, content …", "none": "No central aliases created yet.", "noMatch": "No aliases match this selection.", "createFirst": "Create first alias", "empty": "(empty)", "disabledSuffix": " · alias disabled", "historyTitle": "Alias history", "duplicateTitle": "Duplicate alias", "editDraft": "Edit alias draft", "nameHint": "Letters, digits and underscores only", "typeLabel": "Type", "content": "Content", "active": "Alias active", "hierarchyHint": "The alias is additionally deployed to all current and future hosts in the subtree.", "coveredBy": "(already covered via {groups})", "type": { "host": "Host(s)", "network": "Network(s)", "port": "Port(s)", "networkgroup": "Network group", "mac": "MAC address(es)", "asn": "BGP ASN(s)" }, "hint": { "host": "One IP or host name per line", "network": "One CIDR per line, e.g. 10.10.120.0/24", "port": "One port number or range per line, e.g. 8080 or 8000:8100", "networkgroup": "One alias name per line (combines other aliases)", "mac": "One MAC address per line, e.g. 00:11:22:33:44:55", "asn": "One AS number per line, e.g. 64512" } }, "ph": { "loading": "Loading…", "loadFailed": "Could not load data", "groupSaveFailed": "Could not save group", "deleteGroupConfirm": "Delete group “{name}”?", "ruleSaveFailed": "Could not save rule", "deleteRuleConfirm": "Really delete rule “{name}”? It will also be removed from all target hosts.", "moveFailed": "Moving failed", "orderSaved": "Order saved. Apply it to already deployed rules with “Re-establish order”.", "orderSaveFailed": "Could not save order", "reassertFailed": "Reassert failed", "reassertDone": "Order for “{name}” and all subgroups has been re-established.", "title": "Hierarchical policies", "subtitle": "Define pre/post rules on parent groups — they are deployed automatically, in the correct order, to all hosts of the group and its subgroups.", "groupTree": "Group tree", "noGroups": "No groups created yet.", "selectGroup": "Select or create a group", "selectGroupHint": "Rules are defined on a group and automatically reach all hosts of that group and its subgroups.", "directHosts": "{count} directly assigned host(s) · ", "assignHosts": "Assign hosts", "reassertTitle": "Applies the saved order on all hosts of this group and its subgroups. It is also checked automatically after other OPNexus deployments.", "reasserting": "Reassert running…", "reassert": "Re-establish order", "preRules": "Pre rules", "preHint": "Evaluated before the post rules. With several levels, the topmost group comes first.", "postRules": "Post rules", "postHint": "Evaluated after the pre rules. With several levels, the lowest (most specific) group comes first.", "editGroup": "Edit group", "parentGroup": "Parent group (optional)", "rootGroup": "(none — root group)", "editRule": "Edit rule", "newPreRule": "New pre rule", "newPostRule": "New post rule", "addRule": "Add rule", "noRulesInCategory": "No rules in this category yet.", "targetHosts": "{count} target host(s) · {names}", "none": "none", "dragTitle": "Drag to change the order", "moveUp": "Move up", "moveDown": "Move down" }, "certs": { "deploy": { "draft": "Draft (not pushed yet)", "success": "Pushed successfully", "error": "Error" }, "loading": "Loading certificates…", "hostFailed": "Error", "hostsLoadFailed": "Could not load hosts", "loadFailed": "Could not load certificates", "acmeLoadFailed": "Could not load ACME data", "pushFailed": "Push failed", "certPushed": "Certificate “{name}” pushed", "certDeleteConfirm": "Really delete certificate “{name}”? If it was already pushed to the firewall, it is removed there as well (unless in use).", "certDeleted": "Certificate “{name}” deleted", "accountPushed": "Account “{name}” pushed", "accountDeleteConfirm": "Really delete ACME account “{name}”?", "accountDeleted": "Account “{name}” deleted", "requestPushed": "Request “{name}” pushed", "pollFailed": "Could not refresh status", "requestDeleteConfirm": "Really delete certificate request “{name}”?", "requestDeleted": "Request “{name}” deleted", "title": "Certificates", "subtitle": "Live fleet overview as well as central management of trust store certificates and ACME/Let's Encrypt issuance.", "tabLive": "Live overview", "tabTrust": "Manage trust store", "tabAcme": "ACME / Let's Encrypt", "hostsPending": "{pending} of {total} hosts still pending…", "attentionOne": "{count} certificate expires within the next 30 days or has already expired.", "attentionMany": "{count} certificates expire within the next 30 days or have already expired.", "colHost": "Host", "colName": "Name / CN", "colIssuer": "Issuer", "colValidTo": "Valid until", "colStatus": "Status", "noneFound": "No certificates found.", "hostUnavailable": "{host}: certificates unavailable", "trustIntro": "OPNsense core trust store (import/create internally/CSR/CA-sign/manual) — managed per host, since internal CA references and certificate UUIDs are host-local. A push is a single, immediately effective API call without a service restart — no warning needed, as there is no lockout risk.", "newCert": "New certificate", "createHostFirst": "Create at least one host first.", "showAll": "Show all certificates", "noManaged": "No managed certificates yet.", "actionAndCn": "{host} · Action: {action}", "edit": "Edit", "push": "Push", "delete": "Delete", "certSaved": "Certificate saved", "certCreated": "Certificate created", "acmeIntro": "ACME plugin (os-acme-client) — accounts and certificate requests managed per host (host-local UUIDs). Creating/changing is a purely local configuration change; “Register” and “Issue now” contact the real certificate authority and are therefore hidden behind an explicit warning.", "accounts": "ACME accounts", "newAccount": "New account", "noAccounts": "No ACME accounts yet.", "registration": "Registration: {state}", "registrationOk": "successful", "registrationFailed": "failed", "pushFirst": "Not on the firewall yet: send it there first with “Push”.", "register": "Register", "requests": "ACME certificate requests", "newRequest": "New request", "createAccountFirst": "Create at least one ACME account first.", "noRequests": "No certificate requests yet.", "issuance": "Issuance: {state}", "issuanceTriggered": "triggered (check the result via “Status”)", "issuanceError": "Error while triggering", "requestMeta": "{host} · Account: {account} · Renewal every {days} days (since last issuance)", "firewallStatusCode": "Firewall status code: {code}", "lastIssuance": " · last issuance: {time}", "issueNow": "Issue now", "status": "Status", "accountSaved": "Account saved", "accountCreated": "Account created", "requestSaved": "Request saved", "requestCreated": "Request created", "registerTitle": "Register ACME account “{name}”", "registering": "Registration in progress…", "accountRegistered": "Account “{name}” registered", "issueTitle": "Issue certificate “{name}” now", "triggering": "Triggering…", "issuanceTriggeredToast": "Issuance for “{name}” triggered" }, "ipsec": { "loading": "Loading tunnels…", "loadFailed": "Could not load tunnels", "saved": "Tunnel “{name}” saved", "created": "Tunnel “{name}” created", "pskRequired": "A pre-shared key is required when creating a tunnel", "saveFailed": "Could not save tunnel", "deleteConfirm": "Really delete this tunnel? It will also be removed from all target hosts (connection, identities, phase 2, pre-shared key) and the IPsec service will be reloaded.", "tunnelFallback": "Tunnel", "deleted": "Tunnel “{name}” deleted", "title": "IPsec VPN (site-to-site)", "new": "New tunnel", "intro": "Site-to-site tunnels with a pre-shared key, maintained centrally and deployed to firewalls or device groups. Unlike firewall rules there is no automatic rollback: a failed service reload can cut the connection OPNexus uses to reach the firewall. One phase 2 per tunnel and simple network-to-network tunnels are supported (no certificates/EAP, no pools).", "showAll": "Show all tunnels", "none": "No IPsec tunnels created yet.", "createFirst": "Create first tunnel", "noPsk": "No PSK stored", "disabledSuffix": " · tunnel disabled", "historyTitle": "Tunnel history", "editTitle": "Edit tunnel", "newTitle": "New IPsec tunnel", "descPlaceholder": "S2S to north branch", "localAddress": "Local address", "localAddressPlaceholder": "203.0.113.1 or %any", "remoteAddress": "Remote address", "ikeVersion": "IKE version", "proposal": "Proposal (phase 1)", "espProposal": "ESP proposal (phase 2)", "localIdentity": "Local identity", "localIdentityPlaceholder": "e.g. local IP", "remoteIdentity": "Remote identity (optional)", "remoteIdentityPlaceholder": "e.g. remote IP", "localNetwork": "Local network (CIDR)", "remoteNetwork": "Remote network (CIDR)", "pskEditing": "Pre-shared key ({state})", "pskSet": "set — leave empty to keep it", "pskNotSet": "not set yet", "psk": "Pre-shared key", "pskKeep": "Leave empty = unchanged", "pskPlaceholder": "Shared secret", "active": "Tunnel active" }, "ovpn": { "loading": "Loading instances…", "trustLoadFailed": "Could not load trust store", "loadFailed": "Could not load instances", "saved": "Instance “{name}” saved", "created": "Instance “{name}” created", "saveFailed": "Could not save instance", "deleteConfirm": "Really delete this OpenVPN instance? It will also be removed from all target hosts (instance, static key if any) and the OpenVPN service will be reloaded.", "instanceFallback": "Instance", "deleted": "Instance “{name}” deleted", "title": "OpenVPN instances", "new": "New instance", "intro": "OpenVPN instances (server or client), maintained centrally and deployed to firewalls or device groups. As with IPsec there is no automatic rollback: a failed service reload can cut the connection OPNexus uses to reach the firewall. Every target firewall must already have a certificate and CA (selected from its certificate store); optional TLS protection (tls-auth/tls-crypt) via a static key is supported, but no “shared key” instances without a certificate.", "showAll": "Show all instances", "none": "No OpenVPN instances created yet.", "createFirst": "Create first instance", "tlsKeyMissing": "TLS key enabled but not stored", "roleServer": "Server", "roleClient": "Client", "tlsHardening": " · TLS hardening ({mode})", "disabledSuffix": " · instance disabled", "historyTitle": "Instance history", "editTitle": "Edit instance", "newTitle": "New OpenVPN instance", "descPlaceholder": "Road warrior server", "role": "Role", "bindAddress": "Bind address (optional)", "bindPlaceholder": "empty = all interfaces", "tunnelNetwork": "Tunnel network (CIDR)", "remoteTarget": "Remote target (host or host:port)", "tlsHardeningLabel": "TLS hardening (tls-auth/tls-crypt) via an additional static key", "staticKeyMode": "Static key mode", "modeCrypt": "crypt (encrypted + authenticated)", "modeAuth": "auth (authenticated only)", "staticKeyEditing": "Static key ({state})", "staticKey": "Static key", "keyPlaceholder": "Paste key material", "active": "Instance active", "certCaPerHost": "Certificate / CA per target host", "noTargets": "No target hosts selected — select hosts or a device group above; the selection then appears here, per host from its own trust store.", "trustLoading": "Loading trust store…", "certificate": "Certificate", "noCerts": "No certificates found on this host.", "pleaseChoose": "Please choose…", "ca": "CA", "noCas": "No CAs found on this host." }, "wg": { "saved": "Tunnel “{name}” saved", "created": "Tunnel “{name}” created", "deleteConfirm": "Really delete this WireGuard tunnel? It will also be removed from all target hosts (peer, then server) and the WireGuard service will be reloaded.", "title": "WireGuard tunnels", "intro": "WireGuard connections (one server interface and exactly one peer per tunnel), maintained centrally and deployed to firewalls or device groups. As with IPsec there is no automatic rollback: a failed service reload can cut the connection OPNexus uses to reach the firewall. You generate and enter the keys yourself; a pre-shared key per peer is optional.", "none": "No WireGuard tunnels created yet.", "noPrivateKey": "No private key stored", "pskMissing": "PSK enabled but not stored", "summary": "{address} · port {port} · peer allowed IPs {ips}", "peerPskActive": " · peer PSK active", "newTitle": "New WireGuard tunnel", "serverSection": "Server (local interface)", "interfaceName": "Interface name", "listenPort": "Listen port", "dns": "DNS (optional)", "dnsPlaceholder": "empty = none", "mtu": "MTU (optional)", "mtuPlaceholder": "empty = OPNsense default", "serverPublicKey": "Server public key", "serverPublicKeyPlaceholder": "Public key of the server", "serverPrivateKeyEditing": "Server private key ({state})", "serverPrivateKey": "Server private key", "privateKeyPlaceholder": "Paste private key", "keyNote": "OPNexus does not generate key pairs (no automatic call to OPNsense's own “gen_keypair”). Generate both keys yourself (e.g. via {cmd}) and enter them here.", "peerSection": "Peer", "peerName": "Peer name", "allowedIps": "Allowed IPs (CIDR)", "peerPublicKey": "Peer public key", "peerPublicKeyPlaceholder": "Public key of the peer", "endpointAddress": "Endpoint address (optional)", "endpointAddressPlaceholder": "empty = peer only connects inbound", "endpointPort": "Endpoint port (required if an address is set)", "keepalive": "Keepalive in seconds (optional)", "keepalivePlaceholder": "empty = no keepalive", "pskLabel": "Additional pre-shared key for this peer (WireGuard's own PSK, not IPsec's PSK)", "peerPskEditing": "Peer PSK ({state})", "peerPsk": "Peer PSK", "pskPlaceholder": "Paste PSK" }, "auditExport": { "title": "Audit export", "intro": "Forwards the audit trail (who changed what, with status) to a syslog server and/or a webhook, so it also exists outside OPNexus. Only new events are sent from the moment you switch it on; firewall object contents are never included. Delivery is at least once: every event carries its id.", "saved": "Audit export saved", "testSent": "Test message sent", "testFailed": "The test message could not be delivered", "syslog": "Syslog (RFC 5424)", "host": "Host", "port": "Port", "protocol": "Protocol", "webhook": "Webhook", "webhookUrl": "Webhook URL", "secret": "Signing secret ({state})", "isSet": "set", "notSet": "not set", "keep": "leave empty to keep", "optional": "optional", "removeSecret": "Remove the signing secret", "test": "Send test message", "lastError": "Last delivery failed {when}: {message}", "lastSuccess": "Last delivery {when}" }, "backupSettings": { "title": "Backups", "intro": "Takes a configuration backup of every firewall on a schedule and keeps the newest ones. Optionally a copy is encrypted here with your passphrase and uploaded to S3-compatible storage (AWS S3, MinIO, Backblaze B2, Wasabi, Cloudflare R2, Hetzner…), so a lost OPNexus server or a lost firewall is not the end of your configuration. Delete old offsite copies with the bucket's lifecycle rules.", "saved": "Backup settings saved", "scheduled": "Back up all firewalls on a schedule", "interval": "How often", "everyHours": "every {n} hours", "keep": "Keep the newest (per firewall)", "offsite": "Copy backups to S3-compatible storage (encrypted)", "endpoint": "Endpoint", "region": "Region", "bucket": "Bucket", "prefix": "Folder in the bucket", "accessKey": "Access key", "secretKey": "Secret key ({state})", "pathStyle": "Path-style addressing (works everywhere; turn off only if your provider needs bucket.host)", "passphrase": "Encryption passphrase ({state})", "passphraseNew": "at least 12 characters", "passphraseHint": "Backups are encrypted before they leave this server. Without the passphrase an offsite copy cannot be read — keep it somewhere safe besides OPNexus. Changing it only affects new uploads.", "offsiteError": "Offsite copy failed: {message}", "offsiteOk": "Last offsite copy {when}", "lastRun": "Last scheduled run {when}", "test": "Test the target", "testOk": "The target works (written, read back, deleted)", "testFailed": "The target test failed", "runNow": "Back up now", "ran": "{taken} backed up, {failed} failed, {uploaded} uploaded" }, "backupDiff": { "title": "Changes since the previous backup", "hint": "Secrets (passwords, keys, tokens, certificates) are shown as hashes only: a changed secret appears as a changed hash.", "identical": "No differences.", "summary": "{added} lines added, {removed} removed", "truncated": "The list is cut off; compare the files in OPNsense for the rest.", "failed": "The comparison failed" }, "overlay": { "title": "Management tunnel", "intro": "Lets OPNexus manage firewalls that have no public address (behind NAT, CGNAT, a mobile link). Each firewall dials out to a WireGuard hub on this server; OPNexus then reaches its API through the tunnel. Nothing on the firewall has to be reachable from the internet. Needed on the server: the hub container (COMPOSE_PROFILES=overlay) and a UDP port reachable from the internet.", "loadFailed": "Could not load the management tunnel", "saved": "Saved", "enable": "Enable the management tunnel", "hub": { "running": "hub running", "stale": "hub not reporting", "absent": "hub not running" }, "hubAbsent": "The hub container is not running. Add COMPOSE_PROFILES=overlay to .env and run docker compose up -d.", "endpoint": "Address of this server (as the firewalls see it)", "endpointHint": "Public DNS name or IP of this server. Add :port if the published UDP port differs.", "port": "UDP port", "subnet": "Tunnel network", "subnetHint": "A private network used only for these tunnels. Cannot be changed while firewalls are registered.", "hubKey": "Hub public key", "hubAddress": "hub address", "addPeer": "Add a firewall", "nameHint": "A name for this firewall or site.", "create": "Create", "colName": "Firewall", "colAddress": "Tunnel address", "colStatus": "Status", "colHost": "Managed host", "needsKey": "waiting for the firewall's key", "connected": "connected", "waiting": "not connected yet", "empty": "No firewalls yet.", "instructions": "Instructions", "link": "Key / host", "delete": "Delete", "deleteConfirm": "Remove “{name}” from the management tunnel? The firewall will no longer be reachable through it.", "deleted": "“{name}” removed", "howTitle": "Connect “{name}”", "howIntro": "Do this once in the firewall's own web interface (OPNsense: VPN › WireGuard). Copy the values with the buttons.", "step1": "1. Local instance", "step1Hint": "Create a new instance: let OPNsense generate its key pair, no listen port is needed, and enter this tunnel address:", "fieldAddress": "Tunnel address", "step2": "2. Peer (the hub)", "fieldPublicKey": "Public key", "fieldPsk": "Pre-shared key", "fieldEndpoint": "Endpoint address and port", "fieldAllowed": "Allowed IPs", "fieldKeepalive": "Keepalive (seconds)", "step3": "3. Let the hub in", "step3Text": "Add a firewall rule on the WireGuard interface group: pass TCP from {hub} to “This Firewall”, port 443 (or the port of the web interface).", "step4": "4. Give OPNexus the firewall's public key", "step4Text": "Copy the public key of the new local instance from OPNsense, close this window and use “Key / host” on this firewall.", "step5": "5. Add the firewall as a host", "step5Text": "Add or edit the host with this address and the usual API key. It then shows up as connected here.", "fieldUrl": "Host address", "linkTitle": "Key and host of “{name}”", "firewallKey": "Public key of the firewall's WireGuard instance", "firewallKeyHint": "From OPNsense: VPN › WireGuard › Instances. Leave empty to remove it.", "hostHint": "Optional: which managed host is reached through this tunnel." }, "variables": { "title": "Site variables", "intro": "Rules, aliases and NAT entries can contain placeholders like {{LAN_NET}}. Each firewall fills them with its own value, so one object serves many sites with different networks. A firewall without a value for a placeholder is never pushed: the preview says so and the deploy is refused. Values may contain letters, digits and . : / , @ + - _ and spaces.", "loadFailed": "Could not load the variables", "saved": "Variables saved", "saveFailed": "Could not save the variables", "empty": "No placeholders in use. Write {{NAME}} into a rule, alias or NAT entry (capital letters, digits and _) and define its value here.", "missing": "{n} value(s) missing", "required": "required", "usedBy": "Used by: {list}", "newName": "New variable name", "add": "Add" }, "sso": { "title": "Single sign-on (OIDC)", "intro": "Lets people sign in with your identity provider (Authentik, Keycloak, Entra ID, Google, …) instead of a password stored here. Roles come from the provider's groups at every login; without a mapped group nobody gets in. Local accounts keep working, so you can always sign in with the admin password if the provider is down.", "saved": "SSO settings saved", "testOk": "The provider answered (discovery and signing keys are fine)", "testFailed": "The provider test failed", "enable": "Offer single sign-on on the login page", "redirectHint": "Register this redirect URI with your provider:", "name": "Button text", "issuer": "Issuer URL", "clientId": "Client ID", "clientSecret": "Client secret ({state})", "scopes": "Scopes", "claim": "Groups claim", "mapping": "Which group gets which role", "mappingHint": "Enter the group names as the provider sends them. The most privileged matching role wins; a person in none of them cannot sign in. Roles of SSO accounts are managed at the provider and refreshed at every login. Providers that only send groups when asked (e.g. Okta) need the scope \"groups\" added to the scopes.", "test": "Test the provider", "dutiesTitle": "Separation of duties", "dutiesIntro": "When switched off, operators can prepare changes (edit, preview) but only an administrator may roll them out: deploy, remove or roll back a deployment, run or schedule maintenance and apply network changes. The refusal is recorded in the audit.", "operatorsDeploy": "Operators may roll out changes themselves", "dutiesSaved": "Saved" }, "report": { "title": "Security report", "generated": "Created {when} · OPNexus {version}", "back": "Back", "print": "Print / save as PDF", "score": "Score", "open": "Open findings", "checked": "Checked", "open_report": "Report" }, "security": { "title": "Security posture", "intro": "Checks every firewall's configuration for common weaknesses (open rules, weak SSH/SNMP, missing backups…) and gives a score from 0 to 100. Read-only: nothing is changed on the firewalls. Checked automatically every 6 hours.", "loadFailed": "Could not load the security posture", "checkFailed": "The check failed", "checked": "Check finished", "checkAll": "Check all", "checkHost": "Check again", "noHosts": "No firewalls yet", "noHostsHint": "Connect a firewall to see its security posture.", "notChecked": "Not checked", "neverChecked": "Not checked yet", "checkedAt": "Checked {when}", "allGood": "No open findings", "andMore": "… and {n} more", "unknown": "unknown", "failed": "failed", "passed": "passed", "severity": { "critical": "critical", "high": "high", "medium": "medium", "low": "low", "info": "note" }, "error": { "unreachable": "unreachable", "invalid_config": "unreadable" }, "errorHint": { "unreachable": "The firewall could not be reached, so it could not be checked.", "invalid_config": "The configuration could not be read." }, "reason": { "root_password": "root may log in over SSH with a password", "password": "SSH accepts password login" }, "checks": { "webgui_https": { "title": "Web interface over HTTPS only", "ok": "The management interface is served over HTTPS.", "fail": "The management interface runs over unencrypted HTTP. Credentials can be read on the network.", "fix": "System › Settings › Administration: set the protocol to HTTPS." }, "ssh_hardened": { "title": "SSH locked down", "ok": "SSH is off or accepts keys only.", "fail": "{reason}.", "fix": "Switch SSH off, or disable root login and password login under System › Settings › Administration and use keys." }, "snmp_community": { "title": "SNMP community is not “public”", "ok": "SNMP uses a custom community.", "fail": "SNMP uses the default community “public”. Anyone on the network can read system data.", "fix": "Set your own long community or turn SNMP off." }, "wan_any_any": { "title": "No allow-all rule on the WAN", "ok": "No rule on the WAN allows all traffic to everywhere.", "fail": "{count} rule(s) on the WAN allow all traffic to any destination — the firewall protects nothing there.", "fix": "Restrict the rule to the sources, destinations and ports you need, or delete it." }, "internal_any_any": { "title": "No allow-all rule from any source (internal)", "ok": "No internal rule allows any source to any destination.", "fail": "{count} rule(s) allow any source to any destination.", "fix": "Limit the source to the network the rule is meant for." }, "rules_shadowed": { "title": "No shadowed rules", "ok": "Every rule can be reached.", "fail": "{count} rule(s) are never reached because an earlier rule already covers them.", "fix": "Check the order; remove the useless rule or move it up." }, "rules_duplicate": { "title": "No duplicate rules", "ok": "No rule is repeated.", "fail": "{count} rule(s) are identical to an earlier one.", "fix": "Delete the duplicate." }, "rules_documented": { "title": "Rules are described", "ok": "All active rules have a description.", "fail": "{count} active rule(s) have no description.", "fix": "Add a description so it stays clear later what the rule is for." }, "ntp_configured": { "title": "Time server set", "ok": "Time servers are configured.", "fail": "No time server is configured. Logs and certificates need the right time.", "fix": "Enter NTP servers in the time settings." }, "remote_logging": { "title": "Logs are kept elsewhere too", "ok": "A remote syslog target is configured.", "fail": "Logs exist only on the firewall. After a break-in or a failure they are gone.", "fix": "Add a syslog server under System › Settings › Logging." }, "ids_enabled": { "title": "Intrusion detection active", "ok": "Intrusion detection is on.", "fail": "Intrusion detection (IDS/IPS) is not switched on.", "fix": "Optional: enable Services › Intrusion Detection." }, "firmware_current": { "title": "Firmware up to date", "ok": "No updates are pending.", "fail": "Updates are available.", "fix": "Install them in the Update Center.", "unknown": "Could not determine the update status." }, "backup_recent": { "title": "Recent backup", "ok": "The newest backup is {days} day(s) old.", "fail": "There is no backup from the last 7 days.", "fix": "Use “Back up now” on the host page or schedule maintenance." }, "rules_unused": { "title": "Rules in use", "ok": "Every rule matched traffic in the last 30 days.", "fail": "{count} rule(s) have matched nothing for at least 30 days.", "unknown": "Still collecting data: a rule counts as unused only after 30 days without a hit.", "fix": "Check whether the rule is still needed and disable or delete it." } }, "hits": { "title": "Rule usage", "intro": "When each rule last matched traffic, as observed by OPNexus. The firewall's own counters restart with every change and reboot, so OPNexus keeps the last time it saw one grow. A rule counts as unused after 30 days without a hit.", "rule": "Rule", "state": "Status", "lastHit": "Last hit seen", "packets": "Packets since reload", "states": { "used": "in use", "unused": "unused", "collecting": "collecting data", "disabled": "disabled" } }, "cleanupLink": "Show the candidates in cleanup" }, "tokens": { "title": "API tokens", "new": "New token", "intro": "Tokens let scripts, CI jobs, Prometheus and AI assistants use the OPNexus API without a sign-in. Each token belongs to you, has a scope and can be revoked at any time. It never gets more rights than your account.", "loadFailed": "Could not load API tokens", "createFailed": "Could not create the token", "empty": "No tokens yet.", "colName": "Name", "colScope": "Scope", "colOwner": "Owner", "colExpires": "Expires", "colLastUsed": "Last used", "never": "Never", "neverUsed": "Not used yet", "days": "{n} days", "nameHint": "What the token is for, e.g. “Grafana” or “CI deploy”.", "scope": { "read": "Read", "deploy": "Deploy", "admin": "Admin" }, "scopeHint": { "read": "Read only: view everything, change nothing. For dashboards, Prometheus and AI assistants.", "deploy": "Read plus roll out rules, aliases, NAT, VPN and maintenance. Cannot manage users, settings or hosts.", "admin": "Everything your account may do, except managing tokens and your own account." }, "password": "Your password", "passwordHint": "Creating a token needs your current password.", "create": "Create token", "revoke": "Revoke", "revokeConfirm": "Revoke token “{name}”? Anything using it stops working immediately.", "revoked": "Token “{name}” revoked", "createdTitle": "Token “{name}” created", "shownOnce": "Copy the token now. It is shown only once and cannot be displayed again.", "copy": "Copy", "copied": "Copied", "example": "Example", "done": "Done" }, "users": { "ssoTip": "Managed by single sign-on: role and password are changed at the identity provider.", "roleOperator": "Operator", "roleAdmin": "Admin", "roleReadOnly": "Read-only", "loadFailed": "Could not load users", "deleteConfirm": "Really delete user “{name}”?", "deleted": "User “{name}” deleted", "title": "Users", "new": "New user", "intro": "“Admin” may do everything. “Operator” rolls out and operates (rules, NAT, VPN, maintenance) but cannot manage users, settings or hosts. “Read-only” can view all pages and data but cannot save changes — only your own password can always be changed.", "colUsername": "Username", "colRole": "Role", "colCreated": "Created", "colLastLogin": "Last sign-in", "you": "(you)", "cannotDeleteSelf": "You cannot delete your own account – another admin has to do that.", "created": "User created", "updated": "User “{name}” updated", "createFailed": "Could not create user", "password": "Password", "createUser": "Create user", "editTitle": "Edit user: {name}", "newPassword": "New password (optional)", "keepPassword": "leave empty to keep unchanged" }, "logs": { "preset": { "1h": "Last hour", "24h": "Last 24 hours", "7d": "Last 7 days", "all": "Entire period", "custom": "Custom" }, "loadFailed": "Could not load logs", "title": "Firewall logs", "hostOrCluster": "Host or cluster", "allHosts": "All hosts", "clusterOption": "Cluster: {name} (all hosts)", "statsLoading": "Loading statistics…", "byAction": "By action", "noData": "No data in this period.", "byInterface": "By interface", "topBlocked": "Top blocked sources", "noBlocked": "No blocked connections in this period.", "topPorts": "Top destination ports", "searchLabel": "Search logs", "searchPlaceholder": "Label, source, destination…", "action": "Action", "allActions": "All actions", "interface": "Interface", "allInterfaces": "All interfaces", "protocol": "Protocol", "allProtocols": "All protocols", "period": "Period", "from": "From", "to": "To", "colTime": "Time", "colHost": "Host", "colSource": "Source", "colDestination": "Destination", "noEntries": "No log entries for this selection.", "range": "{from}–{to} of {total} matches", "back": "Back", "page": "Page {page} / {pages}", "next": "Next" }, "cluster": { "error": "Error", "loadFailed": "Could not load cluster view", "comparing": "Comparing rules…", "countDiffers": "Rule count differs — view details", "synced": "In sync", "ungrouped": "Not grouped", "ungroupedHint": "These hosts have no cluster name — assign one under Hosts ▸ Edit to see them grouped here.", "rulesCount": "{count} rules", "rulesUnavailable": "Rules unavailable", "carpHistoryFailed": "Could not load CARP history", "carpHistory": "CARP role history ({count})", "noRoleChanges": "No role changes recorded yet.", "unknown": "unknown" }, "about": { "tagline": "Central management of multiple OPNsense firewalls.", "version": "OPNexus {version} “{codename}” · in-house development by {maintainer}", "fleetStatus": "Fleet status", "colAddress": "Address", "colVersion": "OPNsense version", "colLiveRules": "Live rules", "unavailable": "unavailable" }, "audit": { "kind": { "rule": "Rules", "rule_cleanup": "Rule cleanup", "alias": "Aliases", "port_forward": "Port forward", "one_to_one": "1:1 NAT", "outbound_nat": "Outbound NAT", "host": "Host maintenance", "user": "Users", "auth": "Account security", "backup": "Backup export", "ipsec_tunnel": "IPsec tunnels", "openvpn_instance": "OpenVPN", "wireguard_tunnel": "WireGuard", "certificate": "Certificates", "acme": "ACME", "notification": "Notifications", "system": "OPNexus system", "gui_access": "GUI access" }, "action": { "deploy": "Push", "disable": "Switched off", "enable": "Switched on", "revert": "Reverted", "restore": "Restored", "cleanup_settings": "Settings changed", "confirm": "Confirmation", "rollback": "Rollback", "remove": "Remove target", "retry-rollback": "Retry rollback", "delete": "Delete", "create": "Create", "edit": "Edit", "reboot": "Reboot", "update": "Update", "acknowledge": "Completion confirmed", "backups": "Backup", "cancel": "Cancelled", "carp-execute": "CARP role switch", "carp_enter": "CARP handover", "carp_leave": "CARP normal operation", "check-updates": "Update check", "execute": "Executed", "handoff": "Handover", "preview": "Preview", "schedule": "Scheduled", "major_update": "Major upgrade", "changes": "Changes", "download": "Download", "push": "Push", "register": "Register", "sign": "Sign", "poll": "Poll status", "test": "Test", "change-password": "Change password", "2fa/setup": "2FA setup", "2fa/enable": "2FA enable", "2fa/disable": "2FA disable", "reset-password": "Password reset", "reset-2fa": "2FA reset", "ticket": "Ticket issued", "redeem": "Session started", "end": "Session ended" }, "status": { "requested": "Requested", "accepted": "Request processed", "rejected": "Rejected", "interrupted": "Interrupted · check", "success": "Confirmed", "pending": "Confirmation pending", "error": "Error", "reverted": "Rolled back", "revert_failed": "Rollback failed", "removed": "Removed", "submitted": "Submitted to firewall", "acknowledged": "Completed manually", "starting": "Handover started", "unknown": "Outcome unclear", "denied": "Denied" }, "exportFailed": "Export failed", "title": "Deploy audit history", "refresh": "Refresh", "exporting": "Exporting…", "exportJson": "Export JSON", "intro": "Requests and deployment results are stored permanently from activation onwards, even after a rule or host is deleted. “Request processed” describes the HTTP request; the separate host entry shows the deploy result. Earlier actions are not reconstructed retroactively.", "searchLabel": "Search audit", "searchPlaceholder": "User, host, description…", "typeLabel": "Audit type", "allTypes": "All types", "resultLabel": "Audit result", "allResults": "All results", "events": "{total} events · {from}–{to}", "noEvents": "No events in this selection." }, "hostDetail": { "notFound": "Host not found", "liveRulesFailed": "Could not load live rules", "liveAliasesFailed": "Could not load live aliases", "backupsFailed": "Could not load backups", "backupFailed": "Backup failed", "downloadFailed": "Download failed", "backToHosts": "Back to hosts", "managedRules": "Rules managed by OPNexus", "noManagedRules": "No centrally managed rules for this host.", "colRule": "Rule", "colStatusOnHost": "Status on this host", "notDeployed": "not deployed", "liveRulesTitle": "Actually configured rules (live from the firewall)", "fetchingRules": "Fetching rules from the firewall…", "colOrigin": "Origin", "automatic": "automatic", "custom": "user-defined", "managedAliases": "Aliases managed by OPNexus", "noManagedAliases": "No centrally managed aliases for this host.", "liveAliasesTitle": "Actually configured aliases (live from the firewall)", "fetchingAliases": "Fetching aliases from the firewall…", "backups": "Backups", "backupNow": "Back up now", "noBackups": "No backup available yet.", "colTime": "Time", "colSize": "Size", "changes": "Changes", "download": "Download", "restore": "Restore", "restoreHistory": "Restore history", "colBackup": "Backup", "restoreVerified": "Confirmed", "restoreHandedOff": "Handed over — open", "restoreCancelled": "Cancelled" }, "updates": { "notChecked": "Not checked yet", "fw": { "running": "Job running", "update": "Update available", "upgrade": "Major upgrade", "error": "Check failed", "none": "Check required", "current": "Up to date" }, "blocker": { "haOrder": { "title": "HA order", "master": "This node is currently MASTER. Update the BACKUP node first. Then switch the CARP roles in OPNsense and return to this node.", "backup": "In an HA cluster, updates are only started on the current BACKUP node." }, "partner": { "title": "HA partner not ready", "text": "The other cluster node must be online and CARP MASTER before this node can be updated." }, "backup": { "title": "Fresh backup required", "text": "Before installing, OPNexus needs a local configuration backup that is at most 24 hours old." }, "noUpdate": { "title": "No installable update", "text": "The last check reports no stable package update. Run a new check if needed." }, "noMajor": { "title": "No installable major upgrade", "text": "The last check reports no available major upgrade. Run a new check if needed." }, "pending": { "title": "Maintenance still open", "text": "An earlier maintenance must be completed first: check its result and finish it on the host page." }, "change": { "title": "Change still open", "text": "A deployment or rollback in the cluster is still running. Wait until it has finished." }, "locked": "Update blocked" }, "pkg": { "upgrade": "Upgrade", "new": "Install new", "reinstall": "Reinstall", "downgrade": "Downgrade", "obsolete": "Remove" }, "statusFailed": "Could not load status", "hostsFailed": "Could not load hosts", "checkStarted": "Update check on {host} was started.", "checkFailed": "Update check failed", "autoRunning": "Automatic update check running on {count} hosts…", "checkedSummary": "{prefix}{done} of {total} eligible hosts were checked.", "autoDone": "Automatic check finished: ", "backupSaved": "Fresh configuration backup for {host} was saved.", "backupFailed": "Could not create backup", "previewFailed": "Update preview failed", "handedOver": "{label} was handed over to {host}.", "labelMajor": "Major upgrade", "labelUpdate": "Update", "outcomeUnclear": "Outcome unclear. Check the maintenance status.", "finishDocumented": "Maintenance completion for {host} was documented.", "finishFailed": "Could not save completion", "cancelledNote": "Operation on {host} was closed without confirmed completion.", "cancelFailed": "Cancelling failed", "logFailed": "Could not load update log", "title": "Update Center", "intro": "When opened, all eligible hosts are automatically checked for updates. Major upgrades and HA role switches remain deliberate manual steps.", "checkAgain": "Check for updates again", "refreshView": "Refresh view", "readOnlyNote": "With your role (read-only) you can view status, package changes and logs, but you cannot start checks or updates.", "sumHosts": "Managed hosts", "sumStable": "Stable updates", "sumMajor": "Major upgrades", "sumUnavailable": "Not evaluable", "fleetLoading": "Loading fleet status…", "disabled": "Disabled", "clusterSuffix": " · cluster {name}", "check": "Check", "prepareUpdate": "Prepare update", "prepareMajor": "Prepare major upgrade", "reviewFinish": "Review completion", "cancelOperation": "Cancel operation", "view": "View", "readingStatus": "Reading status…", "installed": "Installed", "available": "Available", "packageUpdates": "Package updates", "lastCheck": "Last check", "localBackup": "Local backup", "backupFresh": " · fresh", "backupOld": " · older than 24 h", "backupMissing": "Missing", "backupNow": "Create backup now", "rebootRequired": "Reboot required", "carpMode": "CARP maintenance mode", "whyUpdateBlocked": "Why “Prepare update” is still blocked", "whyMajorBlocked": "Why “Prepare major upgrade” is still blocked", "packageChanges": "{count} package changes", "majorTargets": " · {count} major upgrade target(s)", "updateLog": "Update log", "majorTargetsTitle": "Available major upgrade targets", "colTarget": "Target", "colInstalled": "Installed", "colNew": "New", "colRepository": "Repository", "stablePackageChanges": "Stable package changes", "noPackageChanges": "No stable package changes in the cached check result.", "colPackage": "Package", "colAction": "Action", "previewTitleMajor": "Major upgrade on {host}", "previewTitleUpdate": "Firmware update on {host}", "majorWarnTitle": "Major upgrade: switch to a new major version", "majorWarnText": "Takes longer and is riskier than a plain package update, possibly with larger behaviour changes to services and configuration. Have a fresh backup and console access ready before proceeding.", "plannedDowntime": "Planned interruption", "plannedDowntimeText": "The host may be unreachable during installation. Connections may drop; there is no automatic rollback.", "carpRole": "CARP role", "standalone": "Standalone", "previewValidUntil": "Preview valid until", "runMajorNow": "Run major upgrade now", "runUpdateNow": "Run update now", "finishTitleCarp": "Complete CARP role switch on {host}", "finishTitle": "Complete maintenance on {host}", "finishCheckCarp": "Check the CARP roles and reachability of both cluster nodes. ", "finishCheck": "Check reachability, installed version and services. ", "finishNote": "This confirmation documents the check and does not trigger any further firewall action.", "cancelTitle": "Cancel operation on {host}", "cancelWarnPre": "This does ", "cancelWarnStrong": "not confirm", "cancelWarnPost": " a successful completion — it only closes the record so this host/cluster is no longer locked. Only use it if the expected state demonstrably never occurred (e.g. a CARP role switch is stuck).", "logTitle": "Update log · {host}", "logEmpty": "No log available. OPNsense clears it on reboot – after a successful update that is normal. The firewall's status shown on this page is what counts.", "readOnlyBadge": "Read-only", "lockedPrefix": "Locked", "tipCheckAll": "Asks all eligible firewalls for new updates. Nothing is installed.", "tipRefreshView": "Reloads the last known status of all hosts without contacting the firewalls.", "tipCheck": "Asks this firewall for available updates. Nothing is installed.", "tipPrepare": "Shows a preview first. Nothing is installed until you explicitly confirm.", "tipPrepareMajor": "Switch to a new major version: takes longer and is riskier. A preview comes first.", "tipView": "Reload this host's status", "tipFinish": "Check the result on the firewall and document the completion.", "tipCancel": "Closes a stuck operation without confirming success. Only if the expected state never occurred.", "tipPackages": "Packages that will change with the next update", "tipLog": "Shows the log of the last update action on the firewall", "tipBackup": "A local configuration backup no older than 24 hours is required before any update.", "tipInstalled": "Version currently installed on the firewall", "tipAvailable": "Newest version that can be installed according to the last check", "tipRebootRequired": "The firewall must be rebooted after the update and will be briefly unreachable.", "tipCarpWarn": "CARP maintenance mode", "majorWarnShort": "Switch to a new major version", "majorWarnTip": "Takes longer and is riskier than a package update, possibly with behavior changes to services and configuration. Have a fresh backup and console access ready.", "downtimeShort": "The host may be unreachable during installation", "downtimeTip": "Connections can drop. There is no automatic rollback.", "tipConfirmName": "Typing the host name prevents updating the wrong host by accident.", "confirmRunDisabledName": "Enter the host name exactly to continue.", "confirmRunDisabledAck": "Confirm the maintenance window first (tick the box in the dialog).", "cancelWarnShort": "Does not confirm a successful completion", "cancelWarnTip": "The operation is only closed so the host or cluster does not stay locked. Use only if the expected state demonstrably never occurred (e.g. a stuck CARP role switch).", "finishNoteTip": "This confirmation documents your check and triggers no firewall action.", "reasonMinHint": "At least 3 characters", "validUntilShort": "Preview valid until {time}" }, "sparkline": { "noData": "No data" }, "tls": { "title": "Firewall TLS certificate", "intro": "The connection to the firewall is only accepted as secure if it presents exactly this certificate. This works for IP addresses and names alike and protects against eavesdropping and redirection.", "pinned": "Pinned", "notPinned": "Not pinned", "insecure": "Not verified (insecure)", "fetch": "Fetch certificate", "refetch": "Fetch certificate again", "needsHttps": "Requires an https address.", "subject": "Name", "issuer": "Issuer", "selfSigned": "self-signed", "validUntil": "Valid until", "expired": "expired", "confirmMatch": "The fingerprint matches the firewall's certificate.", "confirmHelp": "Compare it in OPNsense under System → Trust → Certificates (web GUI certificate) or in the browser's certificate dialog for the firewall. Only confirm if it matches exactly.", "skipVerify": "Do not verify the certificate (insecure)", "skipVerifyHelp": "The connection stays encrypted, but OPNexus cannot tell whether the firewall is really answering. For testing only.", "probeFailed": "The certificate could not be retrieved", "pinnedTip": "Certificate pinned · SHA-256 {fp}…", "systemTip": "The certificate is checked against the standard certificate authorities. For a self-signed certificate, pin it under Edit.", "insecureTip": "The certificate is not verified. Pin it under Edit to secure the connection." }, "twofa": { "title": "Two-factor sign-in", "intro": "In addition to the password, sign-in asks for a 6-digit code from an authenticator app (e.g. Aegis, Google Authenticator, 1Password). Protects the account even if the password becomes known.", "on": "On", "off": "Off", "enable": "Set up two-factor", "disable": "Disable", "codesLeft": "{count} recovery codes left", "confirmPassword": "Current password", "confirmPasswordHelp": "The password is asked again so that a stolen session alone cannot register someone else's authenticator.", "continue": "Continue", "scan": "Scan the QR code with your authenticator app, then enter the code it shows.", "qrAlt": "QR code for the authenticator app", "manualKey": "Or enter the key manually:", "enterCode": "6-digit code", "activate": "Activate", "codesTitle": "Recovery codes – save them now", "codesHelp": "Each code works exactly once if you lose your device. They are only shown now.", "copy": "Copy", "download": "Save as file", "savedAck": "I have saved the codes in a safe place.", "done": "Done", "enterCodeOrRecovery": "Code from the app or recovery code", "userOnTip": "Two-factor sign-in enabled", "reset": "Reset 2FA", "resetTip": "Removes this user's two-factor sign-in, e.g. when the device was lost.", "resetConfirm": "Reset two-factor sign-in for {name}?", "resetDone": "Two-factor reset for {name}." }, "network": { "host": "Firewall", "loadFailed": "Could not load network data.", "empty": "No entries.", "unassigned": "unassigned", "management": "Management", "default": "Default", "active": "Active", "managementNote": "OPNexus reaches this firewall through {device}. Changes to this interface can cut the connection and will get extra safeguards later.", "managementUnknown": "Which interface OPNexus uses to reach this firewall cannot be determined (e.g. via NAT or a CARP address).", "unavailable": "Not available from this firewall: {sections}.", "cannotConfigure": "This firewall is too old to change interface IPs through its API (possible from OPNsense 26.7.6). Change the IP directly in OPNsense or update the firewall.", "sections": { "assignments": "interface assignments", "vlans": "VLANs", "vips": "virtual IPs", "gateways": "gateways", "routes": "routes", "dns_hosts": "DNS entries", "dhcp_hosts": "DHCP hosts", "kea_subnets": "DHCP subnets", "kea_reservations": "DHCP reservations" }, "col": { "device": "Device", "name": "Name", "status": "Status", "addresses": "Addresses", "type": "Type", "vlan": "VLAN", "parent": "Parent device", "tag": "Tag", "pcp": "Priority (PCP)", "address": "Address", "interface": "Interface", "mode": "Mode", "advskew": "Advskew", "priority": "Priority", "network": "Network", "gateway": "Gateway" }, "kinds": { "vlan": "VLAN", "vip": "Virtual IP", "gateway": "Gateway", "route": "Route", "interface": "Interface", "dns_host": "DNS entry", "dhcp_host": "DHCP host (dnsmasq)", "kea_subnet": "DHCP subnet (Kea)", "kea_reservation": "DHCP reservation (Kea)", "tunable": "Tunable", "cron_job": "Cron job", "syslog_destination": "Syslog target", "gateway_group": "Gateway groups", "lagg": "LAGG", "bridge": "Bridge", "loopback": "Loopback", "gre": "GRE tunnel", "dns_forward": "DNS forwards", "dhcp_range": "DHCP ranges (dnsmasq)", "gif": "GIF tunnel", "vxlan": "VXLAN" }, "field": { "if": "Parent interface", "tag": "VLAN tag", "pcp": "Priority (PCP)", "descr": "Description", "interface": "Interface", "mode": "Mode", "network": "Address / prefix (e.g. 192.168.1.50/24)", "vhid": "VHID", "advbase": "Advbase", "advskew": "Advskew", "password": "CARP password", "name": "Name", "ipprotocol": "IP version", "gateway": "Gateway", "defaultgw": "Default gateway", "defaultgwHint": "Use as default gateway", "monitor_disable": "Monitoring", "monitor_disableHint": "Disable gateway monitoring", "priority": "Priority", "disabled": "Disabled", "disabledHint": "Disable gateway", "enabled": "Enabled", "enabledHint": "Route enabled", "fargw": "Far gateway", "force_down": "Mark as down", "monitor": "Monitor IP", "weight": "Weight", "nosync": "Do not sync", "peer": "Peer", "peer6": "Peer (IPv6)", "proto": "Protocol", "enable": "Enabled", "enableHint": "Enable interface", "type4": "IPv4 type", "ipaddr": "IPv4 address / prefix", "type6": "IPv6 type", "ipaddrv6": "IPv6 address / prefix", "gatewayv6": "IPv6 gateway", "mtu": "MTU", "blockpriv": "Block private networks", "blockprivHint": "Block private networks", "blockbogons": "Block bogon networks", "blockbogonsHint": "Block bogon networks", "lock": "Lock", "lockHint": "Prevent removal (lock interface)", "hostname": "Hostname", "domain": "Domain", "rr": "Record type", "server": "Target address", "mx": "Mail server (MX)", "mxprio": "MX priority", "addptr": "PTR record", "addptrHint": "Create the matching PTR record", "description": "Description", "host": "Host", "ip": "IP address(es)", "hwaddr": "MAC address(es)", "client_id": "Client ID", "lease_time": "Lease time (seconds)", "local": "Local", "localHint": "Resolve locally only", "ignore": "Ignore", "ignoreHint": "Ignore requests from this device", "subnet": "Subnet", "pools": "Address pool (e.g. 192.168.1.100-192.168.1.200)", "valid_lifetime": "Lease validity (seconds)", "next_server": "Next server (TFTP)", "ip_address": "IP address", "hw_address": "MAC address", "option_data": { "routers": "Gateway (router)", "domain_name_servers": "DNS servers", "domain_name": "Domain name", "ntp_servers": "NTP servers" }, "tunable": "Tunable", "value": "Value", "default_value": "Default value", "minutes": "Minute", "hours": "Hour", "days": "Day", "months": "Month", "weekdays": "Weekday", "who": "User", "command": "Command", "parameters": "Parameters", "transport": "Transport", "program": "Programs", "level": "Level", "facility": "Facility", "rfc5424": "RFC 5424", "rfc5424Hint": "Use RFC 5424 format", "item": "Gateways (tier 1)", "item2": "Gateways (tier 2)", "item3": "Gateways (tier 3)", "item4": "Gateways (tier 4)", "item5": "Gateways (tier 5)", "trigger": "Trigger", "poolopts": "Pool options", "members": "Members", "primary_member": "Primary member", "lacp_fast_timeout": "LACP fast timeout", "lagghash": "Hash algorithm", "laggif": "Device", "bridgeif": "Device", "linklocal": "Link-local", "linklocalHint": "Assign a link-local address automatically", "enablestp": "STP", "enablestpHint": "Enable spanning tree", "deviceId": "Device no.", "local-addr": "Local address", "remote-addr": "Remote address", "tunnel-local-addr": "Tunnel address (local)", "tunnel-remote-addr": "Tunnel address (remote)", "tunnel-remote-net": "Tunnel prefix", "greif": "Device", "type": "Type", "verify": "Verify certificate", "forward_tcp_upstream": "TCP to upstream", "forward_tcp_upstreamHint": "Forward queries over TCP", "forward_first": "Forward first", "forward_firstHint": "Forward first, then resolve locally", "start_addr": "From", "end_addr": "To", "subnet_mask": "Subnet mask", "domain_type": "Domain type", "vxlanid": "VNI", "vxlanlocal": "Local address", "vxlanlocalport": "Local port", "vxlanremote": "Remote address", "vxlanremoteport": "Remote port", "vxlangroup": "Multicast group", "vxlandev": "Device", "gifif": "Device" }, "risks": { "management_interface": "This change affects {device}, the interface OPNexus uses to reach the firewall. The connection may drop.", "management_address": "The address {address} is the one OPNexus uses to reach the firewall.", "management_unknown": "Which interface OPNexus uses to reach this firewall cannot be determined (NAT or a CARP address). The impact cannot be judged.", "default_gateway": "{name} is the default gateway. Without it, traffic to the internet may fail.", "default_gateway_change": "The default gateway is being set or switched. All outbound traffic will take a different path afterwards.", "management_gateway": "{name} sits on the interface OPNexus uses to reach the firewall.", "default_route": "A default route ({network}) changes the path for almost all traffic.", "route_covers_management": "The route {network} covers the firewall's own address. Replies to OPNexus may take a different path.", "interface_rules_removed": "Removing it makes OPNsense itself delete {count} rule(s) that use this interface: {names}", "management_member": "{device} is the interface OPNexus uses to reach the firewall, and it is a member of this device. The connection may drop.", "tunable_change": "Tunables change how the whole system behaves; some only apply after a reboot and some can make the firewall unusable." }, "warnings": { "carp_change": "CARP changes can trigger a switch between master and backup.", "cluster_peers": "This firewall is part of a cluster. The same change may be needed on {hosts} as well. VIPs and gateways are not synchronised automatically.", "core_interface": "{name} is a core interface of the firewall. Changes affect every rule and service on it.", "gateway_group_in_use": "Rules that use this gateway group lose their target." }, "blocks": { "api_unavailable": "This firewall does not offer an API for this ({section}).", "nothing_to_change": "There is nothing to change.", "interface_api_unavailable": "This firewall is too old to configure interfaces through its API (possible from OPNsense 26.7.6). Please change it directly in OPNsense or update the firewall.", "interface_changes_pending": "Interface changes are already staged on the firewall and waiting to be applied. Check and apply or discard them there first.", "interface_locked": "The interface is locked. Remove the lock first, then delete.", "tunable_default_row": "This is a built-in default of the firewall. To change it, create your own entry with “Override”." }, "change": { "title": { "add": "Add {kind}", "set": "Edit {kind}", "del": "Delete {kind}" }, "loadFailed": "The form could not be loaded.", "previewFailed": "The preview could not be created.", "applyFailed": "The change could not be applied.", "keepUnchanged": "leave unchanged…", "toPreview": "Continue to preview", "back": "Back", "apply": "Apply now", "riskTitle": "Careful, this change can cut the connection", "noChanges": "No changes.", "backupNote": "A backup of the firewall configuration is saved before applying. There is no automatic rollback: if the connection drops, OPNexus cannot undo the change itself.", "ack": "I understand that this change can cut the connection to {host} and is not rolled back automatically.", "typeHost": "To confirm, type the firewall's name: {host}", "applied": "Change applied.", "verified": "Applied and checked", "notVerified": "Applied, check differs", "carpInactive": "The change is saved, but the CARP VIP is not active on the firewall (state is not MASTER/BACKUP). Check Hosts › Status right away and re-apply the VIPs.", "mismatch": "The firewall reports different values: {fields}", "backupId": "Backup before the change: {id}", "col": { "field": "Field", "before": "Before", "after": "After" }, "invalidValue": "Invalid value.", "unreachable": "The change was applied, but “{host}” no longer answers on its previous address. If the management address was changed, enter the new one under Hosts › Edit. The backup taken before the change is kept.", "transferHint": "Apply the same change to the partner in the cluster as well? Backup node first, then the master.", "transfer": "Transfer to {host}" }, "rowAdd": "Add", "rowEdit": "Edit", "rowDelete": "Delete", "hint": { "interfaceDescr": "Letters, digits and underscores only (no spaces or hyphens)." }, "dhcp": { "dnsmasq": "Hosts (dnsmasq: static DHCP and DNS)", "keaSubnets": "Subnets (Kea)", "keaReservations": "Reservations (Kea)" }, "objectsUnavailable": "This OPNsense version offers no API for this.", "override": "Override", "compare": { "loadFailed": "Could not load the comparison.", "noClusters": "No cluster with at least two hosts.", "intro": "Compares the network configuration of a cluster's nodes. Addresses, CARP advskew and the active default gateway may differ and are not compared.", "unreachable": "Unreachable: {hosts}", "same": "Identical", "count": "{count} difference(s)", "category": "Area", "object": "Object", "state": "State", "missing": "Missing", "different": "Differs", "absent": "missing", "categories": { "interfaces": "Interface", "vlans": "VLAN", "vips": "Virtual IP", "gateways": "Gateway", "routes": "Route", "dns_hosts": "DNS entry", "dhcp_hosts": "DHCP host", "kea_subnets": "DHCP subnet", "kea_reservations": "DHCP reservation" } } }, "hostsystem": { "intro": { "tunables": "System parameters of the firewall (sysctl). The firewall's own values stay untouched; your own entries override them.", "cron": "Scheduled tasks the firewall runs itself.", "syslog": "Remote log targets the firewall sends its messages to.", "snapshots": "ZFS snapshots of the firewall as an extra safety net before bigger changes. Activating one (with a reboot) is deliberately left to OPNsense itself.", "diagnostics": "Network queries the selected firewall runs itself (reachability, paths, ports, name resolution). Results are only shown; every run is recorded with its target in the audit log." }, "snapshots": { "create": "Create snapshot", "createHint": "The snapshot captures the current system state. It does not replace a configuration backup.", "name": "Name", "nameHint": "Letters, digits, dot, underscore and hyphen.", "note": "Note", "state": "State", "size": "Size", "createdAt": "Created", "activeNow": "active", "activeNext": "active after reboot", "unsupported": "This firewall does not support snapshots (no ZFS).", "created": "Snapshot “{name}” created.", "createFailed": "Could not create the snapshot.", "deleted": "Snapshot “{name}” deleted.", "deleteFailed": "Could not delete the snapshot.", "deleteConfirm": "Really delete snapshot “{name}”?" }, "diag": { "tools": { "ping": "Ping", "traceroute": "Traceroute", "portprobe": "Port check", "dns": "DNS lookup" }, "target": "Target (host or IP)", "name": "Name", "ipproto": "IP version", "source": "Source address (optional)", "sourceHint": "The firewall's own address to query from. Empty = automatic.", "count": "Count (1–10)", "packetsize": "Packet size (optional)", "protocol": "Protocol", "port": "Port", "server": "DNS server (optional)", "serverHint": "Empty = the firewall's resolvers.", "run": "Run", "running": "Running…", "auditNote": "Recorded in the audit log.", "failed": "The query failed.", "reachable": "Reachable", "unreachable": "Unreachable", "pingSummary": "{sent} sent, {received} received, {loss} loss", "hop": "Hop", "hostname": "Name", "time": "Time", "open": "Port {port} open", "closed": "Port {port} not reachable", "noRecords": "No answer for “{name}”.", "noHops": "No hop on the way answered (or the target is unreachable). That is not a firewall error: many routers do not answer traceroute.", "silentHop": "* no answer" } }, "setup": { "title": "Setup assistant", "skip": "Skip assistant", "stepsLabel": "Setup steps", "stepOf": "Step {current} of {total}", "back": "Back", "next": "Next", "finish": "Finish setup", "readOnly": "The assistant sets up the account and firewalls, so it is reserved for administrators.", "toDashboard": "Go to dashboard", "steps": { "welcome": "Welcome", "account": "Account", "firewall": "Firewall", "done": "Done" }, "welcome": { "title": "Welcome to OPNexus", "intro": "OPNexus manages your OPNsense firewalls in one place: rules, NAT, VPN, certificates, updates and HA clusters. This assistant sets up the essentials in a few minutes. You can skip it at any time and reopen it later under System › Setup.", "points": { "account": "Secure the account: your own password and two-factor sign-in.", "firewall": "Connect your first firewall: create an API key, check the certificate, done.", "done": "An overview of what makes sense next." }, "readOnlyNote": "The assistant only reads from your firewall. Nothing there changes until you roll something out yourself later." }, "account": { "title": "Secure the account", "passwordTitle": "Your own password", "passwordDone": "Changed", "passwordIntro": "If you did not set ADMIN_PASSWORD at startup, OPNexus generated a random password. Set your own now. This step is optional.", "currentHint": "The password you just signed in with. Lost it? On the server: ./opnexus password", "newHint": "At least 10 characters. A password manager is the most convenient way.", "twofaTitle": "Two-factor sign-in (recommended)", "twofaIntro": "OPNexus can change firewalls. A second factor from an authenticator app protects the account even if the password becomes known." }, "firewall": { "title": "Connect your first firewall", "intro": "OPNexus talks to your OPNsense through its REST API, which needs an API key. Creating one takes a minute.", "connected": "Connected firewalls", "recheck": "Check again", "offlineHelp": "Check the address and API key, and that the firewall allows web interface access from this server.", "keyTitle": "How to create the API key in OPNsense", "keySteps": { "menu": "In OPNsense open System › Access › Users.", "user": "Create a dedicated user (e.g. “opnexus”) or edit an existing one.", "key": "Under “API keys” on that user click the plus. Your browser downloads a file called apikey.txt.", "rights": "Give the user sufficient privileges, most simply the “admin” group. With fewer privileges individual features fail." }, "keyFileNote": "In apikey.txt the key follows key= and the secret follows secret=. The secret exists only in this file.", "addFirst": "Add a firewall", "addAnother": "Add another firewall", "nameHint": "Free choice, display only. For an HA pair e.g. fw-a and fw-b.", "urlHint": "Address of the OPNsense web interface, with https:// and the port if needed, e.g. https://192.168.1.1:8443.", "clusterHint": "Is the firewall an HA pair? Add both nodes as separate firewalls and give both the same cluster name.", "connect": "Connect", "connectNote": "OPNexus checks right away whether the firewall answers." }, "done": { "title": "Done", "hostsOnline": "{online} of {total} firewalls reachable", "noHosts": "No firewall connected yet", "twofaOn": "Two-factor on", "twofaOff": "Two-factor off", "nextTitle": "What you can do next", "next": { "rules": { "title": "Create rules", "text": "New rules are rolled out with a confirmation: if you do not confirm within {seconds} seconds, OPNexus rolls back automatically." }, "notify": { "title": "Notifications", "text": "Get told by webhook or email when a firewall goes down or a certificate expires." }, "update": { "title": "Updates", "text": "Set up the notice about new OPNexus versions and one-click updates." } }, "backupBefore": "You back up the OPNexus database on the server with", "backupHelp": "Covers the database (rules, hosts, history). API secrets and keys live in their own Docker volumes and are not in the dump. See the manual for details.", "docs": "Documentation for the command-line tool" } }, "gateway": { "title": "Gateways", "none": "This firewall reports no gateways.", "loadFailed": "Gateway status could not be loaded", "notMeasured": "not monitored", "loss": "Loss {value} %", "delay": "{value} ms", "stddev": "± {value} ms", "state": { "online": "Online", "degraded": "Degraded", "offline": "Offline", "forced_down": "Switched off", "unknown": "Unknown" }, "alert": { "label": "Alert for gateway {name}", "off": "Alert off", "tooltipOn": "Alert for this gateway: on. Click to switch it off (e.g. an idle second WAN).", "tooltipOff": "Alert for this gateway: off. Click to switch it back on.", "adminOnly": "Only administrators can change the alert for a gateway.", "nowOn": "Alert for {name} switched on", "nowOff": "Alert for {name} switched off", "failed": "Could not change the alert" }, "rights": { "badge": "API rights missing: {reads}", "hint": "OPNexus's API user may not read these values, so the alerts based on them cannot fire. In OPNsense, add to the user or group under System > Access:", "read": { "base": "Basic readings (memory, load, disk)", "gateways": "Gateways", "services": "Services", "swap": "Swap", "cpu": "CPU" }, "acl": { "base": "Lobby: Dashboard", "gateways": "System: Gateways", "services": "Status: Services", "swap": "Lobby: Dashboard", "cpu": "Lobby: Dashboard" } } }, "rollouts": { "title": "Rollouts", "intro": "Firmware updates in waves: a small group first (canary), then pilot, then the rest. Between waves OPNexus waits a soak time and checks the health of the updated firewalls. On anything unusual the rollout stops and notifies you. Each host goes through the normal scheduled maintenance (backup, CARP handover, audit).", "tab": { "runs": "Runs", "plans": "Plans", "windows": "Maintenance windows" }, "loadFailed": "Could not load rollouts", "actionFailed": "Action failed", "noRuns": "No rollouts yet", "noRunsHint": "Create waves from device groups under “Plans” and start a plan.", "col": { "plan": "Plan", "status": "Status", "wave": "Wave", "target": "Target version", "started": "Started", "hosts": "Hosts", "host": "Host", "version": "Version", "step": "Step", "note": "Note" }, "details": "Details", "waveOf": "{current}/{total}", "by": "by {user}", "trigger": { "manual": "manual", "window": "automatic in window" }, "action": { "update": "Stable update", "major_update": "Major upgrade" }, "run": { "status": { "waiting_window": "waiting for window", "preflight": "preflight", "wave_running": "wave running", "soaking": "soaking", "gate": "health gate", "awaiting_approval": "awaiting approval", "resuming": "checking before resuming", "paused": "paused", "succeeded": "completed", "cancelled": "aborted" } }, "wave": { "status": { "pending": "pending", "awaiting_approval": "awaiting approval", "preflight": "preflight", "running": "running", "soaking": "soaking", "gate": "gate", "passed": "passed", "skipped": "nothing to do", "cancelled": "aborted" } }, "host": { "status": { "queued": "queued", "running": "running", "verifying": "verifying", "succeeded": "done", "skipped": "skipped", "failed": "failed", "blocked": "blocked", "cancelled": "aborted" } }, "hostNote": { "verified": "verified: version {version}", "host_failed": "Error: {error}", "schedule_missing": "Scheduled maintenance missing", "host_deleted": "Host deleted", "host_disabled": "Host disabled", "no_update_offered": "no matching update offered (status: {status})", "locked": "other maintenance open", "firmware_busy": "firmware job running", "offline": "unreachable", "firmware_status": "firmware status unclear ({status})", "not_fired": "not started, queued again (nothing happened on the firewall)", "skipped_by": "skipped by {user}: {reason}" }, "pauseReason": { "manual": "paused by hand", "gate_failed": "health gate failed", "cluster_gate_failed": "cluster not healthy – next node waits", "host_failed": "a host update failed", "host_timeout": "host is taking unusually long", "host_not_started": "scheduled maintenance did not start", "preflight_blocked": "preflight: hosts not ready", "target_version_changed": "offered version differs from the target version", "master_needs_handover": "CARP MASTER needs the handover (off in this wave)", "blocked_by_maintenance": "other maintenance open in the cluster", "actor_invalid": "the responsible person may no longer roll out", "window_missing": "maintenance window deleted", "run_too_old": "run older than 14 days", "internal_error": "internal error – paused", "aborted": "aborted" }, "pauseHint": "Check and fix the cause, then “Resume”: OPNexus first re-checks every host updated so far. A failed host must be skipped explicitly first.", "gate": { "title": "Health gate", "hint": "Compared with the state before the wave. Red stops the rollout (after one re-check 2 minutes later), yellow is only a hint.", "verdict": { "ok": "passed", "warn": "passed with hints", "fail": "failed" }, "resume": "Check before resuming", "cluster": "Cluster check before the next node", "result": { "ok": "ok", "warn": "hint", "fail": "fail", "skip": "–" }, "check": { "online": "Online", "version": "Version", "carp": "CARP", "gateways": "Gateways", "services": "Services", "locks": "Locks", "compliance": "Compliance", "probes": "Reachability probes" }, "code": { "ok": "fine", "disabled": "host disabled", "offline": "unreachable", "firmware_busy": "firmware job still running", "no_target": "no target version known", "unreadable": "unreadable", "unreadable_both": "unreadable (API permission missing?) – not compared", "version_mismatch": "expected {expected}, installed {actual}", "no_cluster": "no cluster", "node_offline": "node unreachable: {names}", "maintenance_mode": "in CARP maintenance mode: {names}", "auto_revert_active": "CARP timer active: {names}", "vhid_roles": "VHID without exactly one MASTER: {vhids}", "no_master": "no MASTER found", "no_baseline": "no earlier value to compare", "gateway_down": "gateway down: {names}", "gateway_missing": "gateway missing: {names}", "gateway_degraded": "gateway with loss/latency: {names}", "gateway_bad_before": "already bad before: {names}", "service_stopped": "no longer running: {names}", "open_locks": "{count} open lock(s) in host/cluster", "score_lower": "score {before} → {after}", "probe_regressed": "no longer reachable: {probes}", "probe_was_failing": "already failing before: {probes}" } }, "actions": { "pause": "Pause", "resume": "Resume", "approve": "Release wave", "skip": "Skip", "abort": "Abort", "pauseReason": "Reason (optional)", "skipTitle": "Skip {host}", "skipHint": "The host stays as it is and is not touched again in this rollout. A failed maintenance stays open until you close it on the host page.", "reason": "Reason", "abortTitle": "Abort rollout", "abortHint": "Hosts that have not started are no longer updated. An action already running on a firewall is finished in a controlled way (not cut off).", "confirmPlan": "Type the plan name to confirm", "paused": "Rollout paused", "resumed": "Checking and resuming", "approved": "Wave released", "skipped": "Host skipped", "aborted": "Rollout aborted" }, "detail": { "back": "All rollouts", "notFound": "Rollout not found", "soakUntil": "Soaking until {time}", "recheckAt": "Re-check at {time}", "blockedSince": "waiting since {time} for someone else's maintenance (max. 15 min)", "waves": "Waves", "hosts": "Hosts", "handover": "with CARP handover", "approval": "approval needed", "approvedBy": "released by {user}", "soak": "{minutes} min soak", "noGate": "No check yet", "attempt": "attempt {n}", "stillRunning": "still finishing: {hosts}", "waitingWindow": "New hosts only start in the next maintenance window.", "awaiting": "The next wave is waiting for release.", "owner": "responsible" }, "banner": { "active": "Rollout “{plan}” – wave {wave} ({label}): {status}", "open": "View" }, "inRollout": "in rollout", "inRolloutTip": "This host belongs to the running rollout. Manual maintenance is locked here until the rollout has done or skipped it.", "updaterWarning": "A firmware rollout is active. Restarting OPNexus is safe (its state is in the database) but holds the rollout for that time.", "plan": { "new": "New plan", "edit": "Edit plan", "none": "No plans yet", "noneHint": "Create device groups as rings (e.g. ring-canary, ring-pilot, ring-prod) and build waves from them.", "name": "Name", "description": "Description", "action": "Action", "window": "Maintenance window", "noWindow": "none (hosts start right away)", "autoStart": "Start automatically at every window occurrence", "autoStartHint": "Stable updates only. Takes effect after “Activate” and only while plan, groups and window are unchanged; any change deactivates the plan.", "waves": "Waves", "addWave": "Add wave", "waveLabel": "Label", "groups": "Device groups", "soak": "Soak time (min)", "soakHint": "How long to wait after the wave's last host before checking health.", "handover": "CARP handover for MASTER nodes", "approval": "Wait for release before this wave", "moveUp": "Move wave up", "moveDown": "Move wave down", "removeWave": "Remove wave", "checks": "Health gate", "checksHint": "Reachability, version and locks are always checked.", "complianceMode": "Lower security score", "complianceWarn": "hint only", "complianceFail": "stops", "save": "Save", "saved": "Plan saved", "deleted": "Plan deleted", "deleteConfirm": "Delete plan “{name}”? Run history is kept.", "previewStart": "Preview & start", "activate": "Activate", "deactivate": "Deactivate", "active": "automatic: on", "inactive": "automatic: off", "changed": "changed since activation", "changedTip": "The plan, its groups or its window changed since activation. The automatic start is held until the plan is activated again.", "activatedBy": "activated by {user}", "lastAutoStartError": "Last automatic start did not happen ({time}): {reason}", "hostsCount": "{count} hosts", "errors": "{count} errors", "warnings": "{count} hints", "nextOccurrence": "Next occurrence: {time}", "previewTitle": "Preview: {name}", "unattended": "I understand that the firewalls will then be updated and rebooted without further confirmation; the rollout stops by itself on anything unusual.", "start": "Start rollout", "started": "Rollout started", "activated": "Automatic start activated", "deactivated": "Automatic start deactivated", "emptyWave": "no hosts", "disabledHost": "disabled", "cannotStart": "Cannot start like this – see the errors above.", "probes": "Reachability probes", "probesHint": "Ping or TCP probes the firewall itself runs (uplink, DNS, an internal server). A probe that worked before the wave and fails afterwards stops the rollout. This checks reachability from the firewall, not traffic through it.", "probeType": "Probe type", "probeTarget": "Target (IP or name)", "probePort": "Port", "probeRemove": "Remove probe", "addProbe": "Add probe" }, "issue": { "no_waves": "No waves", "no_hosts": "No hosts in the groups", "too_many_waves": "More than {limit} waves", "too_many_hosts": "More than {limit} hosts", "cluster_split": "Cluster {cluster}: for a major upgrade all nodes must be in the same wave.", "cluster_partial": "Cluster {cluster}: not all nodes are in the plan.", "mixed_versions": "Cluster {cluster}: nodes in different waves – mixed versions until wave {wave}.", "master_needs_handover": "Wave {wave} contains clusters ({clusters}) without CARP handover: the rollout stops at the MASTER.", "empty_wave": "Wave {wave} has no hosts.", "duplicate_hosts": "In several waves (the earliest counts): {names}", "disabled_hosts": "Disabled, will be skipped: {names}", "auto_start_update_only": "Automatic start only for stable updates.", "auto_start_needs_window": "Automatic start needs a maintenance window.", "no_window": "No maintenance window: hosts start one after the other right away.", "window_disabled": "The maintenance window is switched off: nothing starts.", "plan_changed": "plan, groups or window changed since activation", "actor_invalid": "{user} may no longer roll out", "plan_invalid": "plan invalid ({reason})", "other_run_active": "another rollout is running ({plan})" }, "detailKey": { "wave": "Wave", "failed": "Failed", "host": "Host", "hosts": "Hosts", "cluster": "Cluster", "expected": "Expected", "offered": "Offered", "user": "User", "by": "By", "text": "Reason", "reason": "Reason", "error": "Error", "days": "Days", "still_running": "Still running" } }, "mwindows": { "none": "No maintenance windows yet", "noneHint": "A window defines when a rollout may start new hosts, e.g. Sundays 02:00–05:00.", "new": "New window", "edit": "Edit window", "name": "Name", "timezone": "Time zone", "recurrence": "Recurrence", "weekly": "weekly", "monthly": "monthly", "weekdays": "Weekdays", "monthMode": "Monthly on", "nthWeekday": "nth weekday", "dayOfMonth": "day of month", "nth": { "1": "first", "2": "second", "3": "third", "4": "fourth", "-1": "last" }, "day": "Day (1–28)", "startTime": "Start (local time)", "duration": "Duration (min)", "cutoff": "New hosts only in the first … min", "cutoffHint": "After that no new host starts; running updates finish. This way an update including reboot fits into the window.", "enabled": "enabled", "dstHint": "Daylight saving: a time that does not exist that day moves forward; a time that exists twice counts the first time.", "saved": "Window saved", "deleted": "Window deleted", "deleteConfirm": "Delete window “{name}”?", "next": "Next occurrences", "openNow": "open now", "off": "switched off", "skipped": "skipped", "moved": "moved", "skip": "Skip", "move": "Move", "moveTo": "New start", "exceptions": "Exceptions", "removeException": "Remove exception", "exceptionSaved": "Exception saved", "usedBy": "Used by: {plans}", "summary": { "weekly": "{days}, {time} ({tz}), {duration} min", "nth": "on the {nth} {day} of the month, {time} ({tz}), {duration} min", "day": "on day {day} of every month, {time} ({tz}), {duration} min" }, "dayName": { "0": "Mon", "1": "Tue", "2": "Wed", "3": "Thu", "4": "Fri", "5": "Sat", "6": "Sun" }, "dayLong": { "0": "Monday", "1": "Tuesday", "2": "Wednesday", "3": "Thursday", "4": "Friday", "5": "Saturday", "6": "Sunday" }, "cutoffSummary": "new hosts only in the first {minutes} min" }, "analysis": { "title": "Rule analysis", "intro": "Answers which firewall rule decides the first packet of a connection (source, destination, protocol, port). Read-only; nothing is changed on any firewall.", "loadFailed": "Could not load hosts.", "queryFailed": "The analysis failed.", "form": { "title": "Connection", "scope": "Which firewalls", "scopeAll": "All enabled hosts", "scopeHosts": "Selected hosts", "scopeGroup": "Device group", "hosts": "Hosts", "group": "Device group", "src": "Source IP", "srcHint": "A single IPv4 or IPv6 address, not a host name or network.", "dst": "Destination IP", "proto": "Protocol", "protoHint": "tcp, udp, icmp, another protocol name or a protocol number (0-255).", "dport": "Destination port", "dportHint": "Without a port, the verdict stays unknown for rules that restrict the port.", "sport": "Source port (optional)", "sportHint": "Empty = any port from the ephemeral range.", "icmptype": "ICMP type (optional)", "icmptypeHint": "Name or number, e.g. echoreq or 8.", "iface": "Ingress interface", "ifaceHint": "The interface the packet arrives on. Automatic guesses from the source IP and is marked as probable.", "ifaceAuto": "automatic", "egress": "Check the egress side", "egressHint": "Also checks the outbound rules on the interface towards the destination. Traffic only counts as allowed if both sides let it through.", "egressIface": "Egress interface", "run": "Analyze", "refresh": "Re-read from the firewall", "refreshHint": "Reads the rules fresh from the firewall instead of using data cached for up to 60 seconds.", "missing": "Source and destination IP are required.", "noHostsSelected": "Select at least one host.", "noGroupSelected": "Select a device group." }, "empty": { "title": "Which rule matches?", "description": "Enter source and destination; the result appears here and the query lives in the address bar so you can share it." }, "noHosts": { "title": "No firewalls", "description": "At least one firewall must be connected for the analysis." }, "result": { "summary": "{src} → {dst}, {proto}", "hostError": "This host could not be evaluated.", "decisive": "Deciding rule", "decisiveIfKnown": "Most likely rule if the open points do not apply", "noRule": "No rule matches", "noRuleHint": "No rule entry matches; the packet filter (pf) then lets the packet through.", "unresolved": "No interface could be determined", "unresolvedHint": "The source IP belongs to no interface network. Choose the ingress interface manually.", "undecided": "Cannot be determined reliably", "undecidedHint": "At least one unclear rule could change the result. This is not a verdict; resolve the open points below.", "openPoints": "Open points", "hints": "Notes", "assumptions": "Assumptions", "legIn": "Ingress {interface}", "legOut": "Egress {interface}", "guessed": "guessed", "rulesLink": "Open live rules", "rulesLinkHint": "Opens the live rules. Look for rule {id} on {host}.", "noLink": "Automatic or legacy rule: not editable in OPNexus", "ruleSource": "Source", "ruleDestination": "Destination", "rulePorts": "Port", "ruleGateway": "Gateway", "ruleSchedule": "Schedule", "quick": "quick", "quickHint": "quick: this rule decides immediately; no further rules are checked.", "pfNumber": "pf rule @{number}", "automatic": "automatic", "legacy": "legacy format", "sortOrder": "Order {order}" }, "verdict": { "pass": "Allowed", "block": "Blocked", "reject": "Rejected", "unknown": "Unknown" }, "confidence": { "label": "Confidence", "sure": "sure", "probable": "probable", "unknown": "unknown", "tip": { "sure": "All rules could be checked unambiguously.", "probable": "The verdict relies on assumptions or an unclear rule that would not change the outcome.", "unknown": "An unclear rule could change the result. There is no reliable verdict.", "unresolved": "Nothing can be checked without an ingress interface." } }, "section": { "system": "System", "floating": "Floating", "group": "Interface group", "interface": "Interface", "nat_auto": "Automatic (NAT)", "invalid": "Automatic (invalid)", "antispoof": "Anti-spoofing", "other": "Other" }, "trace": { "title": "Why?", "hint": "All rules in the order the packet filter (pf) checks them. The last match wins unless a quick rule matches earlier.", "leg": "Trace {direction} on {interface}", "dirIn": "in", "dirOut": "out", "showAll": "Also show non-matching rules ({count})", "noSteps": "No rules checked.", "rule": "Rule", "fields": "Check", "result": { "true": "matches", "false": "does not match", "unknown": "unclear" }, "effect": { "decisive": "decides", "overridden": "overridden", "possible": "possible match", "no_match": "no match", "not_loaded": "not loaded", "disabled": "disabled" }, "field": { "interface": "Interface", "direction": "Direction", "family": "Address family", "protocol": "Protocol", "source": "Source", "destination": "Destination", "source_port": "Source port", "destination_port": "Destination port", "ports": "Ports", "icmp_type": "ICMP type", "tagged": "Tag", "received_on": "Received on", "action": "Action" }, "reasonsTitle": "Reasons" }, "unknownCode": "Unknown code: {code}", "notes": { "IFACE_GUESSED": "Interface guessed", "IFACE_GUESSED_hint": "The ingress interface was derived from the source IP, not given. Choose it manually to be sure.", "EGRESS_GUESSED": "Egress guessed", "EGRESS_GUESSED_hint": "The egress interface was derived from the destination IP.", "IFACE_UNRESOLVED": "Interface unresolved", "IFACE_UNRESOLVED_hint": "No interface could be determined for the source IP.", "EGRESS_UNRESOLVED": "Egress unresolved", "EGRESS_UNRESOLVED_hint": "No egress interface could be determined for the destination IP; the egress side was not checked.", "NAT_NEARBY": "NAT nearby", "NAT_NEARBY_hint": "A port forward matches this connection. Filter rules see the address after translation, so the verdict is only probable.", "NAT_UNAVAILABLE": "NAT unavailable", "NAT_UNAVAILABLE_hint": "The firewall's port forwards could not be read; a translation cannot be ruled out.", "POLICY_ROUTE": "Policy routing", "POLICY_ROUTE_hint": "The deciding rule sends the traffic through a specific gateway.", "STATELESS": "Stateless", "STATELESS_hint": "The rule keeps no state. Reply packets need a rule of their own.", "SCHEDULE_NOW": "Schedule", "SCHEDULE_NOW_hint": "The rule has a schedule and is currently loaded according to the firewall.", "RULES_NOT_LOADED": "Rules not loaded", "RULES_NOT_LOADED_hint": "Enabled rules are not in the loaded ruleset (for example because of a schedule) and were skipped.", "PF_RULESET_UNAVAILABLE": "Ruleset unavailable", "PF_RULESET_UNAVAILABLE_hint": "The loaded pf ruleset could not be read, so order and load state are only estimated.", "ORDER_MISMATCH": "Order mismatch", "ORDER_MISMATCH_hint": "The order in the configuration does not match the loaded ruleset.", "ORDER_GUESSED": "Order guessed", "ORDER_GUESSED_hint": "The order of some rules could not be proven and was estimated.", "TCP_FLAGS": "TCP flags", "TCP_FLAGS_hint": "The rule checks TCP flags; the first packet (SYN) probably matches it, but not certainly.", "RATE_LIMIT": "Rate limit", "RATE_LIMIT_hint": "The rule limits connections; above the limit it may behave differently.", "PF_DEFAULT_PASS": "Default: pass", "PF_DEFAULT_PASS_hint": "No rule matches; the packet filter (pf) then lets the packet through.", "QUICK_UNKNOWN": "quick unclear", "QUICK_UNKNOWN_hint": "For one rule it is unclear whether it decides immediately.", "GROUPS_UNAVAILABLE": "Interface groups unavailable", "GROUPS_UNAVAILABLE_hint": "Interface groups could not be read; rules for groups are unclear.", "ALIASES_UNAVAILABLE": "Aliases unavailable", "ALIASES_UNAVAILABLE_hint": "The alias list could not be read; rules using aliases are unclear.", "ALIAS_REFERENCES_UNAVAILABLE": "Alias lookup unavailable", "ALIAS_REFERENCES_UNAVAILABLE_hint": "The firewall could not tell whether the addresses are in aliases." }, "unknown": { "ALIAS_MISSING": "Alias missing", "ALIAS_MISSING_hint": "A rule refers to an alias that does not exist on the firewall.", "ALIAS_TABLE_UNAVAILABLE": "Alias table missing", "ALIAS_TABLE_UNAVAILABLE_hint": "The alias's pf table could not be queried (for example Geo-IP or URL list).", "ALIAS_CYCLE": "Alias cycle", "ALIAS_CYCLE_hint": "Aliases refer to each other in a loop.", "ALIAS_TOO_DEEP": "Alias too deep", "ALIAS_TOO_DEEP_hint": "The alias nesting is too deep to evaluate.", "ALIAS_EXCLUSION": "Alias with exclusion", "ALIAS_EXCLUSION_hint": "An alias contains exclusions that cannot be evaluated reliably.", "FQDN_UNRESOLVED": "Host name unresolved", "FQDN_UNRESOLVED_hint": "A host name in an alias could not be resolved to addresses.", "TAGGED": "Tagged packets", "TAGGED_hint": "A rule only applies to tagged packets. The tag is set by another rule that did not match here.", "PORT_NOT_GIVEN": "Port not given", "PORT_NOT_GIVEN_hint": "Without a destination port it is unclear whether a rule restricted to ports matches.", "SRC_PORT_NOT_GIVEN": "Source port not given", "SRC_PORT_NOT_GIVEN_hint": "A rule restricts the source port, which was not given.", "PORT_ALIAS_UNRESOLVED": "Port alias unresolved", "PORT_ALIAS_UNRESOLVED_hint": "A port alias could not be resolved.", "PORT_UNPARSEABLE": "Port unparseable", "PORT_UNPARSEABLE_hint": "A port specification in a rule could not be interpreted.", "ICMP_TYPE_NOT_GIVEN": "ICMP type not given", "ICMP_TYPE_NOT_GIVEN_hint": "A rule only applies to certain ICMP types; the type is not given.", "VIP_AS_INTERFACE_ADDRESS": "Virtual IP", "VIP_AS_INTERFACE_ADDRESS_hint": "A virtual IP was used as the interface address. Whether the rule covers it is unclear.", "QUICK_UNKNOWN": "quick unclear", "QUICK_UNKNOWN_hint": "For one rule it is unclear whether it decides immediately.", "RECEIVED_ON": "Received-on unclear", "RECEIVED_ON_hint": "A rule only applies to packets received on a certain interface; that is not known on the egress side.", "ACTION_UNKNOWN": "Action unclear", "ACTION_UNKNOWN_hint": "The action of a rule could not be determined.", "IFACE_UNRESOLVED": "Interface group unclear", "IFACE_UNRESOLVED_hint": "An interface group could not be mapped to its members.", "GROUPS_UNAVAILABLE": "Interface groups unavailable", "GROUPS_UNAVAILABLE_hint": "Interface groups could not be read." }, "assumptions": { "FIRST_PACKET": "First packet", "FIRST_PACKET_hint": "The first packet of a new connection is evaluated. Replies and established connections follow state, not rules.", "SRC_PORT_EPHEMERAL": "Ephemeral source port", "SRC_PORT_EPHEMERAL_hint": "Without a source port, any port from the ephemeral range is assumed." }, "tabs": { "query": "Query", "cleanup": "Cleanup" } }, "guiAccess": { "title": "Firewall interface through OPNexus", "intro": "Opens the web interface of a managed firewall in its own browser tab through OPNexus, even when the firewall is only reachable over the management tunnel. Admins only; you still sign in on the firewall itself. The ticket works once for 30 seconds, every session has time limits and is logged in the audit. Details: manual (German), chapter “Firewall-Oberfläche über OPNexus”.", "defaultOff": "Off by default. It is set up on the server (Compose profile “gui”, OPNEXUS_GUI_SITES, GUI_GATEWAY_TOKEN) – see the manual (German), chapter “Firewall-Oberfläche über OPNexus”.", "on": "On", "off": "Off", "notReady": "Not set up yet. Missing:", "reason": { "cookie_secure": "Secure HTTPS sign-in (setting COOKIE_SECURE=true)", "gateway_token": "Access token for the GUI gateway service (GUI_GATEWAY_TOKEN, at least 32 characters)", "gui_sites": "Ports for the firewall interfaces (OPNEXUS_GUI_SITES) and the Compose profile “gui”" }, "enabled": "Allow opening the firewall interface", "enabledTip": "Turns the feature on for all admins. Turning it off ends open sessions (within about 20 seconds).", "idle": "Inactivity (minutes)", "idleTip": "A session ends after this many minutes without activity (1 to 240). Must not exceed the total duration.", "absolute": "Total duration (minutes)", "absoluteTip": "Every session ends after this time at the latest, even when active (5 to 720).", "slotCount": "Simultaneous slots", "slotCountTip": "How many firewall interfaces can be open at the same time (1 to 4). Each slot has its own port so the open firewalls cannot interfere with each other in the browser.", "orderError": "The inactivity limit must not exceed the total duration.", "activeSlots": "Active slots (ports)", "activeSlotsTip": "The ports set up on the server for the firewall interfaces, as far as the chosen count uses them. Which slot is in use right now is shown in the audit (type “GUI access”).", "noSlots": "none configured", "lastChange": "Last changed by {who} on {when}", "saved": "Firewall interface settings saved" }, "guiOpen": { "button": "Open interface", "tip": "Opens this firewall’s web interface through OPNexus in a new tab.", "opened": "Opening the interface in a new tab (slot {slot}). If nothing happens, allow pop-ups for this site.", "failed": "Could not open the interface", "reason": { "off": "Switched off. Turn it on under Settings › Firewall interface through OPNexus.", "host_disabled": "This firewall is disabled. Enable it under Hosts › Edit (tick “Active”).", "host_https": "This firewall’s address does not start with https://. Change it under Hosts › Edit.", "host_tls": "Certificate verification is switched off for this firewall. Turn it on under Hosts › Edit or pin the certificate.", "unavailable": { "cookie_secure": "Not set up: secure HTTPS sign-in is not active on the server (setting COOKIE_SECURE). A server admin has to change this – instructions: manual (German), chapter “Firewall-Oberfläche über OPNexus”.", "gateway_token": "Not set up: the access token for the GUI gateway service is missing (GUI_GATEWAY_TOKEN, at least 32 characters). A server admin has to add it – instructions: manual (German), chapter “Firewall-Oberfläche über OPNexus”.", "gui_sites": "Not set up: no ports are defined for the firewall interfaces (OPNEXUS_GUI_SITES, Compose profile “gui”). A server admin has to add them – instructions: manual (German), chapter “Firewall-Oberfläche über OPNexus”." }, "more": "More missing items: Settings › Firewall interface through OPNexus." } }, "cleanup": { "loadFailed": "The cleanup list could not be loaded.", "noHosts": "No enabled firewall.", "form": { "title": "Cleanup: firewall and threshold", "host": "Firewall", "threshold": "Threshold", "thresholdHint": "How long a rule may go without a hit (or stay disabled and unchanged) before it shows up as a candidate. OPNexus can only look back as far as it has been watching the rule.", "days": "{n} days", "refreshHint": "Re-reads rules, interfaces and aliases from the firewall instead of using the cache (60 s)." }, "rulesChecked": "{count} rules checked", "watching": "OPNexus has been counting this firewall's hits since {when}. {collecting} rule(s) are still being watched and cannot count as unused yet.", "notWatching": "OPNexus has not collected rule counters from this firewall yet. Unused rules only show up after the observation period.", "notes": { "ORDER_GUESSED": "Order guessed", "ORDER_GUESSED_hint": "This OPNsense version delivers no sort order; the order was derived from group and sequence number. Findings about shadowed and duplicate rules are at most probable.", "ORDER_MISMATCH": "Order differs", "ORDER_MISMATCH_hint": "The loaded pf order does not match the rules' sort order. Read findings about shadowed rules with care.", "PF_RULESET_UNAVAILABLE": "Loaded rules unknown", "PF_RULESET_UNAVAILABLE_hint": "The rule set pf has loaded could not be read, so it is not certain whether a rule is active at all. Nothing is \"sure\".", "GROUPS_UNAVAILABLE": "Interface groups unknown", "GROUPS_UNAVAILABLE_hint": "The interface groups could not be read; rules on groups cannot be compared.", "ALIASES_UNAVAILABLE": "Aliases unknown", "ALIASES_UNAVAILABLE_hint": "The aliases could not be read; rules using aliases cannot be compared.", "NAT_UNAVAILABLE": "NAT unknown", "NAT_UNAVAILABLE_hint": "The port forwards could not be read (irrelevant for cleanup).", "CLUSTER_PEER_USAGE_UNKNOWN": "Cluster usage incomplete", "CLUSTER_PEER_USAGE_UNKNOWN_hint": "For at least one rule a cluster node has no counter data. \"Unused\" is then \"probable\" at best.", "UNUSED_BLOCK_RULE": "block rule", "UNUSED_BLOCK_RULE_hint": "A block rule without hits can still protect (rare attacks). So “unused” counts as probable at most here.", "UNUSED_WINDOW_SHORT": "short window", "UNUSED_WINDOW_SHORT_hint": "Under 30 days of observation, monthly and quarterly jobs are missing. “Unused” counts as probable at most.", "EXTERNAL_CHANGE": "changed externally", "EXTERNAL_CHANGE_hint": "The rule or the rule that shadows it was changed outside OPNexus during the observation period. The finding counts as probable at most.", "ENABLE_MAY_BLOCK_MANAGEMENT": "may block management", "ENABLE_MAY_BLOCK_MANAGEMENT_hint": "A block rule that is not proven to leave the management access alone. Switching it on needs an explicit acknowledgement." }, "empty": { "title": "No candidates", "description": "No rule on this firewall is shadowed, duplicate, unused for {days} days or disabled for that long." }, "tableCaption": "Cleanup candidates of {host}", "col": { "rule": "Rule", "finding": "Finding", "lastHit": "Last hit", "removable": "Removable", "action": "Action" }, "history": "Show the history of rule {rule}", "historyTitle": "History", "allInterfaces": "all interfaces", "disabledRule": "disabled", "category": { "unused": "Unused", "unused_hint": "OPNexus has not observed a single hit of this rule within the threshold (pf counters, read every 15 minutes).", "shadowed": "Shadowed", "shadowed_hint": "An earlier rule with \"quick\" already matches everything this rule matches. This rule never decides.", "duplicate": "Duplicate", "duplicate_hint": "An earlier rule matches exactly the same traffic and has the same action.", "disabled_long": "Long disabled", "disabled_long_hint": "The rule is disabled and OPNexus has seen it unchanged like that for the whole threshold." }, "detail": { "unused": "no hit in {days} days", "disabled": "disabled for at least {days} days", "disabledSince": "disabled since {when}", "by": "by \"{rule}\"", "byAutomatic": "by the automatic rule \"{rule}\"" }, "confidence": { "label": "Confidence", "sure": "sure", "probable": "probable", "unknown": "unknown", "tip": { "sure": "Proven: the data is complete and current, none of it rests on an assumption.", "probable": "Rests on an assumption (e.g. alias content, guessed order, the rule's schedule or a missing pf rule set). Check before removing.", "unknown": "There is a hint but no proof (e.g. the rule is not loaded in pf or the counters are stale). Do not rely on it." } }, "noHit": "none observed", "noHitSince": "OPNexus has been watching this rule since {when} and has seen no hit.", "notRemovable": { "automatic": "automatic", "automatic_hint": "OPNsense generates this rule itself and it cannot be removed on its own.", "legacy": "legacy format", "legacy_hint": "The rule is still in the old format. Migrate it to the new rule format in OPNsense first.", "managed": "managed by OPNexus", "managed_hint": "OPNexus deployed this rule. It is removed through the normal flow of the rules page, otherwise OPNexus would create it again.", "managedLink": "Open rule \"{rule}\"", "confidence": "unknown", "confidence_hint": "There is a hint but no proof. Such rules are never offered for removal.", "nothing": "no finding", "nothing_hint": "There is no finding for this rule that would justify disabling it.", "deleteWait": "not yet", "deleteWait_hint": "Only rules that have been disabled long enough, unchanged, and count as sure are deleted. Not reached yet.", "unreadable": "unreadable", "unreadable_hint": "The rule has no UUID in the new rule format and cannot be changed individually." }, "action": { "disable": "Disable", "enable": "Enable", "delete": "Delete" }, "select": { "column": "Select", "row": "Select rule {rule}", "count": "{n} of {max} selected", "previewDisable": "Preview: disable", "previewDelete": "Preview: delete", "clear": "Clear selection", "none": "Select at least one rule.", "locked": "Locked until management sources are set.", "busy": "Another cleanup is still open: confirm or revert it first.", "otherKind": "One cleanup cannot mix disabling and deleting. Clear the other selection first.", "limit": "At most {max} rules per cleanup (setting).", "needsAck": "Acknowledgement needed", "needsAckHint": "The finding rests on an assumption. Before the preview you confirm for this rule explicitly that it is not needed." }, "settings": { "link": "Settings", "title": "Rule cleanup", "intro": "Limits and protection for disabling, deleting and restoring rules under Analysis, Cleanup.", "sources": "Management sources", "sourcesHint": "Addresses or networks the firewalls are managed from (OPNexus itself, your workstation, a jump host). A rule that could match access from there to the firewall is never disabled. Without an entry the cleanup is locked. IP addresses or networks (CIDR) only, no names.", "sourcesPlaceholder": "203.0.113.10\n198.51.100.0/24", "sourcesInvalid": "“{value}” is not an IP address or network (e.g. 203.0.113.10 or 198.51.100.0/24). Host names are not allowed.", "sourcesEverything": "“{value}” covers the whole address space and would protect every rule.", "sourcesTooMany": "At most 20 entries.", "maxRules": "Rules per cleanup", "maxRulesHint": "The most rules a single cleanup may change (1 to 25).", "maxRulesInvalid": "A whole number from 1 to 25.", "minDays": "Waiting time before deleting (days)", "minDaysHint": "How long a rule that was confirmed as disabled has to stay unchanged before it may be deleted (1 to 365).", "minDaysInvalid": "A whole number from 1 to 365.", "saved": "Cleanup settings saved.", "ports": "Additional management ports", "portsHint": "TCP ports the firewalls are additionally managed on (e.g. SSH or the web GUI on another port). The API port, 443, 80 and 22 are always protected.", "portsPlaceholder": "e.g. 2222, 8443", "portsInvalid": "Not a valid port: {value} (1–65535).", "portsTooMany": "At most 20 ports.", "yourAddress": "Your address as OPNexus sees it: {address}", "addYourAddress": "Add", "yourAddressHint": "A suggestion: the firewalls may see your workstation under another address (NAT, VPN). The cleanup determines OPNexus's own address per firewall automatically." }, "mgmt": { "title": "Cleanup locked: management sources missing", "text": "Enter the addresses your firewalls are managed from. After that the cleanup never switches off a rule that could match this access.", "hint": "For every selected rule OPNexus checks whether it can match a packet from a management source to the firewall's management address and port. If it matches, or this cannot be ruled out, the rule is left alone. IP addresses or networks (CIDR) only.", "askAdmin": "An administrator has to enter the management sources in the settings." }, "dur": { "minutes": "{n} min", "seconds": "{n} s" }, "preview": { "title": { "disable": "Preview: disable rules", "enable": "Preview: enable rules again", "delete": "Preview: delete rules" }, "intro": { "disable": "The rules on {host} are only disabled, not deleted, and the change is applied.", "enable": "The rules on {host} are switched on again and the change is applied.", "delete": "The already disabled rules on {host} are deleted. Their content is backed up first." }, "introHint": { "disable": "The list was just recomputed from the firewall. When rolling out, OPNexus checks everything again and writes nothing if something changed.", "enable": "Switching a rule on can change or block connections. That is why there is a confirmation window again. The list was just recomputed from the firewall.", "delete": "A disabled rule is not loaded in the firewall, so deleting it changes nothing there and needs no confirmation window. Under “Cleanup history” the rule can be restored (disabled, at its old position where possible)." }, "loading": "Computing the preview from the firewall …", "failed": "The preview could not be computed.", "compute": "Compute preview", "again": "Recompute preview", "validFor": "Preview valid for {time}", "expired": "The preview has expired. Please recompute it.", "clusterOrder": "Cluster: backup first, then master. Reverting runs in reverse order.", "basisConfirmed": "Disabled and confirmed since {when}, unchanged.", "basisDisabled": "Disabled by hand and unchanged for a long time.", "external": "changed externally", "externalHint": "The rule was changed outside OPNexus since it has been observed.", "acknowledged": "explicitly acknowledged", "autoRevert": "Afterwards you have {window} to check that everything works and the firewall is reachable. If you do not confirm in that time, OPNexus reverts the change automatically.", "confirmName": "Firewall name to confirm", "confirmNameHint": "Type the firewall's name exactly. This prevents changing the wrong firewall by accident.", "confirmNameAria": "Type the firewall name to confirm: {host}", "deployDisabledName": "The name has to match the firewall's name exactly.", "deployNotAdmin": "Only administrators may roll out. A preview belongs to whoever created it: an administrator has to open a new preview themselves.", "opnexusSource": { "added": "OPNexus reaches this firewall from {address}: that address is protected as well.", "configured": "OPNexus reaches this firewall from {address} (already in the management sources).", "unknown": "The address OPNexus reaches this firewall from could not be determined (API right “Diagnostics: states” or a path through the management tunnel). Make sure it is in the management sources." } }, "ack": { "title": "These findings rest on an assumption. Acknowledge each rule on its own.", "text": "Not proven: schedule, alias content or observation period are estimated. I have checked that the rule “{rule}” is not needed.", "enableTitle": "Switching these block rules on may hit the management access. Acknowledge each rule.", "enableText": "I checked that switching on “{rule}” does not block OPNexus or the admins from reaching the firewall." }, "protect": { "false": "Management access untouched", "false_hint": "No management source ({sources}) can use this rule to reach the firewall's management (checked: {queries} combinations of source, destination, port and interface).", "true": "matches management access", "true_hint": "The rule can match access from a management source ({sources}) to the firewall. The confirmation window is the safeguard here.", "unknown": "Management access unclear", "unknown_hint": "It could not be ruled out that the rule affects access from a management source ({sources}). The confirmation window is the safeguard here.", "sourcesHidden": "the configured management sources" }, "deploy": { "disable": "Disable and apply", "enable": "Enable and apply", "delete": "Delete permanently", "failed": "The roll-out failed." }, "toast": { "deployedConfirm": "Applied. Check the firewall now and confirm, otherwise it is reverted.", "deployedDone": "Done.", "deployedCheck": "Not complete: details in the box above.", "confirm": { "confirmed": "Confirmed. The change stays.", "done": "Confirmed." }, "revert": { "reverted": "Reverted. The rules are as they were.", "revert_failed": "Reverting failed. Check the firewall's state.", "done": "Reverted." }, "retry": { "reverted": "Reverted. The rules are as they were.", "revert_failed": "Reverting failed again.", "done": "State checked again.", "failed": "State checked again, not everything is complete." }, "ended": { "reverted": "The cleanup was reverted automatically.", "confirmed": "The cleanup was confirmed.", "done": "The cleanup is complete.", "failed": "The cleanup has ended, but not everything worked." } }, "confirmFailed": "Confirming failed.", "revertFailed": "Reverting failed.", "retryFailed": "Checking again failed.", "op": { "title": { "disable": "Disable rules", "enable": "Enable rules again", "delete": "Delete rules", "restore": "Restore rule" }, "state": { "running": "OPNexus is writing the change to the firewall. The automatic revert is already armed.", "awaiting_confirm": "The change is applied on the firewall. Check that everything works and the firewall is reachable, then confirm.", "partial": "Not all rules could be changed. Confirming is locked: revert now or wait for the automatic revert.", "apply_failed": "The rules are changed, but applying on the firewall failed. Revert now or wait for the automatic revert.", "reverting": "OPNexus is reverting the change.", "revert_failed": "Reverting failed. The firewall's state is unclear: check it in OPNsense and try again.", "confirmed": "Confirmed.", "reverted": "Reverted.", "done": "Complete.", "failed": "The outcome is unclear for at least one rule. “Check again” makes OPNexus read the firewall's state.", "preview": "Preview.", "cancelled": "Cancelled.", "expired": "Expired." }, "countdown": "{time} left until the automatic revert", "countdownMinutes": "About {n} min left until the automatic revert.", "confirm": "Confirm", "confirmNotYet": "Confirming is possible once the change is applied.", "confirmPartial": "Confirming is locked because at least one rule failed or is unclear.", "confirmApplyFailed": "Confirming is locked because applying on the firewall failed.", "revert": "Revert now", "revertNeedsAdmin": "Only administrators may revert (setting: operators may roll out).", "retryRevert": "Retry reverting", "retryCheck": "Check again", "retryNeedsAdmin": "Only administrators may retry.", "autoRevertNote": "Confirming means: you can still reach the firewall. If you do not confirm, OPNexus reverts automatically when the time is up. Confirming works from the browser session only, not with an API token." }, "status": { "preview": "Preview", "preview_hint": "Computed, nothing written yet.", "running": "Running", "running_hint": "OPNexus is writing to the firewall.", "awaiting_confirm": "Waiting for confirmation", "awaiting_confirm_hint": "Applied. Without confirmation OPNexus reverts automatically when the time is up.", "confirmed": "Confirmed", "confirmed_hint": "Confirmed by a user. The change stays.", "partial": "Partial", "partial_hint": "Not all rules could be changed. Revert or wait for the automatic revert.", "apply_failed": "Apply failed", "apply_failed_hint": "The rules are changed, but the firewall did not apply the change.", "reverting": "Reverting", "reverting_hint": "OPNexus is restoring the old state.", "reverted": "Reverted", "reverted_hint": "The old state is restored. The rules' observation window starts again.", "revert_failed": "Revert failed", "revert_failed_hint": "The firewall's state is unclear. Check it and try again.", "done": "Complete", "done_hint": "Fully carried out.", "failed": "Failed", "failed_hint": "Not everything was carried out. Details at the rules.", "cancelled": "Cancelled", "cancelled_hint": "The preview was not rolled out.", "expired": "Expired", "expired_hint": "The preview was no longer valid." }, "state": { "queued": "waiting", "disabling": "being disabled", "disabled": "disabled", "confirmed": "confirmed", "reverting": "being reverted", "reverted": "reverted", "deleting": "being deleted", "deleted": "deleted", "restoring": "being restored", "restored": "restored (disabled)", "failed": "failed", "unknown": "outcome unclear", "revert_failed": "revert failed", "skipped": "skipped" }, "stateEnable": { "disabling": "being enabled", "disabled": "enabled" }, "hist": { "title": "Cleanup history", "empty": "Nothing has been cleaned up on this firewall yet.", "restore": "Restore …", "restoreHint": "Recreates the deleted rule from the backup, disabled and at its old position where possible.", "adminOnly": "Only administrators may restore.", "delete": "Delete …", "deleteHint": "Opens the preview for deleting this disabled rule.", "deleteWait": "Deleting is possible from {when} (waiting time after the confirmation, configurable).", "enable": "Enable again …", "enableHint": "Opens the preview for switching the rule on, with a confirmation window.", "restoredBadge": "restored" }, "restore": { "title": "Restore rule", "intro": "The deleted rule is recreated from the backup, disabled and at its old position where possible.", "introHint": "The rule gets a new UUID. In a cluster it is restored on every node. Switching it on is a separate step (“Enable again”) with a confirmation window. If aliases or categories of the rule are gone meanwhile, the firewall refuses and its message appears in the result.", "action": "Restore", "done": "Rule “{rule}” restored (disabled).", "failed": "Restoring failed.", "next": "To switch it on: choose “Enable again” under “Cleanup history”." }, "refuse": { "managed": "managed by OPNexus", "automatic": "automatic rule", "legacy": "legacy format", "management": "could match management access", "infrastructure": "cluster/infrastructure rule", "confidence": "finding not proven", "not_candidate": "no longer a candidate" }, "openReason": { "deployment": "rule roll-out open", "cleanup": "another cleanup open", "rule": "rule already being handled" }, "clusterReason": { "peer_disabled": "a node is disabled", "peer_missing": "a node is missing", "roles": "roles unclear", "uuid_missing": "rule missing on a node" }, "settingsReason": { "not_an_address": "not an IP address or network", "everything": "whole address space", "too_many": "too many entries" } }, "ruleHistory": { "title": "History: {rule}", "host": "Firewall", "loadFailed": "The history could not be loaded.", "list": "Events", "action": "History", "open": "Show the history of rule {rule}", "by": "by {actor}", "since": "OPNexus has been watching this firewall since {when}.", "empty": { "title": "No changes observed", "since": "This rule has not changed since {when}.", "notYet": "OPNexus has not observed this firewall yet; the first observation runs shortly after startup." }, "origin": { "opnexus": "via OPNexus", "opnexus_hint": "The change matches a deployment or rollback by OPNexus (an audit entry in that period).", "external": "external", "external_hint": "No OPNexus operation in that period: changed in the firewall's own interface, by a script or through another access." }, "kind": { "added": "created", "changed": "changed", "removed": "removed", "enabled": "enabled", "disabled": "disabled", "revision": "saved in OPNexus", "moved": "moved" }, "audit": { "deploy": "deployed", "confirm": "confirmed", "rollback": "rolled back", "retry-rollback": "rollback retried", "state_change": "state changed" }, "field": { "description": "Description", "enabled": "enabled", "action": "Action", "interface": "Interface", "interfacenot": "Interface inverted", "direction": "Direction", "ipprotocol": "IP version", "protocol": "Protocol", "source_net": "Source", "source_not": "Source inverted", "source_port": "Source port", "destination_net": "Destination", "destination_not": "Destination inverted", "destination_port": "Destination port", "quick": "Quick", "gateway": "Gateway", "sequence": "Sequence", "sort_order": "Sort order", "log": "Log", "sched": "Schedule", "statetype": "State type", "tag": "Tag", "tagged": "Tagged", "source_ports": "Source port", "prio_group": "Group/priority" } }, "configCode": { "title": "Configuration as code", "intro": "Exports rules, NAT, aliases, groups, hierarchy and site variables as one YAML file – for Git, reviews and restoring onto a new instance. Importing only changes the drafts in OPNexus. Firewalls still only receive something through preview → deploy → confirm. The file contains no firewall credentials, users or keys.", "exported": "Configuration exported", "exportFailed": "Export failed", "planFailed": "The file could not be checked", "applyFailed": "Import failed", "tooLarge": "The file is larger than 1 MiB.", "line": "line {n}", "moreErrors": "… and {n} more", "export": { "title": "Export", "text": "All central objects as opnexus-config.yaml, sorted and without a timestamp, so Git shows real changes only.", "tip": "On the server: opnexus export --out /srv/opnexus-config. With cron or a timer plus git commit this becomes a change log. apply --dry-run checks a file in CI.", "button": "Download YAML" }, "import": { "title": "Check and apply a file", "text": "A plan comes first: what would be new, change or be removed. Only then can the file be taken over into the drafts.", "chooseFile": "Choose file", "paste": "or paste YAML", "prune": "Remove objects not in the file (prune)", "pruneTip": "Reconciles every kind that appears in the file completely: objects missing from the file are removed from OPNexus. Deployed or still-referenced objects are never removed, they block the plan.", "plan": "Create plan", "apply": "Apply", "adminOnly": "Only administrators can apply." }, "summary": "Plan summary", "action": { "create": "new", "update": "changed", "delete": "removed", "unchanged": "unchanged", "blocked": "blocked" }, "all": "All", "colKind": "Kind", "colKey": "Key", "colAction": "Action", "colChange": "Change", "kind": { "device_groups": "Device groups", "policy_hierarchy_groups": "Hierarchy groups", "aliases": "Aliases", "rules": "Rules", "port_forwards": "Port forwards", "one_to_one": "1:1 NAT", "outbound_nat": "Outbound NAT", "policy_hierarchy_rules": "Hierarchy rules", "variables": "Variables" }, "noDifferences": "No differences", "noDifferencesText": "The file matches the current state in OPNexus.", "blockedHint": "The plan contains blocked objects and cannot be applied as it is. Fix the cause, or take the objects out of the file and plan again.", "deployedOn": "Deployed on {n} firewall(s): redeploy through the preview afterwards.", "implicit": "Follows from order or membership, not in the file.", "showAll": "Show {n} more", "warnings": "Notes", "reason": { "busy_deployment": "Open deployment: confirm or roll it back first", "prune_deployed": "Is deployed: remove it in the interface first", "prune_referenced": "Still in use" }, "warn": { "redeploy_needed": "{count} changed objects are deployed: redeploy them through the preview after applying.", "targets_without_link": "{count} new objects have targets but are not linked to objects on the firewalls: deploying may create duplicates. Link them first or restore from a full backup.", "unknown_alias_reference": "\"{value}\" looks like an alias but is not a central alias in OPNexus. If it exists on the target firewalls (created by hand), that is fine; otherwise deploying fails.", "variable_removed_in_use": "Variable {name} of {host} is removed while an object still uses it (deploying to that host will then fail).", "target_host_disabled": "Target host {host} is disabled." }, "confirm": { "title": "Apply the plan?", "text": "{create} new, {update} changed, {delete} removed.", "nothingOnFirewalls": "Nothing is written to firewalls. The changes appear as drafts and are deployed as usual through preview → deploy → confirm.", "prune": "{n} objects will be removed from OPNexus." }, "applied": "Applied: {create} new, {update} changed, {delete} removed", "appliedNext": "Nothing was written to firewalls. Now deploy the drafts object by object through preview → deploy → confirm.", "viewDrafts": "View drafts", "err": { "yaml_alias_forbidden": "Aliases (*name) are not allowed", "yaml_anchor_forbidden": "Anchors (&name) are not allowed", "yaml_merge_forbidden": "Merge keys (<<) are not allowed", "yaml_tag_forbidden": "Explicit tags (!, !!) are not allowed", "yaml_directive_forbidden": "Directives (%YAML, %TAG) are not allowed", "yaml_multiple_documents": "More than one YAML document", "yaml_empty": "The file is empty", "yaml_syntax": "YAML syntax error", "duplicate_key": "Duplicate key", "non_string_key": "The key must be text", "too_deep": "Nested too deeply", "too_many_nodes": "Too many elements", "scalar_too_long": "Value too long", "too_many_objects": "Too many objects", "too_many_entries": "Too many entries", "too_many_variables": "Too many variables for this host", "too_large": "File too large", "bad_encoding": "Not valid UTF-8", "bad_request": "Invalid request", "unknown_kind": "Unknown kind", "not_a_mapping": "The file must be a mapping", "missing_version": "opnexus_config: 1 is missing", "unsupported_version": "This version of the file format is unknown", "unknown_field": "Unknown field", "missing_field": "Required field missing", "bad_type": "Wrong type", "bad_value": "Invalid value", "bad_format": "Wrong format", "too_short": "Too short", "too_long": "Too long", "control_character": "Control characters are not allowed", "surrounding_whitespace": "Surrounding whitespace is not allowed", "bad_variable_name": "Invalid variable name", "bad_variable_value": "Invalid variable value", "duplicate_object_key": "This key appears twice in the file", "duplicate_entry": "Entry appears twice", "unknown_host": "Unknown host", "unknown_group": "Unknown device group", "unknown_hierarchy_group": "Unknown hierarchy group", "hierarchy_cycle": "Cycle in the hierarchy tree", "host_in_two_hierarchy_groups": "Host is in two hierarchy groups", "placeholder_not_supported": "Placeholders {{…}} are not possible in hierarchy rules" } } }