OPNexus/frontend/lib/i18n/en.json

{
  "common": {
    "save": "Save",
    "actions": "Actions",
    "statusOnline": "Online",
    "statusOffline": "Offline",
    "statusDisabled": "Disabled",
    "skipToContent": "Skip to content",
    "cancel": "Cancel",
    "close": "Close",
    "requestFailed": "Request failed",
    "loading": "Loading…",
    "refresh": "Refresh",
    "saveFailed": "Saving failed",
    "saving": "Saving…",
    "deleteFailed": "Deleting failed",
    "description": "Description",
    "versionLabel": "OPNexus {version} “{codename}”"
  },
  "settings": {
    "language": {
      "label": "Language",
      "de": "German",
      "en": "English",
      "saved": "Language saved."
    },
    "notify": {
      "saved": "Notification settings saved.",
      "testSent": "Test notification sent via {channel}.",
      "channelWebhook": "webhook",
      "channelEmail": "email",
      "testFailed": "Test failed",
      "title": "Notifications",
      "intro": "Host offline, certificate expiring, rule drift in the cluster and failed rollbacks are checked regularly (every {seconds}s) and reported through the enabled channels.",
      "webhook": "Webhook",
      "webhookUrl": "Webhook URL",
      "signingSecret": "Signing secret {state}",
      "isSet": "(set)",
      "notSet": "(not set)",
      "keepUnchanged": "leave unchanged…",
      "optional": "optional",
      "removeSecret": "Remove secret",
      "sending": "Sending…",
      "testWebhook": "Test webhook",
      "email": "Email (SMTP)",
      "smtpHost": "SMTP host",
      "port": "Port",
      "security": "Encryption",
      "securityNone": "None",
      "username": "Username",
      "password": "Password {state}",
      "removePassword": "Remove password",
      "from": "Sender address",
      "to": "Recipients (comma-separated)",
      "testEmail": "Test email",
      "events": "Events",
      "event": {
        "hostOffline": "Host unreachable",
        "certExpiring": "Certificate expiring",
        "ruleDrift": "Rule drift in the cluster",
        "revertFailed": "Failed rollback",
        "maintenanceUnknown": "Maintenance outcome unclear",
        "carpHealth": "CARP state critical (split-brain / no master)",
        "natDrift": "NAT drift in the cluster",
        "carpAutoRevertFailed": "CARP auto-revert failed",
        "scheduledFailed": "Scheduled maintenance did not run",
        "backupFailed": "No recent backup / offsite copy failed",
        "complianceAlerts": "Critical or high security finding (off by default)",
        "networkDrift": "Network differences in the cluster"
      },
      "pollInterval": "Check interval (seconds)",
      "pollHint": "At least 60s, so the firewalls are not loaded unnecessarily."
    },
    "logs": {
      "saved": "Log ingest settings saved.",
      "title": "Log collection",
      "intro": "OPNexus regularly fetches firewall logs from all hosts and stores them in its own database (see “Logs”). Longer retention means more storage, depending on the traffic volume of the connected firewalls — on heavily used hosts, even a few days can take up several gigabytes.",
      "enabled": "Log collection active",
      "pollInterval": "Fetch interval (seconds)",
      "retention": "Retention (days)",
      "maxSize": "Max. storage (GB)",
      "maxSizeHint": "0 = unlimited. When the limit is reached the oldest entries are deleted. The value is estimated from the table size; Postgres does not hand freed space back to the file system but reuses it for new logs.",
      "usage": "Used: {used} of {limit}",
      "unlimited": "unlimited",
      "usageAria": "Used log storage",
      "stored": "{count} entries stored",
      "storedSince": "{count} entries stored (since {date})"
    },
    "title": "Settings",
    "appearance": "Appearance",
    "appearanceSaved": "Appearance saved.",
    "appearanceHint": "The selection is saved for your account. “System” follows your device's display settings.",
    "colorScheme": "Color scheme",
    "theme": {
      "light": "Light",
      "dark": "Dark",
      "system": "System"
    },
    "passwordMismatch": "New passwords do not match.",
    "passwordChanged": "Password changed.",
    "passwordFailed": "Password change failed",
    "account": "Account",
    "currentPassword": "Current password",
    "newPassword": "New password",
    "repeatPassword": "Repeat new password",
    "changePassword": "Change password",
    "operational": "Operational settings",
    "deployWindow": "Deploy confirmation window",
    "seconds": "{n} seconds",
    "sessionLifetime": "Session lifetime",
    "days": "{n} days",
    "serverManaged": "These values are set centrally by the server configuration.",
    "about": "About OPNexus",
    "version": "Version",
    "development": "Development",
    "changelogNote": "The change history and version scheme are in {file}.",
    "update": {
      "title": "Update OPNexus",
      "hint": "Pulls the new images, switches the services and checks that everything is healthy. If that fails, OPNexus rolls back to the previous version automatically.",
      "installed": "Installed",
      "latest": "Latest version",
      "upToDate": "OPNexus is up to date.",
      "notes": "Release notes",
      "checked": "Last checked: {time}",
      "feedOff": "The version check is off. Set UPDATE_CHECK_URL in the server's .env so OPNexus can detect new versions.",
      "feedError": "The release feed is currently unreachable.",
      "notEnabledTitle": "Updates from the web interface are not enabled.",
      "notEnabledBody": "They need a small separate service (the updater) with access to Docker — deliberately optional. To enable it:",
      "notEnabledStep1": "Add to the .env on the server:",
      "notEnabledStep2": "Then run:",
      "notEnabledCli": "Until then, update on the server with “opnexus update”.",
      "unreachable": "The updater does not respond. Check on the server: docker compose ps updater",
      "localMode": "This installation builds OPNexus locally from source (no release image). Update on the server with git pull and docker compose up -d --build.",
      "majorChange": "Version {latest} is a major version jump. Please read the release notes first, then update on the server with “opnexus update {latest}”.",
      "button": "Update to {latest}",
      "confirmTitle": "Update to {latest}?",
      "confirmBody": "OPNexus pulls the new images and restarts itself. The interface is unavailable for about one to two minutes; the managed firewalls are not affected.",
      "confirmSafety": "A backup is taken automatically before a database migration. If the new version does not become healthy, OPNexus rolls back to the previous version on its own.",
      "confirm": "Update now",
      "startFailed": "Could not start the update",
      "running": "Updating to {target} …",
      "rollingBack": "Rolling back …",
      "reconnecting": "Reconnecting — this is normal while the services restart.",
      "phase": {
        "pulling": "Pulling new images",
        "switching": "Switching services",
        "waiting": "Waiting for healthy services",
        "stopping": "Stopping services",
        "restoring": "Restoring the database",
        "rolled_back": "Rolled back",
        "done": "Done"
      },
      "result": {
        "succeededUpdate": "OPNexus is now running {version}. Reloading the page …",
        "succeededRollback": "OPNexus was rolled back to {version}. Reloading the page …",
        "rolledBack": "The update to {target} failed. OPNexus was rolled back to the previous version automatically.",
        "failed": "The operation failed. Check the log and the server state (on the server: opnexus status)."
      },
      "showLog": "Log",
      "rollback": {
        "button": "Roll back to previous version",
        "hint": "Undoes the last update (back to {version}).",
        "confirmTitle": "Roll back to {version}?",
        "dataLoss": "The update migrated the database. Rolling back restores the state from before the update: changes made since the update and the log history are lost.",
        "noDataLoss": "The database was not migrated — no data is lost.",
        "confirm": "Roll back"
      },
      "badge": "Update available",
      "resultTime": "Result from {time}"
    },
    "setup": {
      "title": "Setup assistant",
      "intro": "Walks you step by step through password, two-factor sign-in and connecting a firewall.",
      "open": "Open assistant"
    }
  },
  "nav": {
    "aboutTitle": "About OPNexus — fleet status & versions",
    "mainNavigation": "Main navigation",
    "subNavigation": "Section navigation",
    "readOnly": "Read-only",
    "readOnlyDescription": "This role can view everything but cannot save changes or perform actions.",
    "search": "Search (Ctrl/⌘+K)",
    "logout": "Sign out",
    "groups": {
      "overview": "Overview",
      "policy": "Policy",
      "network": "Network",
      "vpn": "VPN",
      "certificates": "Certificates",
      "monitoring": "Monitoring",
      "system": "System",
      "hostsystem": "Host system"
    },
    "items": {
      "dashboard": "Dashboard",
      "hosts": "Hosts",
      "cluster": "Cluster",
      "rules": "Rules",
      "policy-hierarchy": "Policy hierarchy",
      "groups": "Groups",
      "aliases": "Aliases",
      "nat": "NAT",
      "network-interfaces": "Interfaces",
      "network-vlans": "VLANs",
      "network-vips": "Virtual IPs",
      "network-gateways": "Gateways",
      "network-routes": "Routes",
      "network-dns": "DNS",
      "network-dhcp": "DHCP",
      "ipsec": "IPsec VPN",
      "openvpn": "OpenVPN",
      "wireguard": "WireGuard",
      "certificates": "Certificates",
      "logs": "Logs",
      "audit": "Audit",
      "security": "Security posture",
      "updates": "Update Center",
      "settings": "Settings",
      "users": "Users",
      "overlay": "Management tunnel",
      "tokens": "API tokens",
      "network-devices": "Devices",
      "network-compare": "Compare",
      "hostsystem-tunables": "Tunables",
      "hostsystem-cron": "Cron",
      "hostsystem-syslog": "Syslog",
      "hostsystem-snapshots": "Snapshots",
      "hostsystem-diagnostics": "Diagnostics",
      "setup": "Setup"
    }
  },
  "dashboard": {
    "securityPosture": "Security posture",
    "postureNone": "No security check has run yet.",
    "postureOpen": "Open",
    "subtitle": "Fleet status, pending actions, and security warnings at a glance.",
    "managedHosts": "Managed hosts",
    "online": "Online",
    "pendingActions": "Pending actions",
    "securityWarnings": "Security warnings",
    "fleetHealth": "Fleet/CARP health",
    "noHosts": "No hosts yet",
    "toHosts": "Go to hosts",
    "startSetup": "Start the setup assistant",
    "nothingPending": "Nothing pending",
    "nothingPendingDescription": "No pending confirmations, errors, or unclear maintenance operations.",
    "securityAndExpiryWarnings": "Security & expiry warnings",
    "noWarnings": "No warnings",
    "noWarningsDescription": "No offline hosts, expiring certificates, rule drift, or pending updates.",
    "activity": "Activity",
    "noActivity": "No activity yet",
    "viewAudit": "View full audit history",
    "justNow": "just now",
    "minutesAgo": "{count} min ago",
    "hoursAgo": "{count} hr ago",
    "certificate": "Certificate",
    "certExpired": "{name} — expired",
    "certExpiresIn": "{name} — expires in {count} days",
    "certExpiresSoon": "{name} — expires soon",
    "expired": "Expired",
    "expires": "Expiring",
    "kinds": {
      "rule": "Firewall rule",
      "port_forward": "Port forward",
      "one_to_one": "1:1 NAT",
      "outbound_nat": "Outbound NAT",
      "policyHierarchy": "Policy hierarchy",
      "alias": "Alias",
      "ipsec": "IPsec tunnel",
      "openvpn": "OpenVPN instance",
      "wireguard": "WireGuard tunnel",
      "hostMaintenance": "Host maintenance",
      "carpAutoRevert": "CARP auto-revert"
    },
    "statuses": {
      "pending": "Confirmation pending",
      "error": "Error",
      "revertFailed": "Rollback failed",
      "starting": "Submitting",
      "submitted": "Submitted to firewall",
      "unknown": "Outcome unclear",
      "active": "Window active"
    },
    "hostIsOffline": "{name} is offline",
    "hostOffline": "Host offline",
    "driftLine": "{cluster}: {count} rule(s) drift between the nodes",
    "driftBadge": "Drift",
    "majorAvailable": "Major upgrade available",
    "stableAvailable": "Stable update available",
    "updateBadge": "Update",
    "loadFailed": "Could not load dashboard"
  },
  "hosts": {
    "add": "Add host",
    "name": "Name",
    "address": "Address",
    "status": "Status",
    "cluster": "Cluster",
    "policyHierarchy": "Policy hierarchy",
    "empty": "No hosts yet.",
    "loadFailed": "Could not load hosts",
    "createFailed": "Could not create host",
    "created": "Host “{name}” created",
    "saved": "Host “{name}” saved",
    "deleted": "Host “{name}” deleted",
    "deleteConfirm": "Delete this host? Rules or aliases that are still active on it must be removed first.",
    "openInOpnsense": "Open in OPNsense",
    "edit": "Edit",
    "delete": "Delete",
    "baseUrl": "Base URL",
    "clusterOptional": "Cluster (optional)",
    "clusterPlaceholder": "e.g. ha-pair-1 — hosts with the same name appear together in the cluster view",
    "clusterShortPlaceholder": "e.g. ha-pair-1",
    "policyGroupOptional": "Policy hierarchy group (optional)",
    "none": "(none)",
    "verifyTls": "Verify TLS certificate",
    "saving": "Saving…",
    "create": "Create host",
    "editTitle": "Edit host: {name}",
    "active": "Active",
    "baseUrlEditHint": "Enter the new address if the firewall got a different IP (e.g. after changing its management interface). History and assignments are kept."
  },
  "rules": {
    "title": "Firewall rules",
    "groupTitle": "Rules · {name}",
    "new": "New rule",
    "managed": "Centrally managed",
    "live": "Live across all hosts",
    "retry": "Retry",
    "loading": "Loading rules…",
    "loadFailed": "Could not load rules",
    "searchLabel": "Search rules",
    "searchPlaceholder": "Name, source, destination, port …",
    "groupFilter": "Filter by device group",
    "allGroups": "All device groups and individual rules",
    "stateFilter": "Filter by rule state",
    "allStates": "All states",
    "subtitle": "Maintain central policies as drafts, review changes, and deploy them to selected hosts or device groups.",
    "groupSummary": "{members} group members · {rules} assigned rules · ",
    "manageMembers": "Manage memberships",
    "showAllInGroup": "All rules of this group",
    "showAll": "Show all rules",
    "countDraft": "{count} with pending changes",
    "countReview": "{count} to review",
    "countSynced": "{count} deployed",
    "groupGone": "This device group no longer exists.",
    "groupEmpty": "No rule is assigned to this group yet.",
    "none": "No central rules created yet.",
    "noMatch": "No rules match this selection.",
    "createFirst": "Create first rule",
    "createFirstForGroup": "Create first rule for this group",
    "resetSelection": "Reset selection",
    "targets": "{active} active target hosts of {total}",
    "retainedTargets": " · {count} former targets",
    "disabledSuffix": " · rule disabled",
    "hierarchyTag": "Hierarchy: {name}",
    "groupTag": "Group: {name}",
    "confirm": "Confirm",
    "confirming": "Confirming…",
    "edit": "Edit",
    "reviewPush": "Review & push",
    "historyTitle": "Rule history",
    "history": "History",
    "duplicateTitle": "Duplicate rule",
    "duplicate": "Duplicate",
    "delete": "Delete",
    "deployResult": "Deploy result",
    "expiresIn": "— expires in {seconds}s unless confirmed",
    "revertedNote": "— not confirmed, rolled back automatically",
    "revertFailed": "— rollback failed: {message}",
    "confirmed": "Deployment confirmed",
    "confirmFailed": "Confirmation failed",
    "deleteConfirm": "Really delete this rule? It will also be removed from all target hosts.",
    "deletedNamed": "Rule “{name}” deleted",
    "deleted": "Rule deleted",
    "createFailed": "Could not create rule",
    "interfacesUnavailable": "Interfaces of {failed} of {total} host(s) unavailable — list may be incomplete.",
    "copySuffix": " (copy)",
    "staleTargets": "Targets that no longer exist were removed from the draft. Please review the target selection before saving.",
    "editDraft": "Edit rule draft",
    "pickFromList": "Pick from list",
    "enterManually": "Enter manually",
    "interfaceMismatch": "Does not mean the same network on all firewalls ({label}) — push is blocked until the rule or targets are adjusted.",
    "netPlaceholder": "any, IP/CIDR or alias",
    "active": "Rule active",
    "deviceGroups": "Device groups",
    "createGroupsHint": "Create groups under “Groups”.",
    "groupHosts": "{name} ({count} hosts)",
    "hierarchyOptional": "Policy hierarchy (optional)",
    "noInheritance": "No inheritance",
    "andSubgroups": "{name} and subgroups",
    "additionalTargets": "Additional target hosts",
    "noHosts": "No hosts available.",
    "coveredBy": "(already covered via {groups} — selecting it here is only needed so the rule keeps this host if it is later removed from the group)",
    "saveDraft": "Save draft",
    "actionPass": "allow",
    "actionBlock": "block",
    "actionReject": "reject",
    "dirIn": "inbound",
    "dirOut": "outbound",
    "adopt": {
      "button": "Adopt from firewall",
      "title": "Adopt rules from the firewall",
      "intro": "These rules were created directly in OPNsense. Once adopted you can edit and deploy them from OPNexus. Adopting itself changes nothing on the firewall.",
      "host": "Firewall",
      "none": "No unmanaged rules found.",
      "action": "Adopt",
      "adopted": "Adopted “{name}”.",
      "failed": "Adopting failed",
      "loadFailed": "Could not load rules.",
      "notPossible": "Cannot be adopted",
      "reasons": {
        "automatic": "System rule",
        "already_managed": "Already managed",
        "interface_not_single": "Several or no interface (floating rule)",
        "negated_interface": "Interface is inverted",
        "negated_source": "Source is inverted (NOT)",
        "negated_destination": "Destination is inverted (NOT)",
        "received_on": "Uses “received on”",
        "not_quick": "Not a quick rule (last match wins)",
        "direction_unsupported": "Direction is neither in nor out",
        "action_unsupported": "Action not supported",
        "ipprotocol_unsupported": "IPv4 and IPv6 in one rule",
        "no_description": "Description missing – please set one in OPNsense"
      }
    },
    "logPackets": "Log matching packets"
  },
  "login": {
    "prompt": "Please sign in",
    "username": "Username",
    "password": "Password",
    "signIn": "Sign in",
    "signingIn": "Signing in…",
    "failed": "Sign-in failed",
    "developedBy": "Developed by {maintainer}",
    "code": "Two-factor code",
    "codeHint": "6-digit code from your authenticator app, or a recovery code.",
    "back": "Back to sign-in",
    "sso": {
      "button": "Sign in with {name}",
      "errors": {
        "no_role": "Your account is not in any group that may use OPNexus.",
        "state": "The sign-in expired or was already used. Please try again.",
        "token": "The identity provider's answer could not be verified.",
        "provider": "The identity provider could not be reached or refused.",
        "throttled": "Too many failed attempts. Please wait a few minutes.",
        "disabled": "Single sign-on is not available.",
        "failed": "Single sign-on failed."
      }
    }
  },
  "errors": {
    "BACKUP_EMPTY": "The backup file is empty.",
    "BACKUP_INVALID_XML": "The backup file is not valid XML.",
    "BACKUP_TOO_LARGE": "The backup file exceeds the limit of {limit} MiB.",
    "BACKUP_WRONG_ROOT": "Unexpected root element “{root}” — this is not an OPNsense configuration backup.",
    "ACCOUNT_MUSS_ZUERST_AUF_DIE_FIREWALL_GESCHRIEBEN_WERDEN_EEEA04A9": "The account must be pushed to the firewall first",
    "ACCOUNT_NICHT_GEFUNDEN": "Account not found",
    "ACCOUNT_WIRD_NOCH_VON_MINDESTENS_EINER_ZERTIFIKATSANFRAGE_REFERENZIERT": "The account is still referenced by at least one certificate request",
    "ACME_ACCOUNT_GEHOERT_ZU_EINEM_ANDEREN_HOST": "The ACME account belongs to another host",
    "ACME_ACCOUNT_NICHT_GEFUNDEN": "ACME account not found",
    "ACTION_NOT_ALLOWED": "Action not allowed: {reason}",
    "AKTUELLES_PASSWORT_IST_FALSCH": "Current password is incorrect",
    "ALIAS_CONTENT_DIFFERS": "The {field_label} alias “{alias}” does not have the same content on all targets ({detail}). Correct the rule or restrict its targets before pushing.",
    "ALIAS_HAT_KEINE_ZIEL_HOSTS": "The alias has no target hosts",
    "ALIAS_MIT_DIESEM_NAMEN_EXISTIERT_BEREITS": "An alias with this name already exists",
    "ALIAS_NICHT_GEFUNDEN": "Alias not found",
    "ALIAS_NOCH_NICHT_BESTAETIGT": "The alias “{alias}” is still unconfirmed on {hosts}. Confirm the alias first, then deploy this rule — otherwise the alias's automatic rollback fails once the rule uses it.",
    "ALIAS_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_5A2C1888": "The alias changed in the meantime. Reload and review the changes again.",
    "BACKUP_NICHT_GEFUNDEN": "Backup not found",
    "BENUTZERNAME_BEREITS_VERGEBEN": "Username is already in use",
    "BENUTZER_NICHT_GEFUNDEN": "User not found",
    "CARP_VORSCHAU_NICHT_GEFUNDEN": "CARP preview not found",
    "CARP_ZUSTAND_WURDE_VERAENDERT_VORSCHAU_ERNEUT_OEFFNEN": "The CARP state changed. Open the preview again.",
    "DAS_NEUE_PASSWORT_MUSS_SICH_VOM_AKTUELLEN_UNTERSCHEIDEN": "The new password must differ from the current password",
    "DEPLOYMENT_NICHT_GEFUNDEN": "Deployment not found",
    "DEPLOYMENT_WURDE_GEAENDERT_VORSCHAU_AKTUALISIEREN": "The deployment changed. Refresh the preview.",
    "DER_EIGENE_ACCOUNT_KANN_NICHT_GELOESCHT_WERDEN": "You cannot delete your own account",
    "EINE_REGEL_DARF_IN_DER_REIHENFOLGE_NUR_EINMAL_F05DF47C": "A rule may occur only once in the ordering",
    "EINTRAG_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_B5A5CE87": "The entry changed in the meantime. Reload and review the changes again.",
    "EIN_ODER_MEHRERE_ZIELE_WURDEN_NICHT_GEFUNDEN": "One or more targets were not found",
    "ENTFERNEN_FEHLGESCHLAGEN_DIE_ZUORDNUNG_BLEIBT_FUER_EINEN_NEUEN_4CF90E4C": "Removal failed. The assignment is retained for another attempt.",
    "ENTWURF_ODER_ZIELE_WURDEN_GEAENDERT_VORSCHAU_ERNEUT_OEFFNEN": "The draft or its targets changed. Open the preview again.",
    "ERROR_1_1_NAT_REGEL_NICHT_GEFUNDEN": "1:1 NAT rule not found",
    "FIRMWARE_AUFTRAG_LAEUFT_BEREITS_ODER_ZUSTAND_IST_UNBEKANNT": "A firmware job is already running or its state is unknown",
    "FUER_DIESEN_TUNNEL_IST_NOCH_KEIN_PRE_SHARED_4AE1FC63": "No pre-shared key has been stored for this tunnel",
    "FUER_DIESEN_TUNNEL_IST_NOCH_KEIN_SERVER_PRIVATSCHLUESSEL_D7527998": "No server private key has been stored for this tunnel",
    "FUER_DIESES_ZIEL_LIEGT_KEIN_WIEDERHOLBARER_ROLLBACK_VOR": "No repeatable rollback exists for this target",
    "GEPLANTE_WARTUNG_NICHT_GEFUNDEN": "Scheduled maintenance not found",
    "GEPLANTE_WARTUNG_NUR_AUF_DEM_CARP_BACKUP_MOEGLICH": "Scheduled maintenance is only possible on the CARP BACKUP. This firewall is currently MASTER – enable CARP maintenance mode first or schedule the partner node",
    "CARP_UEBERGABE_BRAUCHT_EINEN_CLUSTER": "Automatic CARP switchover is only available for hosts in a cluster",
    "GROUP_HAS_ASSIGNED_ITEMS": "The group still has assigned {label}. Move or delete them first.",
    "GRUPPENMITGLIEDER_ODER_REGELN_WURDEN_GEAENDERT_AUSWIRKUNGEN_ERNEUT_PRUEFEN": "Group members or rules changed. Review the impact again.",
    "GRUPPENNAME_BEREITS_VERGEBEN": "Group name is already in use",
    "GRUPPE_HAT_NOCH_UNTERGRUPPEN_DIESE_ZUERST_VERSCHIEBEN_ODER_9FFFD853": "The group still has child groups. Move or delete them first.",
    "GRUPPE_HAT_NOCH_ZUGEORDNETE_REGELN_DIESE_ZUERST_VERSCHIEBEN_2CCBC48B": "The group still has assigned rules. Move or delete them first.",
    "GRUPPE_NICHT_GEFUNDEN": "Group not found",
    "GRUPPE_WIRD_NOCH_VON_ALIASEN_VERWENDET": "The group is still used by aliases",
    "GRUPPE_WIRD_NOCH_VON_NAT_REGELN_VERWENDET": "The group is still used by NAT rules",
    "GRUPPE_WIRD_NOCH_VON_REGELN_VERWENDET": "The group is still used by rules",
    "HOSTNAMEN_EXAKT_EINGEBEN": "Enter the host name exactly",
    "HOSTZUSTAND_WURDE_VERAENDERT_VORSCHAU_ERNEUT_OEFFNEN": "The host state changed. Open the preview again.",
    "HOST_HAT_EINE_OFFENE_WARTUNGSAKTION_ZUERST_PRUEFEN_UND_8CC5FBE0": "The host has an open maintenance action. Review and finish it first.",
    "HOST_HAT_NOCH_AKTIVE_ALIAS_DEPLOYMENTS_DIESE_ZUERST_F4A3ED46": "The host still has active alias deployments. Remove them first or the aliases will remain active and untracked.",
    "HOST_HAT_NOCH_AKTIVE_POLICY_HIERARCHIE_DEPLOYMENTS_DIESE_ADD78845": "The host still has active policy hierarchy deployments. Remove them first or the rules will remain active and untracked.",
    "HOST_HAT_NOCH_AKTIVE_REGEL_DEPLOYMENTS_DIESE_ZUERST_0BF41721": "The host still has active rule deployments. Remove them first or the firewall rules will remain active and untracked.",
    "HOST_HAT_NOCH_NAT_DEPLOYMENTS_DIESE_ZUERST_GEZIELT_0C2A9E85": "The host still has NAT deployments. Remove them explicitly first.",
    "HOST_HAT_NOCH_VPN_ODER_ZERTIFIKATS_OBJEKTE_DIESE_ZUERST_ENTFERNEN": "The host still has VPN, certificate or ACME objects on the firewall. Remove them first or they will remain active and unmanaged.",
    "HOST_IST_DEAKTIVIERT": "Host is disabled",
    "HOST_MIT_DIESEM_NAMEN_EXISTIERT_BEREITS": "A host with this name already exists",
    "HOST_MUSS_ERREICHBAR_SEIN_UND_FIRMWARE_AUFTRAG_BEENDET_BCE1390B": "The host must be reachable and the firmware job must be finished",
    "HOST_NICHT_GEFUNDEN": "Host not found",
    "HOST_REQUEST_FAILED": "Request to host “{host}” failed",
    "INSTANZ_HAT_KEINE_ZIEL_HOSTS": "The instance has no target hosts",
    "INSTANZ_NICHT_GEFUNDEN": "Instance not found",
    "INSTANZ_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_DB923B59": "The instance changed in the meantime. Reload and review the changes again.",
    "INTERFACE_MEANING_DIFFERS": "Interface “{interface}” does not represent the same network on all targets ({detail}). Correct the rule or restrict its targets before pushing.",
    "KEINE_OFFENE_WARTUNGSAKTION": "No open maintenance action",
    "KEIN_OFFENER_RESTORE_VORSCHAU_VORGANG": "No open restore preview operation",
    "KEIN_OFFENER_UEBERGEBENER_RESTORE_VORGANG": "No open handed-off restore operation",
    "MAINTENANCE_WAIT_REQUIRED": "The maintenance job was just submitted. Wait at least {seconds} seconds.",
    "MINDESTENS_EINE_REGEL_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_932925BD": "At least one rule changed in the meantime. Reload and reorder the list.",
    "MINDESTENS_EIN_ADMIN_ACCOUNT_MUSS_BESTEHEN_BLEIBEN": "At least one admin account must remain",
    "NICHT_AUTHENTIFIZIERT": "Not authenticated",
    "NORMALBETRIEB_NOCH_NICHT_BESTAETIGT_WARTUNGSMODUS_MUSS_AUS_UND_8AF9290B": "Normal operation not confirmed: maintenance mode must be off and MASTER/BACKUP must be healthy",
    "NUR_AUSSTEHENDE_GEPLANTE_WARTUNGEN_KOENNEN_ABGEBROCHEN_WERDEN": "Only pending scheduled maintenance can be cancelled",
    "NUR_FRUEHERE_AKTIVE_ZIELE_KOENNEN_BEREINIGT_WERDEN": "Only previous active targets can be cleaned up",
    "NUR_FRUEHERE_AKTIVE_ZIELE_OHNE_OFFENEN_ROLLBACK_KOENNEN_06DE0ADB": "Only previous active targets without an open rollback can be cleaned up",
    "OFFENES_DEPLOYMENT_ZUERST_BESTAETIGEN_ODER_ROLLBACK_KLAEREN": "Confirm the open deployment or resolve its rollback first",
    "OFFENES_DEPLOYMENT_ZUERST_KLAEREN": "Resolve the open deployment first",
    "ORDERING_FAILED": "The ordering could not be established everywhere: {reason}",
    "OUTBOUND_NAT_REGEL_NICHT_GEFUNDEN": "Outbound NAT rule not found",
    "PEER_PRE_SHARED_KEY_IST_AKTIVIERT_ABER_ES_FCFAC129": "Peer pre-shared key is enabled, but no key material has been stored",
    "POLICY_HIERARCHIE_GRUPPE_NICHT_GEFUNDEN": "Policy hierarchy group not found",
    "PORT_FORWARD_REGEL_NICHT_GEFUNDEN": "Port-forward rule not found",
    "REGELLISTE_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_ERNEUT_529D7203": "The rule list changed in the meantime. Reload and reorder it.",
    "REGEL_HAT_KEINE_ZIEL_HOSTS": "The rule has no target hosts",
    "REGEL_NICHT_GEFUNDEN": "Rule not found",
    "REGEL_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_BF51B6B0": "The rule changed in the meantime. Reload and review the changes again.",
    "RESTORE_VORGANG_NICHT_GEFUNDEN": "Restore operation not found",
    "ROLLBACK_ERNEUT_FEHLGESCHLAGEN_PRUEFE_DIE_ERREICHBARKEIT_DER_FIREWALL": "Rollback failed again. Check whether the firewall is reachable.",
    "ROLLENWECHSEL_NOCH_NICHT_BESTAETIGT_DIESER_HOST_MUSS_IM_4676309B": "Role switch not confirmed: this host must be BACKUP in maintenance mode and its peer must be MASTER",
    "RULEBASE_NICHT_GEFUNDEN": "Rulebase not found",
    "SICHERUNG_NICHT_GEFUNDEN": "Backup not found",
    "SICHERUNG_WURDE_SEIT_DER_VORSCHAU_VERAENDERT_ODER_IST_2732C4DD": "The backup changed or disappeared after the preview. Open the preview again.",
    "TLS_HARDENING_IST_AKTIVIERT_ABER_ES_WURDE_NOCH_F53C81DD": "TLS hardening is enabled, but no key material has been stored",
    "TOO_MANY_LOGIN_ATTEMPTS": "Too many failed attempts. Try again in {wait} seconds.",
    "TUNNEL_HAT_KEINE_ZIEL_HOSTS": "The tunnel has no target hosts",
    "TUNNEL_NICHT_GEFUNDEN": "Tunnel not found",
    "TUNNEL_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_50830F70": "The tunnel changed in the meantime. Reload and review the changes again.",
    "UEBERGEORDNETE_GRUPPE_NICHT_GEFUNDEN": "Parent group not found",
    "UNGUELTIGER_BENUTZERNAME_ODER_PASSWORT": "Invalid username or password",
    "UPSTREAM_REQUEST_FAILED": "Request to the target service failed",
    "VERKNUEPFTER_ACME_ACCOUNT_NICHT_GEFUNDEN": "Linked ACME account not found",
    "VORGANG_KANN_NICHT_MEHR_ABGEBROCHEN_WERDEN": "The operation can no longer be cancelled",
    "VORSCHAU_ABGELAUFEN_BITTE_ERNEUT_OEFFNEN": "The preview expired. Open it again.",
    "VORSCHAU_ABGELAUFEN_ODER_BEREITS_VERWENDET": "The preview expired or has already been used",
    "WARTUNGSAKTION_NICHT_GEFUNDEN": "Maintenance action not found",
    "WARTUNGSVORSCHAU_NICHT_GEFUNDEN": "Maintenance preview not found",
    "ZEITPUNKT_MUSS_IN_DER_ZUKUNFT_LIEGEN": "The time must be in the future",
    "ZERTIFIKATSANFRAGE_MUSS_ZUERST_AUF_DIE_FIREWALL_GESCHRIEBEN_WERDEN_F684C449": "The certificate request must be pushed to the firewall first",
    "ZERTIFIKATSANFRAGE_NICHT_GEFUNDEN": "Certificate request not found",
    "ZERTIFIKATSANFRAGE_WURDE_NOCH_NICHT_AUF_DIE_FIREWALL_GESCHRIEBEN": "The certificate request has not been pushed to the firewall yet",
    "ZERTIFIKAT_NICHT_GEFUNDEN": "Certificate not found",
    "ZIELE_ODER_DEPLOYMENT_WURDEN_GEAENDERT_VORSCHAU_AKTUALISIEREN": "The targets or deployment changed. Refresh the preview.",
    "ZIEL_HOST_NICHT_GEFUNDEN": "Target host not found",
    "OUTBOUND_MODE_UNREADABLE": "Outbound mode on {host} not readable: {reason}",
    "INVALID_CHARACTERS": "The input contains a character that cannot be stored (e.g. a NUL character)",
    "UPSTREAM_REJECTED": "The firewall rejected the request: {reason}",
    "SERVICE_NOT_FOUND": "{service}: service not found on this firewall",
    "SERVICE_LOCKED": "{service}: service is locked and cannot be controlled via the API",
    "OUTBOUND_MODE_BLOCKS_PUSH": "{host}: outbound NAT mode “{mode}” does not allow a push. Switch the mode to Hybrid/Manual in OPNsense itself. OPNexus does not change this mode.",
    "GROUP_CANNOT_BE_OWN_PARENT": "A group cannot be its own parent",
    "GROUP_HIERARCHY_CYCLE": "This assignment would create a cycle in the group hierarchy",
    "OPEN_DEPLOYMENT_DRAFT_UNCHANGED": "Resolve the open confirmation or failed rollback first; the draft remains unchanged",
    "OPEN_HOST_MAINTENANCE_BLOCKS_DEPLOY": "Check and complete the open host maintenance before deploying rules.",
    "OPEN_RESTORE_BLOCKS_DEPLOY": "A restore is open for this host. Please confirm or cancel it first.",
    "READ_ONLY_ACCESS": "Read-only access: this action requires the “Admin” role.",
    "CROSS_ORIGIN_BLOCKED": "Request from a foreign origin blocked",
    "TLS_PROBE_FAILED": "The firewall's certificate could not be retrieved",
    "TLS_PEM_INVALID": "Not a valid PEM certificate",
    "TLS_PIN_MISMATCH": "The firewall presents a different certificate than the pinned one",
    "TOTP_REQUIRED": "Two-factor code required",
    "TOTP_INVALID": "Invalid two-factor code",
    "TOTP_ALREADY_ENABLED": "Two-factor authentication is already enabled",
    "TOTP_NOT_ENABLED": "Two-factor authentication is not enabled",
    "TOTP_SETUP_MISSING": "No setup has been started",
    "RULE_NOT_ADOPTABLE": "This rule cannot be adopted ({reasons})",
    "NETWORK_ACK_REQUIRED": "This change can cut the connection to the firewall and must be confirmed explicitly ({reasons})",
    "NETWORK_APPLY_UNCERTAIN": "The change was written, but applying it on “{host}” failed or is unclear. Check the firewall; backup: {backup_id}",
    "NETWORK_BACKUP_FAILED": "Backup of “{host}” before the change failed – nothing was changed",
    "NETWORK_CHANGE_BLOCKED": "The change is not possible ({reasons})",
    "NETWORK_FIELD_INVALID": "Invalid field: {field}",
    "NETWORK_ITEM_NOT_FOUND": "The object does not exist on the firewall (any more)",
    "UPDATER_UNAVAILABLE": "The updater is not enabled or not reachable.",
    "UPDATER_BUSY": "An update or rollback is already running.",
    "UPDATER_REJECTED": "The updater rejected the request ({reason}).",
    "UPDATE_NOT_OFFERED": "This version is not offered for installation — only the latest stable version.",
    "UPDATE_MAJOR_CHANGE": "Please run major version jumps deliberately on the server with “opnexus update”.",
    "ADMIN_REQUIRED": "This function requires the “Admin” role.",
    "API_TOKEN_LIMIT_REACHED": "At most {limit} API tokens are allowed per user. Revoke tokens you no longer need first.",
    "BACKUP_UNLESBAR": "The backup cannot be read: {reason}",
    "DEPLOY_NEEDS_ADMIN": "Only an administrator may roll out here (separation of duties). Prepare the change and have it approved.",
    "OVERLAY_INVALID": "Invalid value: {reason}",
    "OVERLAY_SUBNET_LOCKED": "The overlay network cannot be changed while firewalls are registered. Delete the entries first.",
    "OVERLAY_NAME_TAKEN": "This name is already taken.",
    "OVERLAY_PEER_NOT_FOUND": "Overlay entry not found",
    "VARIABLES_MISSING": "Values for variables are missing: {details}. Enter them on the host page under “Variables”.",
    "VARIABLE_INVALID": "Invalid variable: {reason}",
    "OIDC_TEST_FAILED": "The identity provider test failed: {reason}",
    "OIDC_MANAGED_USER": "This account is managed by single sign-on: change role and password at the identity provider.",
    "OFFSITE_TEST_FAILED": "The offsite target test failed: {reason}",
    "API_TOKEN_NOT_FOUND": "API token not found",
    "API_TOKEN_SCOPE_FORBIDDEN": "This API token (scope “{scope}”) is not allowed to perform this action.",
    "API_TOKEN_SCOPE_TOO_HIGH": "Your role does not allow a token with this scope (read-only: read, operator: up to deploy)."
  },
  "workflow": {
    "attention": "Check errors",
    "pending": "Confirmation pending",
    "cleanup": "Review former targets",
    "unassigned": "Targets missing",
    "disabled": "Target hosts disabled",
    "draft": "Changes pending",
    "synced": "Deployed",
    "tooltip": "State of the deployments stored by OPNexus; not a live comparison"
  },
  "certStatus": {
    "expired": "Expired",
    "expiring_soon": "Expiring soon",
    "valid": "Valid",
    "unknown": "Unknown"
  },
  "outboundModes": {
    "title": "Outbound mode of the firewalls",
    "refresh": "Refresh mode",
    "unavailable": "Unavailable",
    "pushBlocked": " · Push blocked",
    "hint": "Manual rules only take effect in Hybrid/Manual mode. You can only change the mode in OPNsense itself; it is re-checked before every push."
  },
  "liveNat": {
    "firewallSelect": "Firewall for live NAT view",
    "description": "Current firewall state, read-only. Automatic OPNsense rules are shown separately.",
    "noEntries": "No entries.",
    "configured": "Configured rules ({count})",
    "automatic": "Automatic rules · read-only ({count})",
    "noDescription": "(no description)"
  },
  "hostResource": {
    "loadFailed": "Could not load usage data",
    "title": "System usage (24h)",
    "empty": "No measurements yet. Recording runs in the background every 60 seconds.",
    "cpu": "CPU load (1 min)",
    "memory": "Memory",
    "disk": "Disk (/)"
  },
  "loginBanner": {
    "failedOne": "{count} failed login attempt since your last sign-in.",
    "failedMany": "{count} failed login attempts since your last sign-in.",
    "lastLogin": "Last sign-in: {time}",
    "fromIp": " from {ip}",
    "welcome": "Welcome, {username}.",
    "sessionUntil": "Session valid until {time}."
  },
  "updateBanner": {
    "title": "OPNexus {latest} is available (installed: {current}).",
    "notes": "Release notes",
    "how": "Update in the settings or on the server with “opnexus update”.",
    "dismiss": "Hide this notice for this version",
    "settings": "Go to settings"
  },
  "acme": {
    "externalCaWarning": "Contacts the real certificate authority (e.g. Let's Encrypt) over the internet — not a purely local change. Counts against its rate limits (e.g. issuances per domain per week). Use a *_test CA (e.g. letsencrypt_test) for testing.",
    "actionFailed": "Action failed",
    "warningUnderstood": "Warning understood — continue",
    "areYouSure": "Are you sure? “{action}” will be executed now.",
    "yes": "Yes, {action}"
  },
  "hostServices": {
    "loadFailed": "Could not load services",
    "actionFailed": "Action failed",
    "confirm": "Really {verb} service “{name}”? This may briefly affect connectivity or other functions of this host.",
    "verb": {
      "start": "start",
      "stop": "stop",
      "restart": "restart"
    },
    "done": "Service “{name}” {result}",
    "result": {
      "start": "started",
      "stop": "stopped",
      "restart": "restarted"
    },
    "title": "Services",
    "empty": "No services reported.",
    "service": "Service",
    "description": "Description",
    "status": "Status",
    "running": "running",
    "stopped": "stopped",
    "locked": "Locked by OPNsense",
    "startTitle": "Start",
    "stopTitle": "Stop",
    "restartTitle": "Restart"
  },
  "acmeAccount": {
    "caCustom": "Custom CA URL",
    "edit": "Edit ACME account",
    "new": "New ACME account",
    "localNote": "Creating and saving is a purely local configuration change with no external contact. Only the separate “Register” action contacts the certificate authority.",
    "host": "Host",
    "name": "Name",
    "description": "Description",
    "email": "Email",
    "ca": "Certificate authority",
    "customCaUrl": "Custom CA URL",
    "eabKid": "EAB key ID (optional)",
    "eabHmacKeep": "EAB HMAC — leave empty = unchanged",
    "eabHmac": "EAB HMAC (optional)",
    "active": "Account active"
  },
  "review": {
    "actions": {
      "create": "Create new",
      "update": "Change",
      "unchanged": "Unchanged",
      "disabled": "Disabled · skipped",
      "retained": "Former target · stays in place",
      "missing_variable": "Variable missing · skipped",
      "missing_cert": "No certificate/CA selected · skipped"
    },
    "loadFailed": "Loading failed",
    "pushFailed": "Push failed",
    "actionFailed": "Action failed",
    "previewTitle": "Review & deploy changes",
    "reload": "Reload",
    "removeFromHost": "Remove from this host",
    "retryRollback": "Retry rollback",
    "actionsRequireHost": "For actions, the host must be enabled and any open deployment must be resolved.",
    "viewHost": "View host",
    "colField": "Field",
    "colBefore": "Before",
    "colDraft": "Draft",
    "pushInfo": "Push applies the changes. You must then confirm them within the displayed window, otherwise OPNexus tries to restore the previous state.",
    "allInSync": "All active targets match the saved draft. No push necessary.",
    "pushing": "Push running…",
    "deployNow": "Deploy now",
    "version": "Version {n}",
    "adoptAsDraft": "Adopt as draft",
    "assignTargets": "Assign targets",
    "rollbackDone": "Rollback on {host} succeeded.",
    "historyHint": "An earlier version is loaded into the edit form. Save first, then review and deploy the changes.",
    "rule": {
      "deployed": "Rule “{name}” deployed",
      "removeConfirm": "Remove rule “{name}” from “{host}” only? The change is applied immediately and has no automatic rollback.",
      "rollbackConfirm": "Restore the previous rule state on “{host}” again?",
      "removed": "Rule removed from {host}.",
      "historyTitle": "Rule history",
      "noTargets": "No target hosts. Assign hosts or a device group to the rule.",
      "noHistory": "For this existing rule, history is recorded from the first edit onwards."
    },
    "alias": {
      "deployed": "Alias “{name}” deployed",
      "removeConfirm": "Remove alias “{name}” from “{host}” only? The change is applied immediately and has no automatic rollback.",
      "rollbackConfirm": "Restore the previous alias state on “{host}” again?",
      "removed": "Alias removed from {host}.",
      "historyTitle": "Alias history",
      "noTargets": "No target hosts. Assign hosts or a device group to the alias.",
      "noHistory": "For this existing alias, history is recorded from the first edit onwards.",
      "pushInfo": "Push applies the changes. You must then confirm them within the displayed window, otherwise OPNexus tries to restore the previous state — every rule that uses this alias is already affected until then."
    },
    "tunnel": {
      "deployed": "Tunnel “{name}” deployed",
      "removeConfirm": "Remove tunnel “{name}” from “{host}” only? The change is applied immediately and has no automatic rollback.",
      "removed": "Tunnel removed from {host}.",
      "historyTitle": "Tunnel history",
      "noTargets": "No target hosts. Assign hosts or a device group to the tunnel.",
      "noHistory": "For this existing tunnel, history is recorded from the first edit onwards."
    },
    "instance": {
      "deployed": "Instance “{name}” deployed",
      "removeConfirm": "Remove instance “{name}” from “{host}” only? The change is applied immediately and has no automatic rollback.",
      "removed": "Instance removed from {host}.",
      "historyTitle": "Instance history",
      "noTargets": "No target hosts. Assign hosts or a device group to the instance.",
      "noHistory": "For this existing instance, history is recorded from the first edit onwards."
    },
    "historyHintGroups": "An earlier version is loaded into the edit form. Save first, then review and deploy the changes. Group memberships are resolved at push time.",
    "armWarning": "Warning understood — prepare push",
    "armSure": "Are you sure? Config write and service reload happen in a single step, with no possibility of an automatic rollback.",
    "yesDeploy": "Yes, deploy now",
    "hierarchy": {
      "noTargets": "No target hosts. Assign hosts to this rule's group (directly or via a subgroup).",
      "editRule": "Edit rule",
      "pushInfo": "Push applies the changes and then restores the pre/post ordering on every affected host. You must then confirm within the displayed window, otherwise OPNexus tries to restore the previous state."
    },
    "historyHintPsk": "An earlier version is loaded into the edit form (the pre-shared key itself is never part of the history — only whether one was set). Save first, then review and deploy the changes.",
    "historyHintStaticKey": "An earlier version is loaded into the edit form (the static key material itself is never part of the history — only whether any was set). Save first, then review and deploy the changes.",
    "historyHintKeys": "An earlier version is loaded into the edit form (key material itself is never part of the history — only whether it was set). Save first, then review and deploy the changes.",
    "originalPort": "original port",
    "outboundMode": "{host}: outbound mode {mode}",
    "outboundBlocked": " – push blocked. Switch to Hybrid/Manual in OPNsense.",
    "historyTitle": "Version history",
    "pushShort": "Confirm within the time limit after pushing, otherwise an automatic rollback follows."
  },
  "fields": {
    "description": "Description",
    "enabled": "Active",
    "action": "Action",
    "interface": "Interface",
    "direction": "Direction",
    "ipprotocol": "IP version",
    "protocol": "Protocol",
    "source_net": "Source",
    "source_port": "Source port",
    "destination_net": "Destination",
    "destination_port": "Destination port",
    "quick": "Quick",
    "log": "Logging",
    "name": "Name",
    "type": "Type",
    "content": "Content"
  },
  "carp": {
    "peerInMaintenance": "{peer} is already in CARP maintenance mode. Click “Restore CARP normal operation” there first instead of switching again here.",
    "previewFailed": "CARP preview failed",
    "outcomeUnclear": "CARP outcome unclear. Check the roles and do not click again.",
    "switchToPartner": "Switch CARP to partner",
    "restoreNormal": "Restore CARP normal operation",
    "trafficHandover": "Traffic handover",
    "leaveMaintenance": "Leave maintenance mode",
    "enterDescription": "{host} will be demoted persistently. The reachable BACKUP partner should take over the virtual IPs as MASTER.",
    "leaveDescription": "{host} leaves persistent CARP maintenance mode. The normal CARP election may shift the roles, and with them the active traffic, again.",
    "previewValid": "Preview valid until {time}. After a timeout, never retry blindly: check both CARP roles first.",
    "autoRevertRunning": "Already running with an automatic switch-back at {time}.",
    "autoRevertAfter": "Switch back automatically after",
    "minutes": "{n} minutes",
    "never": "Never (permanent, as before)",
    "autoRevertHint": "Safety net against a forgotten maintenance mode — switches back to normal operation automatically unless ended manually before.",
    "confirmHostname": "Enter the host name to confirm",
    "confirmHostnameAria": "Confirm host name for CARP",
    "ackEnter": "The BACKUP partner is updated and tested. ",
    "ackLeave": "Both nodes are updated and tested. ",
    "ackCommon": "I have checked reachability, console access and the expected target MASTER; a brief traffic interruption is accepted.",
    "executeEnter": "Perform role switch now",
    "executeLeave": "Restore normal operation now",
    "handoverShort": "{host} hands MASTER over to the partner",
    "leaveShort": "The normal CARP election decides the roles again",
    "expectedRole": "expected role",
    "previewValidShort": "Preview valid until {time}",
    "previewValidTip": "After a timeout never retry blindly: check both CARP roles first.",
    "ackEnterShort": "Partner is updated and tested; console access and a brief interruption are planned for.",
    "ackLeaveShort": "Both nodes are updated and tested; console access and a brief interruption are planned for."
  },
  "maint": {
    "action": {
      "reboot": "Reboot",
      "update": "Firmware update",
      "major_update": "Major upgrade",
      "carp_enter": "CARP handover",
      "carp_leave": "CARP normal operation"
    },
    "reason": {
      "haOrder": "HA order: this host is MASTER. Update the BACKUP first, then switch the roles with “Switch CARP to partner”.",
      "backupRequired": "Backup required: create a local backup that is at most 24 hours old before installing.",
      "noStableUpdate": "No stable package update reported. Run the update check.",
      "noMajorUpgrade": "No major upgrade reported. Run the update check.",
      "haPartnerNotReady": "HA partner not ready: the other node must be online and CARP MASTER."
    },
    "loadFailed": "Loading failed",
    "scheduleFailed": "Scheduling failed",
    "cancelFailed": "Cancelling failed",
    "previewFailed": "Preview failed",
    "outcomeUnclear": "Outcome unclear. Check the maintenance status.",
    "finishFailed": "Completion failed",
    "checkFailed": "Update check failed",
    "logFailed": "Log not readable",
    "jobSubmitted": "Job submitted.",
    "checkRequested": "Update check requested. Refresh the status after a short while.",
    "title": "Host maintenance",
    "close": "Close maintenance",
    "open": "Open maintenance",
    "intro": "Reboot and stable firmware update apply to this host. In clusters the CARP BACKUP is updated first; the safeguarded role switch can then be performed directly here.",
    "installed": "Installed: {version}",
    "firmwareJob": "Firmware job: {state}",
    "lastCheck": "Last update check: {value}",
    "unknown": "unknown",
    "backup": "Backup: {value}",
    "noBackup": "none",
    "checkUpdates": "Check for updates",
    "previewReboot": "Review reboot",
    "previewUpdate": "Review update",
    "previewMajor": "Review major upgrade",
    "scheduleLater": "Run later…",
    "refreshStatus": "Refresh status",
    "hints": "Notes",
    "scheduled": "Scheduled maintenance",
    "scheduleStatus": {
      "pending": "pending",
      "running": "running",
      "succeeded": "submitted",
      "cancelled": "cancelled",
      "failed": "failed",
      "completed": "completed"
    },
    "history": "History",
    "opStatus": {
      "acknowledged": "completed manually",
      "cancelled": "cancelled",
      "unknown": "Outcome unclear",
      "starting": "Handover started",
      "submitted": "Submitted to firewall"
    },
    "confirmFinish": "Confirm completion",
    "cancelOperation": "Cancel operation",
    "readLog": "Read update log",
    "confirmTitle": "Confirm {action}",
    "majorWarning": "Major upgrade: switch to a new major version. Takes longer and is riskier than a plain package update, possibly with larger behaviour changes. Have a fresh backup and console access ready.",
    "downtimeNote": "The host will be temporarily unreachable. Ongoing connections may drop{reboot}. There is no automatic rollback for this maintenance action.",
    "andReboot": " and the update requires a reboot",
    "previewValid": "Preview valid until {time}.",
    "confirmHostname": "Enter the host name to confirm",
    "confirmHostnameAria": "Confirm host name",
    "windowReady": "Maintenance window and console access are ready; I accept the interruption.",
    "submitting": "Submitting…",
    "executeNow": "Run {action} now",
    "finishCarpTitle": "Complete CARP role switch",
    "finishTitle": "Complete maintenance",
    "finishCarpCheck": "Check the CARP roles and reachability of both cluster nodes. ",
    "finishCheckPre": "Check reachability, version and services on ",
    "finishNote": "This confirmation documents your check; it does not trigger any firewall action.",
    "finishHostnameAria": "Confirm host name for completion",
    "finishChecked": "I have verified the completion on the firewall.",
    "saveFinish": "Save verified completion",
    "cancelWarnPre": "This does ",
    "cancelWarnStrong": "not confirm",
    "cancelWarnPost": " a successful completion — it only closes the record so the host/cluster is no longer locked. Use this only if the expected state demonstrably never occurred (e.g. a CARP role switch is stuck).",
    "cancelHostnameAria": "Confirm host name to cancel",
    "reasonLabel": "Reason (for the audit log)",
    "reasonPlaceholder": "e.g. CARP role switch did not happen after several minutes",
    "closeWithoutConfirm": "Close operation without confirmation",
    "scheduleTitle": "Run maintenance later",
    "actionLabel": "Action",
    "timeLabel": "Time",
    "unattendedWarning": "Runs unattended at the chosen time. For updates, OPNexus takes a configuration backup itself right before. The other prerequisites are only re-checked then — if one is not met, the action is not executed and is marked as failed, without a retry.",
    "unattendedAck": "I understand that nobody will be present when the action runs.",
    "scheduling": "Scheduling…",
    "scheduleIt": "Schedule maintenance",
    "unattendedShort": "Runs unattended at the chosen time",
    "scheduleMasterBlocked": "This firewall is currently the CARP MASTER. Scheduled maintenance only runs on the BACKUP node, otherwise traffic would drop. Schedule the partner node instead, or enable CARP maintenance mode on this host first.",
    "handoverOption": "Switch to the partner first and switch back afterwards (CARP)",
    "handoverHint": "Flow: maintenance mode on this host, the partner becomes MASTER (verified), then the action runs, and once the host is back the maintenance mode is left again. If anything goes wrong the partner stays MASTER and a notification is sent. When switching back, the host may take the MASTER role back depending on the CARP settings (a short second switchover).",
    "handoverBadge": "with CARP switchover",
    "phase": {"handover_wait": "waiting for the partner to take over", "job_wait": "job running", "leave": "switching back", "leave_wait": "verifying normal operation"}
  },
  "restore": {
    "handoffWarning": "OPNexus does NOT perform the restore itself. After the handover you must import the backup manually in the OPNsense web interface. While this operation is open, rule/alias/NAT pushes and host maintenance are blocked for this host.",
    "previewFailed": "Preview failed",
    "handoffFailed": "Handover failed",
    "confirmFailed": "Confirmation failed",
    "cancelFailed": "Cancelling failed",
    "title": "Restore",
    "hostBackup": "{host} · backup {backup}",
    "checking": "Checking backup…",
    "hostname": "Hostname",
    "domain": "Domain",
    "unknown": "unknown",
    "haSync": "HA sync",
    "active": "active",
    "inactive": "not active",
    "secretFields": "Secret fields",
    "secretsFound": "{count} found, not shown",
    "understood": "Warning understood — prepare handover",
    "typeHostname": "Enter host name “{host}” to confirm",
    "back": "Back",
    "handingOff": "Handover in progress…",
    "yesHandoff": "Yes, hand over now",
    "noteOptional": "Note (optional)",
    "cancel": "Cancel restore",
    "confirming": "Confirming…",
    "confirm": "Confirm restore",
    "cancelled": "Restore cancelled.",
    "typeHostnameAria": "Enter the host name to confirm"
  },
  "certAction": {
    "import": "Import (certificate + optional key)",
    "internal": "Create internally (self-signed or CA-signed)",
    "external": "Create CSR (to be signed externally)",
    "sign_csr": "Sign CSR with an existing internal CA",
    "import_csr": "Import signed certificate",
    "reissue": "Reissue (no service restart)",
    "manual": "Manual (paste text only)"
  },
  "certForm": {
    "edit": "Edit certificate",
    "new": "New trust store certificate",
    "host": "Host",
    "action": "Action",
    "description": "Description",
    "commonName": "Common name",
    "country": "Country (ISO code)",
    "state": "State / province",
    "city": "City",
    "organization": "Organization",
    "email": "Email",
    "keyType": "Key type",
    "digest": "Digest",
    "lifetime": "Validity (days)",
    "carefRequired": "CA reference (caref) — required",
    "carefOptional": "CA reference (caref) — empty = self-signed",
    "carefPlaceholder": "Refid of an existing internal CA on this host",
    "carefChoose": "Please choose",
    "carefSelfSigned": "Self-signed (no CA)",
    "csr": "CSR (PEM)",
    "certificate": "Certificate (PEM)",
    "privateKeyKeep": "Private key (PEM) — leave empty = unchanged",
    "privateKeyOptional": "Private key (PEM, optional)",
    "privateKeyAria": "Private key (PEM)",
    "privateKeyNote": "Never stored in the database, only as a file on the OPNexus server (accessible only to the server process, mode 0600)."
  },
  "acmeRequest": {
    "edit": "Edit ACME certificate request",
    "new": "New ACME certificate request",
    "localNote": "Creating and saving is a purely local configuration change. Only the separate “Issue now” action contacts the certificate authority.",
    "account": "ACME account",
    "chooseAccount": "Choose account…",
    "noAccount": "No ACME account exists for this host yet — create one first.",
    "commonName": "Common name / FQDN",
    "altNames": "Alternative names (comma-separated, optional)",
    "validation": "Validation method (UUID — configured in OPNsense itself under ACME Client > Validation)",
    "validationPlaceholder": "UUID of the validation method on this host",
    "keyLength": "Key length",
    "renewInterval": "Renewal after (days since last issuance)",
    "renewWarning": "Note: days SINCE the last issuance, not days BEFORE expiry.",
    "ocsp": "OCSP Must-Staple",
    "autoRenewal": "Automatic renewal (OPNsense's own cron)",
    "active": "Active"
  },
  "drift": {
    "loadRulesFailed": "Could not load live rules",
    "noHosts": "No hosts yet.",
    "onlyDiffs": "Show differences only",
    "comparingRules": "Comparing rules from {count} hosts…",
    "rulesTotal": "{count} rules in total",
    "someDiffer": ", {count} differ",
    "allIdentical": ", all identical on all hosts",
    "noDiffs": "No differences found.",
    "noRules": "No rules found.",
    "colDescription": "Description",
    "colInterface": "Interface",
    "colSourceDest": "Source → destination",
    "colAction": "Action",
    "automatic": "(automatic)",
    "noCluster": "No cluster",
    "noClusterHint": "No drift detection without a comparison host — view rules individually:",
    "loadAliasesFailed": "Could not load live aliases",
    "comparingAliases": "Comparing aliases from {count} hosts…",
    "aliasesIdentical": "{same} of {total} aliases identical on all hosts",
    "noAliases": "No aliases found.",
    "colName": "Name",
    "colType": "Type",
    "empty": "(empty)",
    "noClusterAliasesHint": "No drift detection without a comparison host — view aliases individually:",
    "loadNatFailed": "Could not load live NAT",
    "comparing": "comparing…",
    "natIdentical": "{same} of {total} identical on all hosts",
    "noClusterNatHint": "No drift detection without a comparison host — view NAT rules individually:"
  },
  "palette": {
    "category": {
      "navigation": "Pages",
      "hosts": "Hosts",
      "rules": "Rules",
      "aliases": "Aliases",
      "nat": "NAT",
      "vpn": "VPN",
      "certificates": "Certificates",
      "groups": "Groups",
      "policy-hierarchy": "Policy hierarchy"
    },
    "dialog": "Search",
    "placeholder": "Search pages, hosts, rules, aliases, NAT, VPN …",
    "noResults": "No results"
  },
  "nat": {
    "liveTab": "Live on firewall",
    "externalNet": "External network (IP/CIDR)",
    "reflectionDefault": "System default",
    "reflectionEnabled": "Enabled",
    "reflectionDisabled": "Disabled",
    "invertSource": " Invert source",
    "invertDestination": " Invert destination",
    "type": "NAT type",
    "binat": "BINAT · bidirectional",
    "natOutbound": "NAT · outbound",
    "hierarchyHint": "The NAT rule additionally applies to all current and future hosts in the subtree.",
    "protocol": "Protocol",
    "sourcePortOptional": "Source port (optional)",
    "destinationPortOptional": "Destination port (optional)",
    "ipVersion": "IP version",
    "translationTarget": "Translation target (IP or alias)",
    "translationTargetOptional": "Translation target (empty = interface address)",
    "translatedPort": "Translated port",
    "filterRuleNote": "A matching filter rule must exist separately. Port forward does not create it automatically.",
    "loading": "Loading NAT…",
    "liveDrift": "Live drift",
    "filterRuleShort": "Create the filter rule separately"
  },
  "groups": {
    "loading": "Loading groups…",
    "loadFailed": "Could not load groups",
    "deleteConfirm": "Delete device group “{name}”? The hosts are kept.",
    "deleted": "Device group “{name}” deleted",
    "title": "Device groups",
    "titleNamed": "Device groups · {name}",
    "new": "New group",
    "subtitle": "Shared policies for sites, environments or functions. A host can belong to several groups. HA clusters remain independent of this.",
    "statGroups": "Device groups",
    "statHosts": "Assigned hosts",
    "statRules": "Rules with group targets",
    "statAliases": "Aliases with group targets",
    "savedNote": "Group “{name}” saved. ",
    "checkRules": "Review or create related rules →",
    "showAll": "Show all groups",
    "searchLabel": "Search groups",
    "searchPlaceholder": "Search groups …",
    "emptyTitle": "Shared rules start with a group",
    "emptyText": "For example, create “Sites” or “Data center” and pick the matching firewalls.",
    "createFirst": "Create first group",
    "noMatch": "No group matches your search.",
    "resetSearch": "Reset search",
    "editAria": "Edit {name}",
    "deleteAria": "Delete {name}",
    "deleteInUse": "Remove the rule/alias assignments first",
    "deleteTitle": "Delete group",
    "assignHosts": "Assign hosts",
    "centralRules": "{count} central rules →",
    "onlyHosts": "So far the group only bundles hosts. Assign a central rule to it now.",
    "createRule": "Create rule for this group",
    "centralAliases": "{count} central aliases →",
    "createAlias": "Create alias for this group",
    "editTitle": "Edit device group",
    "newTitle": "New device group",
    "namePlaceholder": "e.g. Branch offices",
    "descPlaceholder": "Shared base rules for all sites",
    "members": "Members",
    "disabled": "(disabled)",
    "createHostsFirst": "Create hosts first.",
    "membershipNote": "Memberships take effect at the next push. Saving does not change any firewall. Rules that are already deployed remain on removed members.",
    "impactTitle": "Impact on central rules",
    "added": "Added: {names}",
    "removed": "Removed: {names}",
    "noMembers": "no members",
    "impactEmpty": "No rules or aliases are assigned to the group yet. The change only affects its members and description.",
    "newRuleTargets": "{added} new rule targets · {removed} removed rule targets",
    "retainedCopies": "{count} already deployed copies remain. After saving, clean them up selectively under “Review & push”.",
    "aliasPrefix": "Alias: {name}",
    "newTargets": "{added} new targets · {removed} removed targets",
    "natPrefix": "NAT: {name}",
    "natRetained": "{count} deployed copies remain. Clean them up selectively under NAT.",
    "otherGroupNote": "Hosts that remain a target of the same rule through another group or directly are not counted as removed rule targets.",
    "changeSelection": "Change selection",
    "wait": "Please wait…",
    "checkImpact": "Review impact",
    "save": "Save group"
  },
  "aliases": {
    "loading": "Loading aliases…",
    "loadFailed": "Could not load aliases",
    "createFailed": "Could not create alias",
    "deleteConfirm": "Really delete this alias? It will also be removed from all target hosts.",
    "deletedNamed": "Alias “{name}” deleted",
    "deleted": "Alias deleted",
    "title": "Firewall aliases",
    "titleNamed": "Aliases · {name}",
    "showAll": "Show all aliases",
    "new": "New alias",
    "subtitle": "Centrally managed objects (hosts, networks, ports) — maintain once, deploy to several firewalls instead of keeping each one in sync individually.",
    "searchLabel": "Search aliases",
    "searchPlaceholder": "Name, description, content …",
    "none": "No central aliases created yet.",
    "noMatch": "No aliases match this selection.",
    "createFirst": "Create first alias",
    "empty": "(empty)",
    "disabledSuffix": " · alias disabled",
    "historyTitle": "Alias history",
    "duplicateTitle": "Duplicate alias",
    "editDraft": "Edit alias draft",
    "nameHint": "Letters, digits and underscores only",
    "typeLabel": "Type",
    "content": "Content",
    "active": "Alias active",
    "hierarchyHint": "The alias is additionally deployed to all current and future hosts in the subtree.",
    "coveredBy": "(already covered via {groups})",
    "type": {
      "host": "Host(s)",
      "network": "Network(s)",
      "port": "Port(s)",
      "networkgroup": "Network group",
      "mac": "MAC address(es)",
      "asn": "BGP ASN(s)"
    },
    "hint": {
      "host": "One IP or host name per line",
      "network": "One CIDR per line, e.g. 10.10.120.0/24",
      "port": "One port number or range per line, e.g. 8080 or 8000:8100",
      "networkgroup": "One alias name per line (combines other aliases)",
      "mac": "One MAC address per line, e.g. 00:11:22:33:44:55",
      "asn": "One AS number per line, e.g. 64512"
    }
  },
  "ph": {
    "loading": "Loading…",
    "loadFailed": "Could not load data",
    "groupSaveFailed": "Could not save group",
    "deleteGroupConfirm": "Delete group “{name}”?",
    "ruleSaveFailed": "Could not save rule",
    "deleteRuleConfirm": "Really delete rule “{name}”? It will also be removed from all target hosts.",
    "moveFailed": "Moving failed",
    "orderSaved": "Order saved. Apply it to already deployed rules with “Re-establish order”.",
    "orderSaveFailed": "Could not save order",
    "reassertFailed": "Reassert failed",
    "reassertDone": "Order for “{name}” and all subgroups has been re-established.",
    "title": "Hierarchical policies",
    "subtitle": "Define pre/post rules on parent groups — they are deployed automatically, in the correct order, to all hosts of the group and its subgroups.",
    "groupTree": "Group tree",
    "noGroups": "No groups created yet.",
    "selectGroup": "Select or create a group",
    "selectGroupHint": "Rules are defined on a group and automatically reach all hosts of that group and its subgroups.",
    "directHosts": "{count} directly assigned host(s) · ",
    "assignHosts": "Assign hosts",
    "reassertTitle": "Applies the saved order on all hosts of this group and its subgroups. It is also checked automatically after other OPNexus deployments.",
    "reasserting": "Reassert running…",
    "reassert": "Re-establish order",
    "preRules": "Pre rules",
    "preHint": "Evaluated before the post rules. Across several levels: root-most group first.",
    "postRules": "Post rules",
    "postHint": "Evaluated after the pre rules. Across several levels: leaf-most (most specific) group first.",
    "editGroup": "Edit group",
    "parentGroup": "Parent group (optional)",
    "rootGroup": "(none — root group)",
    "editRule": "Edit rule",
    "newPreRule": "New pre rule",
    "newPostRule": "New post rule",
    "addRule": "Add rule",
    "noRulesInCategory": "No rules in this category yet.",
    "targetHosts": "{count} target host(s) · {names}",
    "none": "none",
    "dragTitle": "Drag to change the order",
    "moveUp": "Move up",
    "moveDown": "Move down"
  },
  "certs": {
    "deploy": {
      "draft": "Draft (not pushed yet)",
      "success": "Pushed successfully",
      "error": "Error"
    },
    "loading": "Loading certificates…",
    "hostFailed": "Error",
    "hostsLoadFailed": "Could not load hosts",
    "loadFailed": "Could not load certificates",
    "acmeLoadFailed": "Could not load ACME data",
    "pushFailed": "Push failed",
    "certPushed": "Certificate “{name}” pushed",
    "certDeleteConfirm": "Really delete certificate “{name}”? If it was already pushed to the firewall, it is removed there as well (unless in use).",
    "certDeleted": "Certificate “{name}” deleted",
    "accountPushed": "Account “{name}” pushed",
    "accountDeleteConfirm": "Really delete ACME account “{name}”?",
    "accountDeleted": "Account “{name}” deleted",
    "requestPushed": "Request “{name}” pushed",
    "pollFailed": "Could not refresh status",
    "requestDeleteConfirm": "Really delete certificate request “{name}”?",
    "requestDeleted": "Request “{name}” deleted",
    "title": "Certificates",
    "subtitle": "Live fleet overview as well as central management of trust store certificates and ACME/Let's Encrypt issuance.",
    "tabLive": "Live overview",
    "tabTrust": "Manage trust store",
    "tabAcme": "ACME / Let's Encrypt",
    "hostsPending": "{pending} of {total} hosts still pending…",
    "attentionOne": "{count} certificate expires within the next 30 days or has already expired.",
    "attentionMany": "{count} certificates expire within the next 30 days or have already expired.",
    "colHost": "Host",
    "colName": "Name / CN",
    "colIssuer": "Issuer",
    "colValidTo": "Valid until",
    "colStatus": "Status",
    "noneFound": "No certificates found.",
    "hostUnavailable": "{host}: certificates unavailable",
    "trustIntro": "OPNsense core trust store (import/create internally/CSR/CA-sign/manual) — managed per host, since internal CA references and certificate UUIDs are host-local. A push is a single, immediately effective API call without a service restart — no warning needed, as there is no lockout risk.",
    "newCert": "New certificate",
    "createHostFirst": "Create at least one host first.",
    "showAll": "Show all certificates",
    "noManaged": "No managed certificates yet.",
    "actionAndCn": "{host} · Action: {action}",
    "edit": "Edit",
    "push": "Push",
    "delete": "Delete",
    "certSaved": "Certificate saved",
    "certCreated": "Certificate created",
    "acmeIntro": "ACME plugin (os-acme-client) — accounts and certificate requests managed per host (host-local UUIDs). Creating/changing is a purely local configuration change; “Register” and “Issue now” contact the real certificate authority and are therefore hidden behind an explicit warning.",
    "accounts": "ACME accounts",
    "newAccount": "New account",
    "noAccounts": "No ACME accounts yet.",
    "registration": "Registration: {state}",
    "registrationOk": "successful",
    "registrationFailed": "failed",
    "pushFirst": "Push first",
    "register": "Register",
    "requests": "ACME certificate requests",
    "newRequest": "New request",
    "createAccountFirst": "Create at least one ACME account first.",
    "noRequests": "No certificate requests yet.",
    "issuance": "Issuance: {state}",
    "issuanceTriggered": "triggered (check the result via “Status”)",
    "issuanceError": "Error while triggering",
    "requestMeta": "{host} · Account: {account} · Renewal every {days} days (since last issuance)",
    "firewallStatusCode": "Firewall status code: {code}",
    "lastIssuance": " · last issuance: {time}",
    "issueNow": "Issue now",
    "status": "Status",
    "accountSaved": "Account saved",
    "accountCreated": "Account created",
    "requestSaved": "Request saved",
    "requestCreated": "Request created",
    "registerTitle": "Register ACME account “{name}”",
    "registering": "Registration in progress…",
    "accountRegistered": "Account “{name}” registered",
    "issueTitle": "Issue certificate “{name}” now",
    "triggering": "Triggering…",
    "issuanceTriggeredToast": "Issuance for “{name}” triggered"
  },
  "ipsec": {
    "loading": "Loading tunnels…",
    "loadFailed": "Could not load tunnels",
    "saved": "Tunnel “{name}” saved",
    "created": "Tunnel “{name}” created",
    "pskRequired": "A pre-shared key is required when creating a tunnel",
    "saveFailed": "Could not save tunnel",
    "deleteConfirm": "Really delete this tunnel? It will also be removed from all target hosts (connection, identities, phase 2, pre-shared key) and the IPsec service will be reloaded.",
    "tunnelFallback": "Tunnel",
    "deleted": "Tunnel “{name}” deleted",
    "title": "IPsec VPN (site-to-site)",
    "new": "New tunnel",
    "intro": "Site-to-site tunnels with pre-shared-key authentication, maintained centrally and deployed to target hosts or device groups — analogous to the firewall rules, but without their automatic rollback safety net: a failed service reload can cut exactly the connection OPNexus uses to reach the host. v1 only supports PSK auth, one phase 2 (child) per tunnel and simple 1:1 network-to-network tunnels — no OpenVPN/WireGuard, no certificates/EAP, no pools.",
    "showAll": "Show all tunnels",
    "none": "No IPsec tunnels created yet.",
    "createFirst": "Create first tunnel",
    "noPsk": "No PSK stored",
    "disabledSuffix": " · tunnel disabled",
    "historyTitle": "Tunnel history",
    "editTitle": "Edit tunnel",
    "newTitle": "New IPsec tunnel",
    "descPlaceholder": "S2S to north branch",
    "localAddress": "Local address",
    "localAddressPlaceholder": "203.0.113.1 or %any",
    "remoteAddress": "Remote address",
    "ikeVersion": "IKE version",
    "proposal": "Proposal (phase 1)",
    "espProposal": "ESP proposal (phase 2)",
    "localIdentity": "Local identity",
    "localIdentityPlaceholder": "e.g. local IP",
    "remoteIdentity": "Remote identity (optional)",
    "remoteIdentityPlaceholder": "e.g. remote IP",
    "localNetwork": "Local network (CIDR)",
    "remoteNetwork": "Remote network (CIDR)",
    "pskEditing": "Pre-shared key ({state})",
    "pskSet": "set — leave empty to keep it",
    "pskNotSet": "not set yet",
    "psk": "Pre-shared key",
    "pskKeep": "Leave empty = unchanged",
    "pskPlaceholder": "Shared secret",
    "active": "Tunnel active"
  },
  "ovpn": {
    "loading": "Loading instances…",
    "trustLoadFailed": "Could not load trust store",
    "loadFailed": "Could not load instances",
    "saved": "Instance “{name}” saved",
    "created": "Instance “{name}” created",
    "saveFailed": "Could not save instance",
    "deleteConfirm": "Really delete this OpenVPN instance? It will also be removed from all target hosts (instance, static key if any) and the OpenVPN service will be reloaded.",
    "instanceFallback": "Instance",
    "deleted": "Instance “{name}” deleted",
    "title": "OpenVPN instances",
    "new": "New instance",
    "intro": "OpenVPN instances (server or client role), maintained centrally and deployed to target hosts or device groups — analogous to the IPsec feature, but without its automatic rollback safety net: a failed service reload can cut exactly the connection OPNexus uses to reach the host. v1 requires a certificate/CA that already exists on every target host — selectable via a picker from the respective host's trust store, since a certificate UUID is host-local —, supports optional TLS hardening (tls-auth/tls-crypt) via a static key, but no certificate-less “shared key” instance (not provided for in the modern OPNsense model).",
    "showAll": "Show all instances",
    "none": "No OpenVPN instances created yet.",
    "createFirst": "Create first instance",
    "tlsKeyMissing": "TLS key enabled but not stored",
    "roleServer": "Server",
    "roleClient": "Client",
    "tlsHardening": " · TLS hardening ({mode})",
    "disabledSuffix": " · instance disabled",
    "historyTitle": "Instance history",
    "editTitle": "Edit instance",
    "newTitle": "New OpenVPN instance",
    "descPlaceholder": "Road warrior server",
    "role": "Role",
    "bindAddress": "Bind address (optional)",
    "bindPlaceholder": "empty = all interfaces",
    "tunnelNetwork": "Tunnel network (CIDR)",
    "remoteTarget": "Remote target (host or host:port)",
    "tlsHardeningLabel": "TLS hardening (tls-auth/tls-crypt) via an additional static key",
    "staticKeyMode": "Static key mode",
    "modeCrypt": "crypt (encrypted + authenticated)",
    "modeAuth": "auth (authenticated only)",
    "staticKeyEditing": "Static key ({state})",
    "staticKey": "Static key",
    "keyPlaceholder": "Paste key material",
    "active": "Instance active",
    "certCaPerHost": "Certificate / CA per target host",
    "noTargets": "No target hosts selected — select hosts or a device group above; the selection then appears here, per host from its own trust store.",
    "trustLoading": "Loading trust store…",
    "certificate": "Certificate",
    "noCerts": "No certificates found on this host.",
    "pleaseChoose": "Please choose…",
    "ca": "CA",
    "noCas": "No CAs found on this host."
  },
  "wg": {
    "saved": "Tunnel “{name}” saved",
    "created": "Tunnel “{name}” created",
    "deleteConfirm": "Really delete this WireGuard tunnel? It will also be removed from all target hosts (peer, then server) and the WireGuard service will be reloaded.",
    "title": "WireGuard tunnels",
    "intro": "WireGuard interconnects (one server interface + exactly one peer per tunnel), maintained centrally and deployed to target hosts or device groups — analogous to IPsec/OpenVPN, without their automatic rollback safety net: a failed service reload can cut exactly the connection OPNexus uses to reach the host. v1 requires the server private key AND public key as well as the peer public key to be supplied manually by the operator (no key pair generator), optionally supports WireGuard's own pre-shared key per peer, and models exactly one server↔peer connection (no multi-peer hub).",
    "none": "No WireGuard tunnels created yet.",
    "noPrivateKey": "No private key stored",
    "pskMissing": "PSK enabled but not stored",
    "summary": "{address} · port {port} · peer allowed IPs {ips}",
    "peerPskActive": " · peer PSK active",
    "newTitle": "New WireGuard tunnel",
    "serverSection": "Server (local interface)",
    "interfaceName": "Interface name",
    "listenPort": "Listen port",
    "dns": "DNS (optional)",
    "dnsPlaceholder": "empty = none",
    "mtu": "MTU (optional)",
    "mtuPlaceholder": "empty = OPNsense default",
    "serverPublicKey": "Server public key",
    "serverPublicKeyPlaceholder": "Public key of the server",
    "serverPrivateKeyEditing": "Server private key ({state})",
    "serverPrivateKey": "Server private key",
    "privateKeyPlaceholder": "Paste private key",
    "keyNote": "OPNexus does not generate key pairs (no automatic call to OPNsense's own “gen_keypair”). Generate both keys yourself (e.g. via {cmd}) and enter them here.",
    "peerSection": "Peer",
    "peerName": "Peer name",
    "allowedIps": "Allowed IPs (CIDR)",
    "peerPublicKey": "Peer public key",
    "peerPublicKeyPlaceholder": "Public key of the peer",
    "endpointAddress": "Endpoint address (optional)",
    "endpointAddressPlaceholder": "empty = peer only connects inbound",
    "endpointPort": "Endpoint port (required if an address is set)",
    "keepalive": "Keepalive in seconds (optional)",
    "keepalivePlaceholder": "empty = no keepalive",
    "pskLabel": "Additional pre-shared key for this peer (WireGuard's own PSK, not IPsec's PSK)",
    "peerPskEditing": "Peer PSK ({state})",
    "peerPsk": "Peer PSK",
    "pskPlaceholder": "Paste PSK"
  },
  "auditExport": {
    "title": "Audit export",
    "intro": "Forwards the audit trail (who changed what, with status) to a syslog server and/or a webhook, so it also exists outside OPNexus. Only new events are sent from the moment you switch it on; firewall object contents are never included. Delivery is at least once: every event carries its id.",
    "saved": "Audit export saved",
    "testSent": "Test message sent",
    "testFailed": "The test message could not be delivered",
    "syslog": "Syslog (RFC 5424)",
    "host": "Host",
    "port": "Port",
    "protocol": "Protocol",
    "webhook": "Webhook",
    "webhookUrl": "Webhook URL",
    "secret": "Signing secret ({state})",
    "isSet": "set",
    "notSet": "not set",
    "keep": "leave empty to keep",
    "optional": "optional",
    "removeSecret": "Remove the signing secret",
    "test": "Send test message",
    "lastError": "Last delivery failed {when}: {message}",
    "lastSuccess": "Last delivery {when}"
  },
  "backupSettings": {
    "title": "Backups",
    "intro": "Takes a configuration backup of every firewall on a schedule and keeps the newest ones. Optionally a copy is encrypted here with your passphrase and uploaded to S3-compatible storage (AWS S3, MinIO, Backblaze B2, Wasabi, Cloudflare R2, Hetzner…), so a lost OPNexus server or a lost firewall is not the end of your configuration. Delete old offsite copies with the bucket's lifecycle rules.",
    "saved": "Backup settings saved",
    "scheduled": "Back up all firewalls on a schedule",
    "interval": "How often",
    "everyHours": "every {n} hours",
    "keep": "Keep the newest (per firewall)",
    "offsite": "Copy backups to S3-compatible storage (encrypted)",
    "endpoint": "Endpoint",
    "region": "Region",
    "bucket": "Bucket",
    "prefix": "Folder in the bucket",
    "accessKey": "Access key",
    "secretKey": "Secret key ({state})",
    "pathStyle": "Path-style addressing (works everywhere; turn off only if your provider needs bucket.host)",
    "passphrase": "Encryption passphrase ({state})",
    "passphraseNew": "at least 12 characters",
    "passphraseHint": "Backups are encrypted before they leave this server. Without the passphrase an offsite copy cannot be read — keep it somewhere safe besides OPNexus. Changing it only affects new uploads.",
    "offsiteError": "Offsite copy failed: {message}",
    "offsiteOk": "Last offsite copy {when}",
    "lastRun": "Last scheduled run {when}",
    "test": "Test the target",
    "testOk": "The target works (written, read back, deleted)",
    "testFailed": "The target test failed",
    "runNow": "Back up now",
    "ran": "{taken} backed up, {failed} failed, {uploaded} uploaded"
  },
  "backupDiff": {
    "title": "Changes since the previous backup",
    "hint": "Secrets (passwords, keys, tokens, certificates) are shown as hashes only: a changed secret appears as a changed hash.",
    "identical": "No differences.",
    "summary": "{added} lines added, {removed} removed",
    "truncated": "The list is cut off; compare the files in OPNsense for the rest.",
    "failed": "The comparison failed"
  },
  "overlay": {
    "title": "Management tunnel",
    "intro": "Lets OPNexus manage firewalls that have no public address (behind NAT, CGNAT, a mobile link). Each firewall dials OUT to a WireGuard hub on this server; OPNexus then reaches its API through the tunnel. Nothing on the firewall has to be reachable from the internet. Needs the hub container (COMPOSE_PROFILES=overlay) and the UDP port reachable from the internet.",
    "loadFailed": "Could not load the management tunnel",
    "saved": "Saved",
    "enable": "Enable the management tunnel",
    "hub": {
      "running": "hub running",
      "stale": "hub not reporting",
      "absent": "hub not running"
    },
    "hubAbsent": "The hub container is not running. Add COMPOSE_PROFILES=overlay to .env and run docker compose up -d.",
    "endpoint": "Address of this server (as the firewalls see it)",
    "endpointHint": "Public DNS name or IP of this server. Add :port if the published UDP port differs.",
    "port": "UDP port",
    "subnet": "Tunnel network",
    "subnetHint": "A private network used only for these tunnels. Cannot be changed while firewalls are registered.",
    "hubKey": "Hub public key",
    "hubAddress": "hub address",
    "addPeer": "Add a firewall",
    "nameHint": "A name for this firewall or site.",
    "create": "Create",
    "colName": "Firewall",
    "colAddress": "Tunnel address",
    "colStatus": "Status",
    "colHost": "Managed host",
    "needsKey": "waiting for the firewall's key",
    "connected": "connected",
    "waiting": "not connected yet",
    "empty": "No firewalls yet.",
    "instructions": "Instructions",
    "link": "Key / host",
    "delete": "Delete",
    "deleteConfirm": "Remove “{name}” from the management tunnel? The firewall will no longer be reachable through it.",
    "deleted": "“{name}” removed",
    "howTitle": "Connect “{name}”",
    "howIntro": "Do this once in the firewall's own web interface (OPNsense: VPN › WireGuard). Copy the values with the buttons.",
    "step1": "1. Local instance",
    "step1Hint": "Create a new instance: let OPNsense generate its key pair, no listen port is needed, and enter this tunnel address:",
    "fieldAddress": "Tunnel address",
    "step2": "2. Peer (the hub)",
    "fieldPublicKey": "Public key",
    "fieldPsk": "Pre-shared key",
    "fieldEndpoint": "Endpoint address and port",
    "fieldAllowed": "Allowed IPs",
    "fieldKeepalive": "Keepalive (seconds)",
    "step3": "3. Let the hub in",
    "step3Text": "Add a firewall rule on the WireGuard interface group: pass TCP from {hub} to “This Firewall”, port 443 (or the port of the web interface).",
    "step4": "4. Give OPNexus the firewall's public key",
    "step4Text": "Copy the public key of the new local instance from OPNsense, close this window and use “Key / host” on this firewall.",
    "step5": "5. Add the firewall as a host",
    "step5Text": "Add or edit the host with this address and the usual API key. It then shows up as connected here.",
    "fieldUrl": "Host address",
    "linkTitle": "Key and host of “{name}”",
    "firewallKey": "Public key of the firewall's WireGuard instance",
    "firewallKeyHint": "From OPNsense: VPN › WireGuard › Instances. Leave empty to remove it.",
    "hostHint": "Optional: which managed host is reached through this tunnel."
  },
  "variables": {
    "title": "Site variables",
    "intro": "Rules, aliases and NAT entries can contain placeholders like {{LAN_NET}}. Each firewall fills them with its own value, so one object serves many sites with different networks. A firewall without a value for a placeholder is never pushed: the preview says so and the deploy is refused. Values may contain letters, digits and . : / , @ + - _ and spaces.",
    "loadFailed": "Could not load the variables",
    "saved": "Variables saved",
    "saveFailed": "Could not save the variables",
    "empty": "No placeholders in use. Write {{NAME}} into a rule, alias or NAT entry (capital letters, digits and _) and define its value here.",
    "missing": "{n} value(s) missing",
    "required": "required",
    "usedBy": "Used by: {list}",
    "newName": "New variable name",
    "add": "Add"
  },
  "sso": {
    "title": "Single sign-on (OIDC)",
    "intro": "Lets people sign in with your identity provider (Authentik, Keycloak, Entra ID, Google, …) instead of a password stored here. Roles come from the provider's groups at every login; without a mapped group nobody gets in. Local accounts keep working, so you can always sign in with the admin password if the provider is down.",
    "saved": "SSO settings saved",
    "testOk": "The provider answered (discovery and signing keys are fine)",
    "testFailed": "The provider test failed",
    "enable": "Offer single sign-on on the login page",
    "redirectHint": "Register this redirect URI with your provider:",
    "name": "Button text",
    "issuer": "Issuer URL",
    "clientId": "Client ID",
    "clientSecret": "Client secret ({state})",
    "scopes": "Scopes",
    "claim": "Groups claim",
    "mapping": "Which group gets which role",
    "mappingHint": "Enter the group names as the provider sends them. The most privileged matching role wins; a person in none of them cannot sign in. Roles of SSO accounts are managed at the provider and refreshed at every login. Providers that only send groups when asked (e.g. Okta) need the scope \"groups\" added to the scopes.",
    "test": "Test the provider",
    "dutiesTitle": "Separation of duties",
    "dutiesIntro": "When switched off, operators can prepare changes (edit, preview) but only an administrator may roll them out: deploy, remove or roll back a deployment, run or schedule maintenance and apply network changes. The refusal is recorded in the audit.",
    "operatorsDeploy": "Operators may roll out changes themselves",
    "dutiesSaved": "Saved"
  },
  "report": {
    "title": "Security report",
    "generated": "Created {when} · OPNexus {version}",
    "back": "Back",
    "print": "Print / save as PDF",
    "score": "Score",
    "open": "Open findings",
    "checked": "Checked",
    "open_report": "Report"
  },
  "security": {
    "title": "Security posture",
    "intro": "Checks every firewall's configuration for common weaknesses (open rules, weak SSH/SNMP, missing backups…) and gives a score from 0 to 100. Read-only: nothing is changed on the firewalls. Checked automatically every 6 hours.",
    "loadFailed": "Could not load the security posture",
    "checkFailed": "The check failed",
    "checked": "Check finished",
    "checkAll": "Check all",
    "checkHost": "Check again",
    "noHosts": "No firewalls yet",
    "noHostsHint": "Connect a firewall to see its security posture.",
    "notChecked": "Not checked",
    "neverChecked": "Not checked yet",
    "checkedAt": "Checked {when}",
    "allGood": "No open findings",
    "andMore": "… and {n} more",
    "unknown": "unknown",
    "failed": "failed",
    "passed": "passed",
    "severity": {
      "critical": "critical",
      "high": "high",
      "medium": "medium",
      "low": "low",
      "info": "note"
    },
    "error": {
      "unreachable": "unreachable",
      "invalid_config": "unreadable"
    },
    "errorHint": {
      "unreachable": "The firewall could not be reached, so it could not be checked.",
      "invalid_config": "The configuration could not be read."
    },
    "reason": {
      "root_password": "root may log in over SSH with a password",
      "password": "SSH accepts password login"
    },
    "checks": {
      "webgui_https": {
        "title": "Web interface over HTTPS only",
        "ok": "The management interface is served over HTTPS.",
        "fail": "The management interface runs over unencrypted HTTP. Credentials can be read on the network.",
        "fix": "System › Settings › Administration: set the protocol to HTTPS."
      },
      "ssh_hardened": {
        "title": "SSH locked down",
        "ok": "SSH is off or accepts keys only.",
        "fail": "{reason}.",
        "fix": "Switch SSH off, or disable root login and password login under System › Settings › Administration and use keys."
      },
      "snmp_community": {
        "title": "SNMP community is not “public”",
        "ok": "SNMP uses a custom community.",
        "fail": "SNMP uses the default community “public”. Anyone on the network can read system data.",
        "fix": "Set your own long community or turn SNMP off."
      },
      "wan_any_any": {
        "title": "No allow-all rule on the WAN",
        "ok": "No rule on the WAN allows all traffic to everywhere.",
        "fail": "{count} rule(s) on the WAN allow all traffic to any destination — the firewall protects nothing there.",
        "fix": "Restrict the rule to the sources, destinations and ports you need, or delete it."
      },
      "internal_any_any": {
        "title": "No allow-all rule from any source (internal)",
        "ok": "No internal rule allows any source to any destination.",
        "fail": "{count} rule(s) allow any source to any destination.",
        "fix": "Limit the source to the network the rule is meant for."
      },
      "rules_shadowed": {
        "title": "No shadowed rules",
        "ok": "Every rule can be reached.",
        "fail": "{count} rule(s) are never reached because an earlier rule already covers them.",
        "fix": "Check the order; remove the useless rule or move it up."
      },
      "rules_duplicate": {
        "title": "No duplicate rules",
        "ok": "No rule is repeated.",
        "fail": "{count} rule(s) are identical to an earlier one.",
        "fix": "Delete the duplicate."
      },
      "rules_documented": {
        "title": "Rules are described",
        "ok": "All active rules have a description.",
        "fail": "{count} active rule(s) have no description.",
        "fix": "Add a description so it stays clear later what the rule is for."
      },
      "ntp_configured": {
        "title": "Time server set",
        "ok": "Time servers are configured.",
        "fail": "No time server is configured. Logs and certificates need the right time.",
        "fix": "Enter NTP servers in the time settings."
      },
      "remote_logging": {
        "title": "Logs are kept elsewhere too",
        "ok": "A remote syslog target is configured.",
        "fail": "Logs exist only on the firewall. After a break-in or a failure they are gone.",
        "fix": "Add a syslog server under System › Settings › Logging."
      },
      "ids_enabled": {
        "title": "Intrusion detection active",
        "ok": "Intrusion detection is on.",
        "fail": "Intrusion detection (IDS/IPS) is not switched on.",
        "fix": "Optional: enable Services › Intrusion Detection."
      },
      "firmware_current": {
        "title": "Firmware up to date",
        "ok": "No updates are pending.",
        "fail": "Updates are available.",
        "fix": "Install them in the Update Center.",
        "unknown": "Could not determine the update status."
      },
      "backup_recent": {
        "title": "Recent backup",
        "ok": "The newest backup is {days} day(s) old.",
        "fail": "There is no backup from the last 7 days.",
        "fix": "Use “Back up now” on the host page or schedule maintenance."
      },
      "rules_unused": {
        "title": "Rules in use",
        "ok": "Every rule matched traffic in the last 30 days.",
        "fail": "{count} rule(s) have matched nothing for at least 30 days.",
        "unknown": "Still collecting data: a rule counts as unused only after 30 days without a hit.",
        "fix": "Check whether the rule is still needed and disable or delete it."
      }
    },
    "hits": {
      "title": "Rule usage",
      "intro": "When each rule last matched traffic, as observed by OPNexus. The firewall's own counters restart with every change and reboot, so OPNexus keeps the last time it saw one grow. A rule counts as unused after 30 days without a hit.",
      "rule": "Rule",
      "state": "Status",
      "lastHit": "Last hit seen",
      "packets": "Packets since reload",
      "states": {
        "used": "in use",
        "unused": "unused",
        "collecting": "collecting data",
        "disabled": "disabled"
      }
    }
  },
  "tokens": {
    "title": "API tokens",
    "new": "New token",
    "intro": "Tokens let scripts, CI jobs, Prometheus and AI assistants use the OPNexus API without a sign-in. Each token belongs to you, has a scope and can be revoked at any time. It never gets more rights than your account.",
    "loadFailed": "Could not load API tokens",
    "createFailed": "Could not create the token",
    "empty": "No tokens yet.",
    "colName": "Name",
    "colScope": "Scope",
    "colOwner": "Owner",
    "colExpires": "Expires",
    "colLastUsed": "Last used",
    "never": "Never",
    "neverUsed": "Not used yet",
    "days": "{n} days",
    "nameHint": "What the token is for, e.g. “Grafana” or “CI deploy”.",
    "scope": {
      "read": "Read",
      "deploy": "Deploy",
      "admin": "Admin"
    },
    "scopeHint": {
      "read": "Read only: view everything, change nothing. For dashboards, Prometheus and AI assistants.",
      "deploy": "Read plus roll out rules, aliases, NAT, VPN and maintenance. Cannot manage users, settings or hosts.",
      "admin": "Everything your account may do, except managing tokens and your own account."
    },
    "password": "Your password",
    "passwordHint": "Creating a token needs your current password.",
    "create": "Create token",
    "revoke": "Revoke",
    "revokeConfirm": "Revoke token “{name}”? Anything using it stops working immediately.",
    "revoked": "Token “{name}” revoked",
    "createdTitle": "Token “{name}” created",
    "shownOnce": "Copy the token now. It is shown only once and cannot be displayed again.",
    "copy": "Copy",
    "copied": "Copied",
    "example": "Example",
    "done": "Done"
  },
  "users": {
    "ssoTip": "Managed by single sign-on: role and password are changed at the identity provider.",
    "roleOperator": "Operator",
    "roleAdmin": "Admin",
    "roleReadOnly": "Read-only",
    "loadFailed": "Could not load users",
    "deleteConfirm": "Really delete user “{name}”?",
    "deleted": "User “{name}” deleted",
    "title": "Users",
    "new": "New user",
    "intro": "“Admin” may do everything. “Operator” rolls out and operates (rules, NAT, VPN, maintenance) but cannot manage users, settings or hosts. “Read-only” can view all pages and data but cannot save changes — only your own password can always be changed.",
    "colUsername": "Username",
    "colRole": "Role",
    "colCreated": "Created",
    "colLastLogin": "Last sign-in",
    "you": "(you)",
    "cannotDeleteSelf": "You cannot delete your own account",
    "created": "User created",
    "updated": "User “{name}” updated",
    "createFailed": "Could not create user",
    "password": "Password",
    "createUser": "Create user",
    "editTitle": "Edit user: {name}",
    "newPassword": "New password (optional)",
    "keepPassword": "leave empty to keep unchanged"
  },
  "logs": {
    "preset": {
      "1h": "Last hour",
      "24h": "Last 24 hours",
      "7d": "Last 7 days",
      "all": "Entire period",
      "custom": "Custom"
    },
    "loadFailed": "Could not load logs",
    "title": "Firewall logs",
    "hostOrCluster": "Host or cluster",
    "allHosts": "All hosts",
    "clusterOption": "Cluster: {name} (all hosts)",
    "statsLoading": "Loading statistics…",
    "byAction": "By action",
    "noData": "No data in this period.",
    "byInterface": "By interface",
    "topBlocked": "Top blocked sources",
    "noBlocked": "No blocked connections in this period.",
    "topPorts": "Top destination ports",
    "searchLabel": "Search logs",
    "searchPlaceholder": "Label, source, destination…",
    "action": "Action",
    "allActions": "All actions",
    "interface": "Interface",
    "allInterfaces": "All interfaces",
    "protocol": "Protocol",
    "allProtocols": "All protocols",
    "period": "Period",
    "from": "From",
    "to": "To",
    "colTime": "Time",
    "colHost": "Host",
    "colSource": "Source",
    "colDestination": "Destination",
    "noEntries": "No log entries for this selection.",
    "range": "{from}–{to} of {total} matches",
    "back": "Back",
    "page": "Page {page} / {pages}",
    "next": "Next"
  },
  "cluster": {
    "error": "Error",
    "loadFailed": "Could not load cluster view",
    "comparing": "Comparing rules…",
    "countDiffers": "Rule count differs — view details",
    "synced": "In sync",
    "ungrouped": "Not grouped",
    "ungroupedHint": "These hosts have no cluster name — assign one under Hosts ▸ Edit to see them grouped here.",
    "rulesCount": "{count} rules",
    "rulesUnavailable": "Rules unavailable",
    "carpHistoryFailed": "Could not load CARP history",
    "carpHistory": "CARP role history ({count})",
    "noRoleChanges": "No role changes recorded yet.",
    "unknown": "unknown"
  },
  "about": {
    "tagline": "Central management of multiple OPNsense firewalls.",
    "version": "OPNexus {version} “{codename}” · in-house development by {maintainer}",
    "fleetStatus": "Fleet status",
    "colAddress": "Address",
    "colVersion": "OPNsense version",
    "colLiveRules": "Live rules",
    "unavailable": "unavailable"
  },
  "audit": {
    "kind": {
      "rule": "Rules",
      "alias": "Aliases",
      "port_forward": "Port forward",
      "one_to_one": "1:1 NAT",
      "outbound_nat": "Outbound NAT",
      "host": "Host maintenance",
      "user": "Users",
      "auth": "Account security",
      "backup": "Backup export",
      "ipsec_tunnel": "IPsec tunnels",
      "openvpn_instance": "OpenVPN",
      "wireguard_tunnel": "WireGuard",
      "certificate": "Certificates",
      "acme": "ACME",
      "notification": "Notifications",
      "system": "OPNexus system"
    },
    "action": {
      "deploy": "Push",
      "confirm": "Confirmation",
      "rollback": "Rollback",
      "remove": "Remove target",
      "retry-rollback": "Retry rollback",
      "delete": "Delete",
      "create": "Create",
      "edit": "Edit",
      "reboot": "Reboot",
      "update": "Update",
      "acknowledge": "Completion confirmed",
      "backups": "Backup",
      "cancel": "Cancelled",
      "carp-execute": "CARP role switch",
      "carp_enter": "CARP handover",
      "carp_leave": "CARP normal operation",
      "check-updates": "Update check",
      "execute": "Executed",
      "handoff": "Handover",
      "preview": "Preview",
      "schedule": "Scheduled",
      "major_update": "Major upgrade",
      "changes": "Changes",
    "download": "Download",
      "push": "Push",
      "register": "Register",
      "sign": "Sign",
      "poll": "Poll status",
      "test": "Test",
      "change-password": "Change password",
      "2fa/setup": "2FA setup",
      "2fa/enable": "2FA enable",
      "2fa/disable": "2FA disable",
      "reset-password": "Password reset",
      "reset-2fa": "2FA reset"
    },
    "status": {
      "requested": "Requested",
      "accepted": "Request processed",
      "rejected": "Rejected",
      "interrupted": "Interrupted · check",
      "success": "Confirmed",
      "pending": "Confirmation pending",
      "error": "Error",
      "reverted": "Rolled back",
      "revert_failed": "Rollback failed",
      "removed": "Removed",
      "submitted": "Submitted to firewall",
      "acknowledged": "Completed manually",
      "starting": "Handover started",
      "unknown": "Outcome unclear",
      "denied": "Denied"
    },
    "exportFailed": "Export failed",
    "title": "Deploy audit history",
    "refresh": "Refresh",
    "exporting": "Exporting…",
    "exportJson": "Export JSON",
    "intro": "Requests and deployment results are stored permanently from activation onwards, even after a rule or host is deleted. “Request processed” describes the HTTP request; the separate host entry shows the deploy result. Earlier actions are not reconstructed retroactively.",
    "searchLabel": "Search audit",
    "searchPlaceholder": "User, host, description…",
    "typeLabel": "Audit type",
    "allTypes": "All types",
    "resultLabel": "Audit result",
    "allResults": "All results",
    "events": "{total} events · {from}–{to}",
    "noEvents": "No events in this selection."
  },
  "hostDetail": {
    "notFound": "Host not found",
    "liveRulesFailed": "Could not load live rules",
    "liveAliasesFailed": "Could not load live aliases",
    "backupsFailed": "Could not load backups",
    "backupFailed": "Backup failed",
    "downloadFailed": "Download failed",
    "backToHosts": "Back to hosts",
    "managedRules": "Rules managed by OPNexus",
    "noManagedRules": "No centrally managed rules for this host.",
    "colRule": "Rule",
    "colStatusOnHost": "Status on this host",
    "notDeployed": "not deployed",
    "liveRulesTitle": "Actually configured rules (live from the firewall)",
    "fetchingRules": "Fetching rules from the firewall…",
    "colOrigin": "Origin",
    "automatic": "automatic",
    "custom": "user-defined",
    "managedAliases": "Aliases managed by OPNexus",
    "noManagedAliases": "No centrally managed aliases for this host.",
    "liveAliasesTitle": "Actually configured aliases (live from the firewall)",
    "fetchingAliases": "Fetching aliases from the firewall…",
    "backups": "Backups",
    "backupNow": "Back up now",
    "noBackups": "No backup available yet.",
    "colTime": "Time",
    "colSize": "Size",
    "changes": "Changes",
    "download": "Download",
    "restore": "Restore",
    "restoreHistory": "Restore history",
    "colBackup": "Backup",
    "restoreVerified": "Confirmed",
    "restoreHandedOff": "Handed over — open",
    "restoreCancelled": "Cancelled"
  },
  "updates": {
    "notChecked": "Not checked yet",
    "fw": {
      "running": "Job running",
      "update": "Update available",
      "upgrade": "Major upgrade",
      "error": "Check failed",
      "none": "Check required",
      "current": "Up to date"
    },
    "blocker": {
      "haOrder": {
        "title": "HA order",
        "master": "This node is currently MASTER. Update the BACKUP node first. Then switch the CARP roles in OPNsense and return to this node.",
        "backup": "In an HA cluster, updates are only started on the current BACKUP node."
      },
      "partner": {
        "title": "HA partner not ready",
        "text": "The other cluster node must be online and CARP MASTER before this node can be updated."
      },
      "backup": {
        "title": "Fresh backup required",
        "text": "Before installing, OPNexus needs a local configuration backup that is at most 24 hours old."
      },
      "noUpdate": {
        "title": "No installable update",
        "text": "The last check reports no stable package update."
      },
      "noMajor": {
        "title": "No installable major upgrade",
        "text": "The last check reports no available major upgrade."
      },
      "pending": {
        "title": "Maintenance still open",
        "text": "An earlier maintenance must be completed first, after the technical check."
      },
      "change": {
        "title": "Change still open",
        "text": "A deployment or rollback in the cluster is not finished yet."
      },
      "locked": "Update blocked"
    },
    "pkg": {
      "upgrade": "Upgrade",
      "new": "Install new",
      "reinstall": "Reinstall",
      "downgrade": "Downgrade",
      "obsolete": "Remove"
    },
    "statusFailed": "Could not load status",
    "hostsFailed": "Could not load hosts",
    "checkStarted": "Update check on {host} was started.",
    "checkFailed": "Update check failed",
    "autoRunning": "Automatic update check running on {count} hosts…",
    "checkedSummary": "{prefix}{done} of {total} eligible hosts were checked.",
    "autoDone": "Automatic check finished: ",
    "backupSaved": "Fresh configuration backup for {host} was saved.",
    "backupFailed": "Could not create backup",
    "previewFailed": "Update preview failed",
    "handedOver": "{label} was handed over to {host}.",
    "labelMajor": "Major upgrade",
    "labelUpdate": "Update",
    "outcomeUnclear": "Outcome unclear. Check the maintenance status.",
    "finishDocumented": "Maintenance completion for {host} was documented.",
    "finishFailed": "Could not save completion",
    "cancelledNote": "Operation on {host} was closed without confirmed completion.",
    "cancelFailed": "Cancelling failed",
    "logFailed": "Could not load update log",
    "title": "Update Center",
    "intro": "When opened, all eligible hosts are automatically checked for updates. Major upgrades and HA role switches remain deliberate manual steps.",
    "checkAgain": "Check for updates again",
    "refreshView": "Refresh view",
    "readOnlyNote": "Read-only access: status, package changes and logs are visible; checks and updates are blocked.",
    "sumHosts": "Managed hosts",
    "sumStable": "Stable updates",
    "sumMajor": "Major upgrades",
    "sumUnavailable": "Not evaluable",
    "fleetLoading": "Loading fleet status…",
    "disabled": "Disabled",
    "clusterSuffix": " · cluster {name}",
    "check": "Check",
    "prepareUpdate": "Prepare update",
    "prepareMajor": "Prepare major upgrade",
    "reviewFinish": "Review completion",
    "cancelOperation": "Cancel operation",
    "view": "View",
    "readingStatus": "Reading status…",
    "installed": "Installed",
    "available": "Available",
    "packageUpdates": "Package updates",
    "lastCheck": "Last check",
    "localBackup": "Local backup",
    "backupFresh": " · fresh",
    "backupOld": " · older than 24 h",
    "backupMissing": "Missing",
    "backupNow": "Create backup now",
    "rebootRequired": "Reboot required",
    "carpMode": "CARP maintenance mode",
    "whyUpdateBlocked": "Why “Prepare update” is still blocked",
    "whyMajorBlocked": "Why “Prepare major upgrade” is still blocked",
    "packageChanges": "{count} package changes",
    "majorTargets": " · {count} major upgrade target(s)",
    "updateLog": "Update log",
    "majorTargetsTitle": "Available major upgrade targets",
    "colTarget": "Target",
    "colInstalled": "Installed",
    "colNew": "New",
    "colRepository": "Repository",
    "stablePackageChanges": "Stable package changes",
    "noPackageChanges": "No stable package changes in the cached check result.",
    "colPackage": "Package",
    "colAction": "Action",
    "previewTitleMajor": "Major upgrade on {host}",
    "previewTitleUpdate": "Firmware update on {host}",
    "majorWarnTitle": "Major upgrade: switch to a new major version",
    "majorWarnText": "Takes longer and is riskier than a plain package update, possibly with larger behaviour changes to services and configuration. Have a fresh backup and console access ready before proceeding.",
    "plannedDowntime": "Planned interruption",
    "plannedDowntimeText": "The host may be unreachable during installation. Connections may drop; there is no automatic rollback.",
    "carpRole": "CARP role",
    "standalone": "Standalone",
    "previewValidUntil": "Preview valid until",
    "runMajorNow": "Run major upgrade now",
    "runUpdateNow": "Run update now",
    "finishTitleCarp": "Complete CARP role switch on {host}",
    "finishTitle": "Complete maintenance on {host}",
    "finishCheckCarp": "Check the CARP roles and reachability of both cluster nodes. ",
    "finishCheck": "Check reachability, installed version and services. ",
    "finishNote": "This confirmation documents the check and does not trigger any further firewall action.",
    "cancelTitle": "Cancel operation on {host}",
    "cancelWarnPre": "This does ",
    "cancelWarnStrong": "not confirm",
    "cancelWarnPost": " a successful completion — it only closes the record so this host/cluster is no longer locked. Only use it if the expected state demonstrably never occurred (e.g. a CARP role switch is stuck).",
    "logTitle": "Update log · {host}",
    "logEmpty": "No log available. OPNsense clears it on reboot – after a successful update that is normal. The firewall's status shown on this page is what counts.",
    "readOnlyBadge": "Read-only",
    "lockedPrefix": "Locked",
    "tipCheckAll": "Asks all eligible firewalls for new updates. Nothing is installed.",
    "tipRefreshView": "Reloads the last known status of all hosts without contacting the firewalls.",
    "tipCheck": "Asks this firewall for available updates. Nothing is installed.",
    "tipPrepare": "Shows a preview first. Nothing is installed until you explicitly confirm.",
    "tipPrepareMajor": "Switch to a new major version: takes longer and is riskier. A preview comes first.",
    "tipView": "Reload this host's status",
    "tipFinish": "Check the result on the firewall and document the completion.",
    "tipCancel": "Closes a stuck operation without confirming success. Only if the expected state never occurred.",
    "tipPackages": "Packages that will change with the next update",
    "tipLog": "Shows the log of the last update action on the firewall",
    "tipBackup": "A local configuration backup no older than 24 hours is required before any update.",
    "tipInstalled": "Version currently installed on the firewall",
    "tipAvailable": "Newest version that can be installed according to the last check",
    "tipRebootRequired": "The firewall must be rebooted after the update and will be briefly unreachable.",
    "tipCarpWarn": "CARP maintenance mode",
    "majorWarnShort": "Switch to a new major version",
    "majorWarnTip": "Takes longer and is riskier than a package update, possibly with behavior changes to services and configuration. Have a fresh backup and console access ready.",
    "downtimeShort": "The host may be unreachable during installation",
    "downtimeTip": "Connections can drop. There is no automatic rollback.",
    "tipConfirmName": "Typing the host name prevents updating the wrong host by accident.",
    "confirmRunDisabledName": "Enter the host name exactly to continue",
    "confirmRunDisabledAck": "Confirm the maintenance window first",
    "cancelWarnShort": "Does not confirm a successful completion",
    "cancelWarnTip": "The operation is only closed so the host or cluster does not stay locked. Use only if the expected state demonstrably never occurred (e.g. a stuck CARP role switch).",
    "finishNoteTip": "This confirmation documents your check and triggers no firewall action.",
    "reasonMinHint": "At least 3 characters",
    "validUntilShort": "Preview valid until {time}"
  },
  "sparkline": {
    "noData": "No data"
  },
  "tls": {
    "title": "Firewall TLS certificate",
    "intro": "The connection to the firewall is only accepted as secure if it presents exactly this certificate. This works for IP addresses and names alike and protects against eavesdropping and redirection.",
    "pinned": "Pinned",
    "notPinned": "Not pinned",
    "insecure": "Not verified (insecure)",
    "fetch": "Fetch certificate",
    "refetch": "Fetch certificate again",
    "needsHttps": "Requires an https address.",
    "subject": "Name",
    "issuer": "Issuer",
    "selfSigned": "self-signed",
    "validUntil": "Valid until",
    "expired": "expired",
    "confirmMatch": "The fingerprint matches the firewall's certificate.",
    "confirmHelp": "Compare it in OPNsense under System → Trust → Certificates (web GUI certificate) or in the browser's certificate dialog for the firewall. Only confirm if it matches exactly.",
    "skipVerify": "Do not verify the certificate (insecure)",
    "skipVerifyHelp": "The connection stays encrypted, but OPNexus cannot tell whether the firewall is really answering. For testing only.",
    "probeFailed": "The certificate could not be retrieved",
    "pinnedTip": "Certificate pinned · SHA-256 {fp}…",
    "systemTip": "Standard certificate check. For self-signed firewalls, pin the certificate.",
    "insecureTip": "The certificate is not verified. Edit the host to pin it."
  },
  "twofa": {
    "title": "Two-factor sign-in",
    "intro": "In addition to the password, sign-in asks for a 6-digit code from an authenticator app (e.g. Aegis, Google Authenticator, 1Password). Protects the account even if the password becomes known.",
    "on": "On",
    "off": "Off",
    "enable": "Set up two-factor",
    "disable": "Disable",
    "codesLeft": "{count} recovery codes left",
    "confirmPassword": "Current password",
    "confirmPasswordHelp": "The password is asked again so that a stolen session alone cannot register someone else's authenticator.",
    "continue": "Continue",
    "scan": "Scan the QR code with your authenticator app, then enter the code it shows.",
    "qrAlt": "QR code for the authenticator app",
    "manualKey": "Or enter the key manually:",
    "enterCode": "6-digit code",
    "activate": "Activate",
    "codesTitle": "Recovery codes – save them now",
    "codesHelp": "Each code works exactly once if you lose your device. They are only shown now.",
    "copy": "Copy",
    "download": "Save as file",
    "savedAck": "I have saved the codes in a safe place.",
    "done": "Done",
    "enterCodeOrRecovery": "Code from the app or recovery code",
    "userOnTip": "Two-factor sign-in enabled",
    "reset": "Reset 2FA",
    "resetTip": "Removes this user's two-factor sign-in, e.g. when the device was lost.",
    "resetConfirm": "Reset two-factor sign-in for {name}?",
    "resetDone": "Two-factor reset for {name}."
  },
  "network": {
    "host": "Firewall",
    "loadFailed": "Could not load network data.",
    "empty": "No entries.",
    "unassigned": "unassigned",
    "management": "Management",
    "default": "Default",
    "active": "Active",
    "managementNote": "OPNexus reaches this firewall through {device}. Changes to this interface can cut the connection and will get extra safeguards later.",
    "managementUnknown": "Which interface OPNexus uses to reach this firewall cannot be determined (e.g. via NAT or a CARP address).",
    "unavailable": "Not available from this firewall: {sections}.",
    "cannotConfigure": "This firewall is too old to change interface IPs through its API (possible from OPNsense 26.7.6). Change the IP directly in OPNsense or update the firewall.",
    "sections": {
      "assignments": "interface assignments",
      "vlans": "VLANs",
      "vips": "virtual IPs",
      "gateways": "gateways",
      "routes": "routes",
      "dns_hosts": "DNS entries",
      "dhcp_hosts": "DHCP hosts",
      "kea_subnets": "DHCP subnets",
      "kea_reservations": "DHCP reservations"
    },
    "col": {
      "device": "Device",
      "name": "Name",
      "status": "Status",
      "addresses": "Addresses",
      "type": "Type",
      "vlan": "VLAN",
      "parent": "Parent device",
      "tag": "Tag",
      "pcp": "Priority (PCP)",
      "address": "Address",
      "interface": "Interface",
      "mode": "Mode",
      "advskew": "Advskew",
      "priority": "Priority",
      "network": "Network",
      "gateway": "Gateway"
    },
    "kinds": {
      "vlan": "VLAN",
      "vip": "Virtual IP",
      "gateway": "Gateway",
      "route": "Route",
      "interface": "Interface",
      "dns_host": "DNS entry",
      "dhcp_host": "DHCP host (dnsmasq)",
      "kea_subnet": "DHCP subnet (Kea)",
      "kea_reservation": "DHCP reservation (Kea)",
      "tunable": "Tunable",
      "cron_job": "Cron job",
      "syslog_destination": "Syslog target",
      "gateway_group": "Gateway groups",
      "lagg": "LAGG",
      "bridge": "Bridge",
      "loopback": "Loopback",
      "gre": "GRE tunnel",
      "dns_forward": "DNS forwards",
      "dhcp_range": "DHCP ranges (dnsmasq)",
      "gif": "GIF tunnel",
      "vxlan": "VXLAN"
    },
    "field": {
      "if": "Parent interface",
      "tag": "VLAN tag",
      "pcp": "Priority (PCP)",
      "descr": "Description",
      "interface": "Interface",
      "mode": "Mode",
      "network": "Address / prefix (e.g. 192.168.1.50/24)",
      "vhid": "VHID",
      "advbase": "Advbase",
      "advskew": "Advskew",
      "password": "CARP password",
      "name": "Name",
      "ipprotocol": "IP version",
      "gateway": "Gateway",
      "defaultgw": "Default gateway",
      "defaultgwHint": "Use as default gateway",
      "monitor_disable": "Monitoring",
      "monitor_disableHint": "Disable gateway monitoring",
      "priority": "Priority",
      "disabled": "Disabled",
      "disabledHint": "Disable gateway",
      "enabled": "Enabled",
      "enabledHint": "Route enabled",
      "fargw": "Far gateway",
      "force_down": "Mark as down",
      "monitor": "Monitor IP",
      "weight": "Weight",
      "nosync": "Do not sync",
      "peer": "Peer",
      "peer6": "Peer (IPv6)",
      "proto": "Protocol",
      "enable": "Enabled",
      "enableHint": "Enable interface",
      "type4": "IPv4 type",
      "ipaddr": "IPv4 address / prefix",
      "type6": "IPv6 type",
      "ipaddrv6": "IPv6 address / prefix",
      "gatewayv6": "IPv6 gateway",
      "mtu": "MTU",
      "blockpriv": "Block private networks",
      "blockprivHint": "Block private networks",
      "blockbogons": "Block bogon networks",
      "blockbogonsHint": "Block bogon networks",
      "lock": "Lock",
      "lockHint": "Prevent removal (lock interface)",
      "hostname": "Hostname",
      "domain": "Domain",
      "rr": "Record type",
      "server": "Target address",
      "mx": "Mail server (MX)",
      "mxprio": "MX priority",
      "addptr": "PTR record",
      "addptrHint": "Create the matching PTR record",
      "description": "Description",
      "host": "Host",
      "ip": "IP address(es)",
      "hwaddr": "MAC address(es)",
      "client_id": "Client ID",
      "lease_time": "Lease time (seconds)",
      "local": "Local",
      "localHint": "Resolve locally only",
      "ignore": "Ignore",
      "ignoreHint": "Ignore requests from this device",
      "subnet": "Subnet",
      "pools": "Address pool (e.g. 192.168.1.100-192.168.1.200)",
      "valid_lifetime": "Lease validity (seconds)",
      "next_server": "Next server (TFTP)",
      "ip_address": "IP address",
      "hw_address": "MAC address",
      "option_data": {
        "routers": "Gateway (router)",
        "domain_name_servers": "DNS servers",
        "domain_name": "Domain name",
        "ntp_servers": "NTP servers"
      },
      "tunable": "Tunable",
      "value": "Value",
      "default_value": "Default value",
      "minutes": "Minute",
      "hours": "Hour",
      "days": "Day",
      "months": "Month",
      "weekdays": "Weekday",
      "who": "User",
      "command": "Command",
      "parameters": "Parameters",
      "transport": "Transport",
      "program": "Programs",
      "level": "Level",
      "facility": "Facility",
      "rfc5424": "RFC 5424",
      "rfc5424Hint": "Use RFC 5424 format",
      "item": "Gateways (tier 1)",
      "item2": "Gateways (tier 2)",
      "item3": "Gateways (tier 3)",
      "item4": "Gateways (tier 4)",
      "item5": "Gateways (tier 5)",
      "trigger": "Trigger",
      "poolopts": "Pool options",
      "members": "Members",
      "primary_member": "Primary member",
      "lacp_fast_timeout": "LACP fast timeout",
      "lagghash": "Hash algorithm",
      "laggif": "Device",
      "bridgeif": "Device",
      "linklocal": "Link-local",
      "linklocalHint": "Assign a link-local address automatically",
      "enablestp": "STP",
      "enablestpHint": "Enable spanning tree",
      "deviceId": "Device no.",
      "local-addr": "Local address",
      "remote-addr": "Remote address",
      "tunnel-local-addr": "Tunnel address (local)",
      "tunnel-remote-addr": "Tunnel address (remote)",
      "tunnel-remote-net": "Tunnel prefix",
      "greif": "Device",
      "type": "Type",
      "verify": "Verify certificate",
      "forward_tcp_upstream": "TCP to upstream",
      "forward_tcp_upstreamHint": "Forward queries over TCP",
      "forward_first": "Forward first",
      "forward_firstHint": "Forward first, then resolve locally",
      "start_addr": "From",
      "end_addr": "To",
      "subnet_mask": "Subnet mask",
      "domain_type": "Domain type",
      "vxlanid": "VNI",
      "vxlanlocal": "Local address",
      "vxlanlocalport": "Local port",
      "vxlanremote": "Remote address",
      "vxlanremoteport": "Remote port",
      "vxlangroup": "Multicast group",
      "vxlandev": "Device",
      "gifif": "Device"
    },
    "risks": {
      "management_interface": "This change affects {device}, the interface OPNexus uses to reach the firewall. The connection may drop.",
      "management_address": "The address {address} is the one OPNexus uses to reach the firewall.",
      "management_unknown": "Which interface OPNexus uses to reach this firewall cannot be determined (NAT or a CARP address). The impact cannot be judged.",
      "default_gateway": "{name} is the default gateway. Without it, traffic to the internet may fail.",
      "default_gateway_change": "The default gateway is being set or switched. All outbound traffic will take a different path afterwards.",
      "management_gateway": "{name} sits on the interface OPNexus uses to reach the firewall.",
      "default_route": "A default route ({network}) changes the path for almost all traffic.",
      "route_covers_management": "The route {network} covers the firewall's own address. Replies to OPNexus may take a different path.",
      "interface_rules_removed": "Removing it makes OPNsense itself delete {count} rule(s) that use this interface: {names}",
      "management_member": "{device} is the interface OPNexus uses to reach the firewall, and it is a member of this device. The connection may drop.",
      "tunable_change": "Tunables change how the whole system behaves; some only apply after a reboot and some can make the firewall unusable."
    },
    "warnings": {
      "carp_change": "CARP changes can trigger a switch between master and backup.",
      "cluster_peers": "This firewall is part of a cluster. The same change may be needed on {hosts} as well. VIPs and gateways are not synchronised automatically.",
      "core_interface": "{name} is a core interface of the firewall. Changes affect every rule and service on it.",
      "gateway_group_in_use": "Rules that use this gateway group lose their target."
    },
    "blocks": {
      "api_unavailable": "This firewall does not offer an API for this ({section}).",
      "nothing_to_change": "There is nothing to change.",
      "interface_api_unavailable": "This firewall is too old to configure interfaces through its API (possible from OPNsense 26.7.6). Please change it directly in OPNsense or update the firewall.",
      "interface_changes_pending": "Interface changes are already staged on the firewall and waiting to be applied. Check and apply or discard them there first.",
      "interface_locked": "The interface is locked. Remove the lock first, then delete.",
      "tunable_default_row": "This is a built-in default of the firewall. To change it, create your own entry with “Override”."
    },
    "change": {
      "title": {
        "add": "Add {kind}",
        "set": "Edit {kind}",
        "del": "Delete {kind}"
      },
      "loadFailed": "The form could not be loaded.",
      "previewFailed": "The preview could not be created.",
      "applyFailed": "The change could not be applied.",
      "keepUnchanged": "leave unchanged…",
      "toPreview": "Continue to preview",
      "back": "Back",
      "apply": "Apply now",
      "riskTitle": "Careful, this change can cut the connection",
      "noChanges": "No changes.",
      "backupNote": "A backup of the firewall configuration is saved before applying. There is no automatic rollback: if the connection drops, OPNexus cannot undo the change itself.",
      "ack": "I understand that this change can cut the connection to {host} and is not rolled back automatically.",
      "typeHost": "To confirm, type the firewall's name: {host}",
      "applied": "Change applied.",
      "verified": "Applied and checked",
      "notVerified": "Applied, check differs",
      "mismatch": "The firewall reports different values: {fields}",
      "backupId": "Backup before the change: {id}",
      "col": {
        "field": "Field",
        "before": "Before",
        "after": "After"
      },
      "invalidValue": "Invalid value.",
      "unreachable": "The change was applied, but “{host}” no longer answers on its previous address. If the management address was changed, enter the new one under Hosts › Edit. The backup taken before the change is kept.",
      "transferHint": "Apply the same change to the partner in the cluster as well? Backup node first, then the master.",
      "transfer": "Transfer to {host}"
    },
    "rowAdd": "Add",
    "rowEdit": "Edit",
    "rowDelete": "Delete",
    "hint": {
      "interfaceDescr": "Letters, digits and underscores only (no spaces or hyphens)."
    },
    "dhcp": {
      "dnsmasq": "Hosts (dnsmasq: static DHCP and DNS)",
      "keaSubnets": "Subnets (Kea)",
      "keaReservations": "Reservations (Kea)"
    },
    "objectsUnavailable": "This OPNsense version offers no API for this.",
    "override": "Override",
    "compare": {
      "loadFailed": "Could not load the comparison.",
      "noClusters": "No cluster with at least two hosts.",
      "intro": "Compares the network configuration of a cluster's nodes. Addresses, CARP advskew and the active default gateway may differ and are not compared.",
      "unreachable": "Unreachable: {hosts}",
      "same": "Identical",
      "count": "{count} difference(s)",
      "category": "Area",
      "object": "Object",
      "state": "State",
      "missing": "Missing",
      "different": "Differs",
      "absent": "missing",
      "categories": {
        "interfaces": "Interface",
        "vlans": "VLAN",
        "vips": "Virtual IP",
        "gateways": "Gateway",
        "routes": "Route",
        "dns_hosts": "DNS entry",
        "dhcp_hosts": "DHCP host",
        "kea_subnets": "DHCP subnet",
        "kea_reservations": "DHCP reservation"
      }
    }
  },
  "hostsystem": {
    "intro": {
      "tunables": "System parameters of the firewall (sysctl). The firewall's own values stay untouched; your own entries override them.",
      "cron": "Scheduled tasks the firewall runs itself.",
      "syslog": "Remote log targets the firewall sends its messages to.",
      "snapshots": "ZFS snapshots of the firewall as an extra safety net before bigger changes. Activating one (with a reboot) is deliberately left to OPNsense itself.",
      "diagnostics": "Network queries the selected firewall runs itself (reachability, paths, ports, name resolution). Results are only shown; every run is recorded with its target in the audit log."
    },
    "snapshots": {
      "create": "Create snapshot",
      "createHint": "The snapshot captures the current system state. It does not replace a configuration backup.",
      "name": "Name",
      "nameHint": "Letters, digits, dot, underscore and hyphen.",
      "note": "Note",
      "state": "State",
      "size": "Size",
      "createdAt": "Created",
      "activeNow": "active",
      "activeNext": "active after reboot",
      "unsupported": "This firewall does not support snapshots (no ZFS).",
      "created": "Snapshot “{name}” created.",
      "createFailed": "Could not create the snapshot.",
      "deleted": "Snapshot “{name}” deleted.",
      "deleteFailed": "Could not delete the snapshot.",
      "deleteConfirm": "Really delete snapshot “{name}”?"
    },
    "diag": {
      "tools": {
        "ping": "Ping",
        "traceroute": "Traceroute",
        "portprobe": "Port check",
        "dns": "DNS lookup"
      },
      "target": "Target (host or IP)",
      "name": "Name",
      "ipproto": "IP version",
      "source": "Source address (optional)",
      "sourceHint": "The firewall's own address to query from. Empty = automatic.",
      "count": "Count (1–10)",
      "packetsize": "Packet size (optional)",
      "protocol": "Protocol",
      "port": "Port",
      "server": "DNS server (optional)",
      "serverHint": "Empty = the firewall's resolvers.",
      "run": "Run",
      "running": "Running…",
      "auditNote": "Recorded in the audit log.",
      "failed": "The query failed.",
      "reachable": "Reachable",
      "unreachable": "Unreachable",
      "pingSummary": "{sent} sent, {received} received, {loss} loss",
      "hop": "Hop",
      "hostname": "Name",
      "time": "Time",
      "open": "Port {port} open",
      "closed": "Port {port} not reachable",
      "noRecords": "No answer for “{name}”."
    }
  },
  "setup": {
    "title": "Setup assistant",
    "skip": "Skip assistant",
    "stepsLabel": "Setup steps",
    "stepOf": "Step {current} of {total}",
    "back": "Back",
    "next": "Next",
    "finish": "Finish setup",
    "readOnly": "The assistant sets up the account and firewalls, so it is reserved for administrators.",
    "toDashboard": "Go to dashboard",
    "steps": {
      "welcome": "Welcome",
      "account": "Account",
      "firewall": "Firewall",
      "done": "Done"
    },
    "welcome": {
      "title": "Welcome to OPNexus",
      "intro": "OPNexus manages your OPNsense firewalls in one place: rules, NAT, VPN, certificates, updates and HA clusters. This assistant sets up the essentials in a few minutes. You can skip it at any time and reopen it later under System › Setup.",
      "points": {
        "account": "Secure the account: your own password and two-factor sign-in.",
        "firewall": "Connect your first firewall: create an API key, check the certificate, done.",
        "done": "An overview of what makes sense next."
      },
      "readOnlyNote": "The assistant only reads from your firewall. Nothing there changes until you roll something out yourself later."
    },
    "account": {
      "title": "Secure the account",
      "passwordTitle": "Your own password",
      "passwordDone": "Changed",
      "passwordIntro": "If you did not set ADMIN_PASSWORD at startup, OPNexus generated a random password. Set your own now. This step is optional.",
      "currentHint": "The password you just signed in with. Lost it? On the server: ./opnexus password",
      "newHint": "At least 10 characters. A password manager is the most convenient way.",
      "twofaTitle": "Two-factor sign-in (recommended)",
      "twofaIntro": "OPNexus can change firewalls. A second factor from an authenticator app protects the account even if the password becomes known."
    },
    "firewall": {
      "title": "Connect your first firewall",
      "intro": "OPNexus talks to your OPNsense through its REST API, which needs an API key. Creating one takes a minute.",
      "connected": "Connected firewalls",
      "recheck": "Check again",
      "offlineHelp": "Check the address and API key, and that the firewall allows web interface access from this server.",
      "keyTitle": "How to create the API key in OPNsense",
      "keySteps": {
        "menu": "In OPNsense open System › Access › Users.",
        "user": "Create a dedicated user (e.g. “opnexus”) or edit an existing one.",
        "key": "Under “API keys” on that user click the plus. Your browser downloads a file called apikey.txt.",
        "rights": "Give the user sufficient privileges, most simply the “admin” group. With fewer privileges individual features fail."
      },
      "keyFileNote": "In apikey.txt the key follows key= and the secret follows secret=. The secret exists only in this file.",
      "addFirst": "Add a firewall",
      "addAnother": "Add another firewall",
      "nameHint": "Free choice, display only. For an HA pair e.g. fw-a and fw-b.",
      "urlHint": "Address of the OPNsense web interface, with https:// and the port if needed, e.g. https://192.168.1.1:8443.",
      "clusterHint": "Is the firewall an HA pair? Add both nodes as separate firewalls and give both the same cluster name.",
      "connect": "Connect",
      "connectNote": "OPNexus checks right away whether the firewall answers."
    },
    "done": {
      "title": "Done",
      "hostsOnline": "{online} of {total} firewalls reachable",
      "noHosts": "No firewall connected yet",
      "twofaOn": "Two-factor on",
      "twofaOff": "Two-factor off",
      "nextTitle": "What you can do next",
      "next": {
        "rules": {
          "title": "Create rules",
          "text": "New rules are rolled out with a confirmation: if you do not confirm within {seconds} seconds, OPNexus rolls back automatically."
        },
        "notify": {
          "title": "Notifications",
          "text": "Get told by webhook or email when a firewall goes down or a certificate expires."
        },
        "update": {
          "title": "Updates",
          "text": "Set up the notice about new OPNexus versions and one-click updates."
        }
      },
      "backupBefore": "You back up the OPNexus database on the server with",
      "backupHelp": "Covers the database (rules, hosts, history). API secrets and keys live in their own Docker volumes and are not in the dump. See the manual for details.",
      "docs": "Documentation for the command-line tool"
    }
  }
}