v0,28,2

langs/en_US.json

@@ -1690,14 +1690,14 @@
     "cacheTabCold": "Cold cache",
     "cacheTabDiagnostics": "Static & diagnostics",
     "certificateApiTitle": "Certificate API",
-    "certificateApiHelp": "Create separate Key ID + Bearer Token credentials for certificate deploy/reload automation. Tokens cannot read configuration or use other administration APIs.",
+    "certificateApiHelp": "Create separate Key ID + Bearer Token credentials for certificate automation. New tokens are reload-only by default and are restricted to the listed certificate IDs. Enable deploy only for automation that must upload certificate material.",
     "certificateApiKeyId": "Key ID",
     "certificateApiToken": "Bearer token (optional custom value)",
     "certificateApiTokenHelp": "Leave the field empty to generate a strong token. Each cleartext token is shown only once; RustProxy stores only its hash.",
     "certificateApiRotate": "Generate / rotate token",
     "certificateApiRevoke": "Revoke token",
     "certificateApiOneTimeToken": "Copy this token now",
-    "certificateApiCurlHelp": "External automation sends the Key ID header and Bearer token to the certificate deploy/reload endpoints over HTTPS (or loopback HTTP).",
+    "certificateApiCurlHelp": "External automation sends the Key ID header and Bearer token over HTTPS (or loopback HTTP). Reload tokens must use the targeted /api/certificates/{id}/reload endpoint; a token cannot call the global reload endpoint.",
     "certificateApiUnknown": "Loading certificate API status…",
     "certificateApiConfigured": "Certificate API enabled",
     "certificateApiDisabled": "Certificate API disabled",
@@ -1721,6 +1721,14 @@
     "connectionActivity": "CONNECTION ACTIVITY",
     "reloadCertificate": "Reload certificate",
     "certificateApiComment": "Comment",
+    "certificateApiCertificateIds": "Allowed certificate IDs",
+    "certificateApiCertificateIdsHelp": "One or more certificate IDs separated by commas or new lines. The token is rejected for every other certificate ID.",
+    "certificateApiCertificateIdsRequired": "Enter at least one certificate ID for this token.",
+    "certificateApiAllowDeploy": "Also allow deploy",
+    "certificateApiAllowDeployHelp": "Leave disabled for Certbot/acme.sh renewal hooks. Reload-only is the recommended least-privilege mode.",
+    "certificateApiScopeReloadOnly": "reload only",
+    "certificateApiScopeDeployReload": "deploy + reload",
+    "certificateApiAllowedIds": "allowed IDs",
     "certificateApiConfiguredCount": "Certificate API tokens: {count} / {max}",
     "certificateApiNeverUsed": "never used",
     "certificateApiRevokeAll": "Revoke all tokens",
@@ -1729,6 +1737,10 @@
     "certificate_api.invalid_comment": "Certificate API comments must be at most 256 characters and contain no control characters.",
     "certificate_api.limit_reached": "The Certificate API token limit has been reached.",
     "certificate_api.not_found": "Certificate API token not found.",
+    "certificate_api.invalid_certificate_ids": "Certificate API tokens require 1-32 valid certificate IDs.",
+    "certificate_api.target_required": "Certificate API tokens cannot reload every certificate at once; use the targeted certificate reload endpoint.",
+    "certificate_api.certificate_forbidden": "This Certificate API token is not allowed to operate on that certificate ID.",
+    "certificate_api.deploy_forbidden": "This Certificate API token is reload-only. Rotate it with deploy permission only if upload/deploy automation is required.",
     "networkInterfacesVisibleCount": "{visible} / {total} interfaces",
     "hideMetric": "Hide",
     "showMetric": "Show",
@@ -2187,7 +2199,8 @@
     "certificateSourceManaged": "RustProxy certificate directory (<data-dir>/certs)",
     "certificateSourceExternal": "External files (absolute paths)",
     "certificateSourceManagedHelp": "Enter filenames only, for example app.pem and app.key. RustProxy loads them from <data-dir>/certs (normally /var/lib/rustproxy/certs for a packaged service).",
-    "certificateSourceExternalHelp": "Enter absolute server paths. Certbot example: /etc/letsencrypt/live/example.com/fullchain.pem and /etc/letsencrypt/live/example.com/privkey.pem. Certbot live/ symlinks are resolved again on every reload. The rustproxy service user needs directory traversal and file read access; external private keys may use 0600 when owned by the service or 0640 with a restricted group, never world access.",
+    "certificateSourceExternalHelp": "Enter absolute server paths. Certbot example: /etc/letsencrypt/live/example.com/fullchain.pem and /etc/letsencrypt/live/example.com/privkey.pem. live/ symlinks are resolved on every reload. POSIX ACL read access is supported; RustProxy does not require an exact chmod. The private key must not be world-readable or group/world-writable, and the path must stay under root- or rustproxy-owned non-writable directories.",
+    "certificateExternalAclExample": "ACL example (grant traversal, not directory read):\nsetfacl -m u:rustproxy:--x /etc/ssl/\nsetfacl -m u:rustproxy:--x /etc/letsencrypt/ /etc/letsencrypt/live/ /etc/letsencrypt/archive/\nsetfacl -m u:rustproxy:--x /etc/letsencrypt/live/example.com/ /etc/letsencrypt/archive/example.com/\nsetfacl -m u:rustproxy:r-- /etc/letsencrypt/archive/example.com/fullchain*.pem /etc/letsencrypt/archive/example.com/privkey*.pem\nAfter renewal, reapply read ACL to the current resolved files before API reload:\nsetfacl -m u:rustproxy:r-- \"$(readlink -f /etc/letsencrypt/live/example.com/fullchain.pem)\" \"$(readlink -f /etc/letsencrypt/live/example.com/privkey.pem)\"",
     "certificateExternalFiles": "External file paths"
   }
 }