v0.28.1

langs/en_US.json

@@ -177,13 +177,13 @@
     "certificateBindings": "Certificate bindings",
     "addCertificate": "Add certificate",
     "certificateId": "Certificate ID",
-    "certificateFile": "Certificate filename",
-    "privateKeyFile": "Private key filename",
+    "certificateFile": "Certificate filename / path",
+    "privateKeyFile": "Private key filename / path",
     "defaultCertificate": "Use as the default certificate",
     "saveCertificate": "Apply certificate",
     "reloadCertificates": "Reload certificate files",
-    "certificateHelp": "Upload a PEM pair, reference files already in data/certs, or deploy an externally issued certificate with the installed RustProxy binary. Reload re-reads configured files without changing the configuration revision.",
-    "certificateHint": "External Certbot hook (standard service install): rust-proxy --data-dir /var/lib/rustproxy tls deploy --id shared-cert --cert /etc/letsencrypt/live/example/fullchain.pem --key /etc/letsencrypt/live/example/privkey.pem",
+    "certificateHelp": "Use RustProxy-managed files, absolute external paths, uploaded PEM pairs, or ACME. Managed filenames are loaded from <data-dir>/certs. External paths are read in place and can be reloaded after an outside renewal without changing the configuration revision.",
+    "certificateHint": "External renewal: keep fullchain.pem/privkey.pem paths in the certificate entry, renew them with Certbot/acme.sh, then use Reload certificate or POST /api/certificates/{certificate_id}/reload.",
     "emptyCertificates": "No explicit SNI bindings. The generated default certificate is used while the TLS listener is enabled.",
     "certificateSafety": "Certificates secure TLS connections, not routing. Assign a certificate to a vhost. Changes affect new handshakes.",
     "wsActive": "WebSocket tunnels",
@@ -724,13 +724,13 @@
     "providerOvh": "Let's Encrypt - OVH API (DNS-01)",
     "providerRfc2136": "Let's Encrypt - RFC2136 / TSIG (DNS-01)",
     "providerImport": "Import certificate and private key (PEM)",
-    "providerExisting": "Existing server files (advanced)",
-    "providerHint_http01": "Requires Certbot. Every domain must resolve to this proxy and be reachable on public TCP port 80. RustProxy serves the challenge without stopping HTTP traffic. Wildcards need DNS-01. Staging certificates are not browser-trusted; automatic renewal is not installed.",
-    "providerHint_cloudflare": "Requires Certbot + certbot-dns-cloudflare. Use a restricted API token with Zone:DNS:Edit for the necessary zones only. Supports wildcard certificates. Secrets stay in private server files.",
-    "providerHint_ovh": "Requires Certbot + certbot-dns-ovh. Supply application key, application secret and consumer key authorized for the required DNS zones. Supports wildcard certificates.",
-    "providerHint_rfc2136": "Requires Certbot + certbot-dns-rfc2136 and a DNS server accepting signed RFC2136 updates. Limit the TSIG key to the required challenge records.",
-    "providerHint_import": "Upload a matching PEM/fullchain and private key. Save in the library, then assign the certificate in a vhost SSL tab.",
-    "providerHint_existing": "Advanced: only existing private files inside the configured certificate directory. Never put private key contents in JSON.",
+    "providerExisting": "Existing server files / external paths (advanced)",
+    "providerHint_http01": "RustProxy runs Certbot HTTP-01. You do not provide certificate file paths here. Every domain must resolve to this proxy and public TCP port 80 must reach its HTTP listener. The issued pair is stored in RustProxy-managed certificate storage. Wildcards require DNS-01.",
+    "providerHint_cloudflare": "RustProxy runs Certbot DNS-01 with the Cloudflare plugin. You do not provide certificate file paths here. Use a restricted Zone:DNS:Edit API token; the issued pair is stored in RustProxy-managed certificate storage and can be renewed automatically.",
+    "providerHint_ovh": "RustProxy runs Certbot DNS-01 with the OVH plugin. You do not provide certificate file paths here. Supply credentials limited to the required DNS zones; the issued pair is stored in RustProxy-managed certificate storage and can be renewed automatically.",
+    "providerHint_rfc2136": "RustProxy runs Certbot DNS-01 with RFC2136/TSIG. You do not provide certificate file paths here. The DNS server must accept signed updates for the required challenge records; the issued pair is stored in RustProxy-managed certificate storage.",
+    "providerHint_import": "Choose certificate/fullchain and private-key PEM files from your computer. RustProxy validates the pair and copies it into <data-dir>/certs; the browser-side source path is not saved.",
+    "providerHint_existing": "Reference files already present on the RustProxy server. Choose managed filenames from <data-dir>/certs or absolute external paths such as /etc/letsencrypt/live/example.com/fullchain.pem and privkey.pem. External files are not copied into RustProxy backups.",
     "acmeCfToken": "Cloudflare API token",
     "acmeOvhEndpoint": "OVH API region",
     "acmeOvhApplicationKey": "OVH application key",
@@ -2182,6 +2182,12 @@
     "geoipIpv6ChecksumUrl": "IPv6 SHA-256 URL (optional)",
     "geoipMmdbUrl": "MaxMind DB direct URL",
     "geoipMmdbChecksumUrl": "MaxMind DB SHA-256 URL (optional)",
-    "geoipSourceHelp": "CSV mode uses separate IPv4 and IPv6 range files. MMDB mode uses one native MaxMind DB file and supports standard country.iso_code, registered_country.iso_code, or country_code records. Leave a checksum URL empty to skip publisher-checksum verification; every download is still size-bounded and format-validated before atomic publish. For a local custom MMDB, place it at <data-dir>/geoip/country.mmdb, select MMDB and disable automatic updates."
+    "geoipSourceHelp": "CSV mode uses separate IPv4 and IPv6 range files. MMDB mode uses one native MaxMind DB file and supports standard country.iso_code, registered_country.iso_code, or country_code records. Leave a checksum URL empty to skip publisher-checksum verification; every download is still size-bounded and format-validated before atomic publish. For a local custom MMDB, place it at <data-dir>/geoip/country.mmdb, select MMDB and disable automatic updates.",
+    "certificateFileSource": "File location",
+    "certificateSourceManaged": "RustProxy certificate directory (<data-dir>/certs)",
+    "certificateSourceExternal": "External files (absolute paths)",
+    "certificateSourceManagedHelp": "Enter filenames only, for example app.pem and app.key. RustProxy loads them from <data-dir>/certs (normally /var/lib/rustproxy/certs for a packaged service).",
+    "certificateSourceExternalHelp": "Enter absolute server paths. Certbot example: /etc/letsencrypt/live/example.com/fullchain.pem and /etc/letsencrypt/live/example.com/privkey.pem. Certbot live/ symlinks are resolved again on every reload. The rustproxy service user needs directory traversal and file read access; external private keys may use 0600 when owned by the service or 0640 with a restricted group, never world access.",
+    "certificateExternalFiles": "External file paths"
   }
 }