v0.26.6

langs/en_US.json

@@ -123,7 +123,7 @@
     "allow": "Allow",
     "deny": "Deny",
     "aclRules": "One rule per line: allow/deny followed by CIDR",
-    "aclHelp": "Use IPv4/IPv6 CIDRs, e.g. 192.168.1.0/24 or 10.0.0.5/32. Deny wins. An allowed IP must still authenticate; a location cannot bypass the host ACL.",
+    "aclHelp": "Use IPv4/IPv6 addresses or CIDRs, e.g. 192.168.1.0/24 or 10.0.0.5. Deny wins. With an allow-only country policy, an allowed country OR an allowed IP can pass this scope; with a block-country policy, a blocked country OR denied IP is rejected. Authentication still applies.",
     "routeHeaders": "Request / response headers (JSON)",
     "headersHelp": "Operations: set, append, remove. Transport, body encoding and client-identity headers are protected.",
     "currentSession": "CURRENT SESSION",
@@ -851,7 +851,7 @@
     "vhCountryBlock": "Block listed countries",
     "vhCountryAllow": "Allow only listed countries",
     "vhCountryList": "Countries (ISO 3166-1 alpha-2)",
-    "vhCountryPolicyHelp": "Country rules use the installed GeoIP database. Allow-only mode fails closed when a client country cannot be resolved.",
+    "vhCountryPolicyHelp": "Country rules use the installed GeoIP database. In allow-only mode, a listed country OR an explicitly allowed IP can pass this vhost scope. In block mode, a listed country OR explicitly denied IP is blocked. An unresolved country fails the country branch.",
     "vhCountry": "Country",
     "vhAddCountryRate": "Add country rate limit",
     "vhCountryRateLimit": "At most 64 country-specific rate limits are allowed.",
@@ -983,7 +983,47 @@
     "aclProfileName": "Display name",
     "aclProfileIpEnabled": "Enable IP ACL",
     "aclProfileRules": "IP rules — one “allow|deny CIDR” per line",
-    "aclProfileCombineHelp": "Profile and vhost rules are restrictive: a request must pass both policies.",
+    "aclProfileCombineHelp": "Country and IP exceptions are combined with OR inside this profile. Explicit deny rules and blocked countries win; attached profile, vhost and location policies must still all pass.",
+    "aclProfilePolicyMode": "Choose the base policy",
+    "aclProfilePolicyModeHelp": "Use a guided allow-list or block-list for normal cases. Custom mode keeps full control for mixed policies.",
+    "aclProfileModeAllowExceptions": "Block by default",
+    "aclProfileModeAllowExceptionsHelp": "Allow selected countries OR selected IP/CIDR ranges.",
+    "aclProfileModeBlockExceptions": "Allow by default",
+    "aclProfileModeBlockExceptionsHelp": "Block selected countries OR selected IP/CIDR ranges.",
+    "aclProfileModeCustom": "Custom",
+    "aclProfileModeCustomHelp": "Control default action, country mode and every IP action manually.",
+    "aclProfileCountryExceptions": "Country exceptions",
+    "aclProfileUseCountries": "Use countries",
+    "aclProfileAllowedCountries": "Allowed countries (ISO codes)",
+    "aclProfileBlockedCountries": "Blocked countries (ISO codes)",
+    "aclProfileAllowedCountriesHelp": "A request from any listed country is allowed even when its IP is not listed.",
+    "aclProfileBlockedCountriesHelp": "A request from any listed country is blocked even when its IP is otherwise allowed.",
+    "aclProfileCustomCountryHelp": "Custom country behavior is controlled below. Blocked countries always deny.",
+    "aclProfileIpExceptions": "IP / CIDR exceptions",
+    "aclProfileAddIpException": "Add IP exception",
+    "aclProfileAllowedIpsHelp": "Add an IPv4/IPv6 address or CIDR. These addresses are allowed in addition to the selected countries.",
+    "aclProfileBlockedIpsHelp": "Add an IPv4/IPv6 address or CIDR. These addresses are blocked in addition to the selected countries.",
+    "aclProfileCustomIpHelp": "Each IP rule can allow or deny independently. Plain IP addresses are accepted as host rules.",
+    "aclProfileBulkExceptions": "Paste many IP addresses / CIDRs",
+    "aclProfilePreview": "Effective policy",
+    "aclProfilePreviewDefaultDeny": "DEFAULT: BLOCK",
+    "aclProfilePreviewDefaultAllow": "DEFAULT: ALLOW",
+    "aclProfilePreviewAllowedCountries": "ALLOW COUNTRY",
+    "aclProfilePreviewBlockedCountries": "BLOCK COUNTRY",
+    "aclProfilePreviewAllowedIps": "ALLOW IP",
+    "aclProfilePreviewBlockedIps": "BLOCK IP",
+    "aclProfilePreviewIpRules": "IP RULES",
+    "aclProfilePreviewNoExceptions": "No exceptions configured",
+    "aclProfilePreviewBlocksAll": "This profile currently blocks all traffic. Add a country or IP exception to allow access.",
+    "aclProfilePreviewAllowsAll": "This profile currently allows all traffic. Add a country or IP exception to block access.",
+    "aclProfilePreviewAllowNote": "Access is granted when the country OR the client IP matches an allowed exception. Explicit deny rules still win in custom policies.",
+    "aclProfilePreviewBlockNote": "Access is denied when the country OR the client IP matches a blocked exception.",
+    "aclProfilePreviewCustomNote": "Custom mode uses backend precedence: explicit IP deny and blocked country deny; allow-only countries and explicit IP allows can satisfy the same policy scope.",
+    "aclProfileOr": "OR",
+    "aclProfileCountriesShortAllow": "Allowed countries",
+    "aclProfileCountriesShortBlock": "Blocked countries",
+    "aclProfileIpsShortAllow": "Allowed IPs",
+    "aclProfileIpsShortBlock": "Blocked IPs",
     "aclProfileIpRulesShort": "IP rules",
     "aclProfileIpOff": "IP ACL disabled",
     "aclProfileCountriesOff": "Country filtering disabled",
@@ -991,6 +1031,7 @@
     "aclProfileInUse": "Profile is attached to vhosts",
     "aclProfilesEmpty": "No reusable ACL profiles yet.",
     "aclProfileCountryInvalid": "Country codes must use two-letter ISO codes.",
+    "aclProfileCountryRequired": "Add at least one country or disable country exceptions.",
     "aclProfileDuplicate": "An ACL profile with this ID already exists.",
     "vhAclProfile": "ACL profile",
     "vhAclProfileNone": "No reusable profile",