RustProxy/langs/en_US.json

{
    "meta": {
        "locale": "en-US",
        "name": "English",
        "native_name": "English",
        "direction": "ltr"
    },
    "translations": {
        "overview": "Overview",
        "mainMenu": "Menu",
        "routing": "Legacy routes",
        "configuration": "Configuration",
        "manualConfig": "Manual config",
        "runtime": "RUNTIME",
        "localOnly": "ADMINISTRATION",
        "logout": "Sign out",
        "firstSlice": "INDEPENDENT CORE / EXPLICIT ACCESS",
        "loginTitle": "Administration",
        "unlock": "Unlock administration",
        "tokenHelp": "Run this command in a second terminal and paste the token below.",
        "token": "Local access token",
        "connect": "Connect to proxy",
        "tokenNote": "Administration defaults to loopback HTTP. Enable Administration HTTPS before using a non-loopback bind.",
        "requests": "Requests",
        "activeExchanges": "Active exchanges",
        "bodyLifetime": "Full body lifetime",
        "bandwidth": "Payload transferred",
        "bothDirections": "Both directions",
        "errors": "Errors",
        "errorDescription": "5xx / body / cancelled",
        "liveTraffic": "LIVE TRAFFIC",
        "liveTransformed": "Transformed",
        "requestsPerSecond": "Requests per second",
        "live": "LIVE",
        "lastMinute": "Recent samples / resets on reload",
        "coreState": "CORE STATE",
        "configurationRevision": "Applied revision",
        "backends": "Backends",
        "routes": "Routes",
        "connections": "Open connections",
        "uptime": "Uptime",
        "activity": "ACTIVITY",
        "accessLog": "Access log",
        "boundedLog": "Last 50 / retained ring 4096",
        "time": "Time",
        "request": "Request",
        "status": "Status",
        "duration": "Duration",
        "outcome": "Outcome",
        "noTraffic": "No traffic yet. Open the proxy to make your first request.",
        "reload": "Reload configuration",
        "addBackend": "Add / edit backend",
        "backendUrl": "Backend origin (HTTP / HTTPS, IP / DNS)",
        "allowPrivate": "Explicitly allow private / loopback IP",
        "preserveHost": "Preserve original Host header",
        "saveBackend": "Save backend",
        "clear": "Clear",
        "addRoute": "Add / edit route",
        "hostnames": "Hostnames and aliases, comma-separated",
        "pathPrefix": "Path prefix (not stripped)",
        "backend": "Backend",
        "enabled": "Enabled",
        "saveRoute": "Save route",
        "rawConfig": "Configuration document",
        "export": "Export JSON",
        "configHelp": "A valid save is applied atomically. Invalid or stale changes leave the running configuration untouched.",
        "apply": "Validate, save and apply",
        "noRestart": "Routing and response policies apply live; listener changes require restart.",
        "roadmapHelp": "Release details and planned features are documented in ROADMAP.md.",
        "overviewTitle": "Traffic, in focus.",
        "overviewDescription": "Traffic, cache and operating-system measurements in one compact dashboard.",
        "routingTitle": "Connect the right dots.",
        "routingDescription": "Existing backend/route format remains supported. New deployments can use one vhost with its own frontend and pool.",
        "configurationTitle": "One source of truth.",
        "configurationDescription": "One canonical configuration: vhosts, listeners and shared policies.",
        "connected": "CONNECTED TO LOCAL CORE",
        "disconnected": "CORE NOT REACHABLE",
        "edit": "Edit",
        "remove": "Delete",
        "privateAllowed": "PRIVATE IP APPROVED",
        "configured": "CONFIGURED / NOT PROBED",
        "disabled": "DISABLED",
        "emptyBackends": "No backends configured. Add an explicit HTTP or HTTPS origin.",
        "emptyRoutes": "No routes configured. Unknown hosts return 404.",
        "saving": "Saving…",
        "unsavedChanges": "Unsaved changes",
        "saved": "Configuration applied.",
        "confirmDelete": "Delete this item? The change takes effect immediately.",
        "confirmTitle": "Confirm action",
        "confirmationLabel": "CONFIRMATION",
        "warningLabel": "WARNING",
        "continueAction": "Continue",
        "cancelAction": "Cancel",
        "discardAction": "Discard changes",
        "errorContext": "{area}: {message}",
        "stale": "Configuration changed elsewhere. Reload before saving.",
        "busy": "A save is already in progress.",
        "loginError": "Sign-in failed.",
        "fresh": "Configuration reloaded.",
        "locked": "Signed out. The session was revoked.",
        "backendUsed": "This backend is referenced by a route. Delete or change the route first.",
        "renaming": "IDs cannot be renamed in this form. Use the JSON editor to update references atomically.",
        "complete": "complete",
        "cancelled": "cancelled",
        "body_error": "body error",
        "proxy_or_upstream_error": "proxy/upstream error",
        "security": "Security",
        "sessionNote": "Local HTTP administration. Passwords use Argon2id and session cookies are HttpOnly. Do not expose the panel publicly.",
        "setupHelp": "Create the first administrator using a one-time capability from the local terminal.",
        "setupToken": "One-time setup token",
        "username": "Username",
        "password": "Password",
        "confirmPassword": "Confirm password",
        "setupTitle": "Create your administrator",
        "signIn": "Sign in",
        "createAndSignIn": "Create account and sign in",
        "securityTitle": "Access stays deliberate.",
        "securityDescription": "One administrator. Revocable sessions. Explicit host and route access policies.",
        "manualBackends": "MANUAL BACKENDS",
        "routePolicies": "Access policy and custom headers",
        "useRouteAcl": "Enable route ACL",
        "aclDefault": "Default action",
        "allow": "Allow",
        "deny": "Deny",
        "aclRules": "One rule per line: allow/deny followed by CIDR",
        "aclHelp": "Use IPv4/IPv6 addresses or CIDRs, e.g. 192.168.1.0/24 or 10.0.0.5. Deny wins. With an allow-only country policy, an allowed country OR an allowed IP can pass this scope; with a block-country policy, a blocked country OR denied IP is rejected. Authentication still applies.",
        "routeHeaders": "Request / response headers (JSON)",
        "headersHelp": "Operations: set, append, remove. Transport, body encoding and client-identity headers are protected.",
        "currentSession": "CURRENT SESSION",
        "recoveryHelp": "Lost access? Run rust-proxy admin reset-password locally. Existing sessions will be revoked.",
        "revokeAll": "Sign out all sessions",
        "changePassword": "Change password",
        "currentPassword": "Current password",
        "newPassword": "New password (12-128 UTF-8 bytes)",
        "savePassword": "Change and sign out",
        "hostPolicies": "Host access policies",
        "editHostPolicy": "Add / replace host policy",
        "savePolicy": "Apply host policy",
        "auditRetention": "SQLITE / LAST 100 / RETAINED 10,000",
        "audit": "Administration audit",
        "reloadAudit": "Reload",
        "actor": "Actor",
        "action": "Action",
        "detail": "Detail",
        "noAudit": "No audit entries.",
        "noPolicies": "No host ACLs. Route ACLs may still restrict access.",
        "expires": "Absolute session expiry: ",
        "passwordChanged": "Password changed. All sessions were revoked. Sign in again.",
        "passwordMismatch": "The passwords do not match.",
        "ruleSyntax": "Use one rule per line, for example: allow 127.0.0.1/32",
        "confirmRevoke": "Sign out every administrator session, including this one?",
        "streamLive": "SSE live",
        "streamFallback": "Polling fallback",
        "auth.required": "Your session expired or was revoked. Sign in again.",
        "auth.invalid_credentials": "Incorrect username or password.",
        "auth.password_policy": "The password must contain 12-128 UTF-8 bytes and no line breaks.",
        "auth.invalid_username": "Use 3-64 letters, digits, dots, dashes or underscores.",
        "auth.invalid_setup_token": "The setup token is invalid. Read it from the local terminal.",
        "auth.already_initialized": "An administrator already exists. Sign in.",
        "auth.rate_limited": "Too many attempts. Retry after 60 seconds or use local password recovery.",
        "auth.busy": "Password workers are busy. Retry shortly.",
        "auth.csrf": "Request protection failed. Reload the page and retry.",
        "auth.invalid_host": "Use the configured administration address and allowed hostname.",
        "auth.invalid_origin": "Cross-origin administration is blocked.",
        "auth.credentials_changed": "Credentials changed concurrently. Sign in again.",
        "auth.unavailable": "Administration storage is temporarily unavailable.",
        "events.too_many_viewers": "Live viewer limit reached; polling is available.",
        "protocol": "Upstream protocol",
        "protocolHelp": "HTTP/2 and auto use the backend authority. Preserve Host is available with HTTP/1.1 only. RFC 8441 can use an explicit HTTP/2 upstream; other WebSocket transports bridge through HTTP/1.1.",
        "addressAllowlist": "Optional address allowlist (CIDR, one per line)",
        "caPem": "Additional trusted CA / certificate (PEM, optional)",
        "backendTlsHelp": "TLS encryption remains available, but certificate/hostname verification is off unless enabled explicitly. Private addresses still need explicit approval, including DNS answers.",
        "advancedTransport": "Transport and trust",
        "tls": "Certificates",
        "tlsTitle": "Encrypted, deliberately.",
        "tlsDescription": "Exact SNI names. Private local certificate files. Apply bindings without restarting.",
        "certificateBindings": "Certificate bindings",
        "addCertificate": "Add certificate",
        "certificateId": "Certificate ID",
        "certificateFile": "Certificate filename / path",
        "privateKeyFile": "Private key filename / path",
        "defaultCertificate": "Use as the default certificate",
        "saveCertificate": "Apply certificate",
        "reloadCertificates": "Reload certificate files",
        "certificateHelp": "Use RustProxy-managed files, absolute external paths, uploaded PEM pairs, or ACME. Managed filenames are loaded from <data-dir>/certs. External paths are read in place and can be reloaded after an outside renewal without changing the configuration revision.",
        "certificateHint": "External renewal: keep fullchain.pem/privkey.pem paths in the certificate entry, renew them with Certbot/acme.sh, then use Reload certificate or POST /api/certificates/{certificate_id}/reload.",
        "emptyCertificates": "No explicit SNI bindings. The generated default certificate is used while the TLS listener is enabled.",
        "certificateSafety": "Certificates secure TLS connections, not routing. Assign a certificate to a vhost. Changes affect new handshakes.",
        "wsActive": "WebSocket tunnels",
        "h2Requests": "HTTP/2 requests",
        "h2ActiveConnections": "Active H2 connections",
        "tlsFailures": "TLS handshake errors",
        "tlsListener": "TLS listener",
        "notEnabled": "Disabled",
        "websocket_closed": "WebSocket closed",
        "defaultLabel": "DEFAULT",
        "language": "Language",
        "settings": "Settings",
        "settingsTitle": "Configure your edge.",
        "settingsDescription": "Switch between function tabs. Unsaved changes stay in their forms.",
        "cacheHitRatio": "Cache hit ratio",
        "processMemory": "Process memory",
        "systemLoad": "SYSTEM LOAD",
        "systemChart": "Recent system CPU usage",
        "systemMemory": "System RAM",
        "systemSwap": "System swap",
        "systemUptime": "System uptime",
        "loadAverage": "Load 1 / 5 / 15 min",
        "cacheOverview": "RAM cache",
        "cacheObjects": "Objects / memory",
        "cacheEvictions": "Evicted / expired",
        "processDiagnostics": "Process",
        "platform": "Platform",
        "processCpu": "CPU (100% = 1 core)",
        "fileDescriptors": "File descriptors / limit",
        "processThreads": "OS threads",
        "processVirtualMemory": "Virtual memory / limit",
        "processStartTime": "Process start",
        "containerMemory": "cgroup RAM / limit",
        "networkDiagnostics": "Network and responses",
        "hostScope": "OS scope",
        "networkRate": "RX / TX per second",
        "meanLatency": "Mean exchange duration",
        "filterLogs": "Filter host or path",
        "filterResult": "Filter result",
        "allResults": "All results",
        "routeCache": "Route cache policy",
        "inheritCache": "Inherit global policy",
        "bypassCache": "Always bypass",
        "listeners": "Listeners",
        "httpConnections": "HTTP connections",
        "httpConnectionsHelp": "Connection lifecycle and transport limits for HTTP/2 and HTTP/3.",
        "http2Tab": "HTTP/2",
        "http3Tab": "HTTP/3",
        "http2Settings": "HTTP/2 connections",
        "http2SettingsHelp": "HTTP/2 enablement is controlled per listener. Tune idle, maximum lifetime and graceful GOAWAY drain limits here.",
        "http2IdleTimeout": "Idle timeout (seconds)",
        "http2MaxLifetime": "Maximum connection lifetime (seconds, 0 = disabled)",
        "http2DrainTimeout": "Drain timeout (seconds)",
        "http2DrainHelp": "These limits apply to this listener. Idle timeout applies only to unused connections; maximum lifetime is absolute; drain bounds active streams after GOAWAY. Changes require restart.",
        "http2Save": "Save HTTP/2 settings",
        "http2NoEnabledListeners": "No listener has HTTP/2 enabled. Enable HTTP/2 or h2c in Settings > Listeners first.",
        "http2ListenersDirty": "Save pending listener changes before editing HTTP/2 settings.",
        "restartLabel": "RESTART",
        "listenersHelp": "Named IP and port bindings. Changes require restart. The administration endpoint remains separate.",
        "httpAddress": "HTTP bind address and port",
        "httpsAddress": "HTTPS bind address and port",
        "enableHttps": "Enable HTTPS listener",
        "lowPortsHelp": "Privileged ports may need CAP_NET_BIND_SERVICE. Do not run the whole application as root.",
        "saveListeners": "Save listeners",
        "inheritListeners": "Use startup defaults",
        "responseSettings": "Client response",
        "hotApply": "LIVE APPLY",
        "serverHeader": "Server header",
        "serverPreserve": "Preserve origin value",
        "serverHide": "Hide completely",
        "serverCustom": "Replace / add custom value",
        "serverValue": "Custom Server value",
        "compression": "Streaming compression",
        "compressionMin": "Minimum response size (bytes)",
        "compressionHelp": "Negotiates Accept-Encoding using client q-values and zstd → br → gzip → deflate as the server preference for equal quality. Cookies, Authorization, Set-Cookie, private and no-store responses may be compressed. Existing Content-Encoding, ranges, SSE, upgrades and no-transform are passed through.",
        "saveResponse": "Apply response settings",
        "cacheSettings": "Cache",
        "enableCache": "Enable cache",
        "cacheSafety": "Complete public-safe GET responses are cached. Authorization, cookies and private/no-store responses still bypass. One byte range can be served from a complete cached object; multipart/unsupported ranges pass through.",
        "cacheMemory": "HOT allocated budget (MiB)",
        "cacheObject": "Maximum object (KiB)",
        "cacheEntries": "Maximum entries",
        "cacheMaxTtl": "Maximum TTL (seconds)",
        "cacheDefaultTtl": "Fallback TTL for public responses (0 = off)",
        "bypassQuery": "Bypass URLs with a query string",
        "cachePrefixes": "Bypass path prefixes, one per line",
        "cacheAgeHelp": "Age is sent on cache hits unless an explicit response-header rule removes or replaces it. Such Age rules are wire-only and do not change cache freshness. Counters remain available even when diagnostic headers are hidden. Only cache-affecting configuration changes invalidate incompatible objects; managed software updates hand hot objects to cold storage when the cold tier is enabled.",
        "saveCache": "Apply cache policy",
        "purgeCache": "Purge all cache",
        "customHeaders": "Global custom headers",
        "globalHeadersHelp": "Request rules go to the backend; response rules go to the client. Route rules run after global rules. Server policy takes final precedence.",
        "responseHeaders": "Response to client",
        "requestHeaders": "Request to backend",
        "addHeader": "Add header rule",
        "saveHeaders": "Apply header rules",
        "unavailable": "N/A",
        "threads": "threads",
        "realSample": "Measured",
        "noKnownLimit": "unknown / unlimited",
        "unlimited": "unlimited",
        "restartPending": "Saved listener changes are pending. Restart RustProxy to apply them.",
        "activeListeners": "Currently active",
        "headerLimit": "At most 32 rules per direction.",
        "headerOperation": "Operation",
        "header_set": "Set",
        "header_append": "Append",
        "header_remove": "Remove",
        "headerName": "Header name",
        "headerValue": "Header value",
        "confirmInherit": "Restore listener defaults from startup flags and environment on the next restart?",
        "confirmPurge": "Purge every cached object and cancel all pending cache fills?",
        "cachePurged": "Cache purged; removed entries",
        "logsDropped": "dropped",
        "updateAvailable": "New version",
        "vhosts": "Vhosts",
        "vhostsTitle": "Virtual hosts & backends",
        "vhostsDescription": "Manage hostnames, frontend bindings, backends and per-host policies.",
        "vhHealthTitle": "Backends",
        "vhManage": "Manage vhosts",
        "vhHealthEmpty": "No backend diagnostics yet.",
        "vhVhost": "Vhost",
        "vhActive": "Active",
        "vhRequests": "Requests",
        "vhErrors": "Errors",
        "vhLatency": "Latency (EWMA)",
        "vhTraffic": "Traffic/s",
        "vhClientGeneration": "Client gen.",
        "vhGenerationRequests": "Gen. requests",
        "vhGenerationAge": "Gen. age",
        "vhClientRotations": "Rotations",
        "vhIntro": "Each vhost owns its bound IPs, paths and backends. Unlisted addresses cannot reach it. Listener changes require restart.",
        "vhList": "Virtual hosts",
        "vhSearch": "Search vhosts",
        "vhSearchPlaceholder": "Search hostname, vhost or backend",
        "vhSearchEmpty": "No vhosts match this search.",
        "vhNew": "New vhost",
        "vhMigrate": "Migrate a legacy route group",
        "vhImport": "Load into editor",
        "vhMigrationHint": "Migration is saved atomically. Routes sharing one host and one backend are grouped; ambiguous host ownership is rejected.",
        "vhEditor": "Vhost configuration",
        "vhReset": "Discard changes",
        "vhSafetyHint": "Private IP binding is not authentication. Keep firewall/ACL rules. HSTS preload is opt-in; affinity cookies are not login sessions.",
        "vhId": "Vhost ID",
        "vhHosts": "Hostnames",
        "vhEnabled": "Enabled",
        "vhFrontends": "Frontends / bound addresses",
        "vhAddFrontend": "Add frontend",
        "vhAddress": "IP:port (IPv6: [address]:port)",
        "vhTls": "TLS enabled",
        "vhHttp2": "Prefer HTTP/2 over TLS; retain HTTP/1.1",
        "vhBackendPool": "Backends",
        "vhAddBackend": "Add backend",
        "vhMemberId": "Backend ID",
        "vhUrl": "Origin URL",
        "vhWeight": "Weight",
        "vhBackup": "Backup only",
        "vhDrain": "Drain new sessions",
        "vhPrivate": "Allow private origin IP",
        "vhPreserveHost": "Preserve client Host (HTTP/1.1 only)",
        "vhProtocol": "Origin protocol",
        "vhProtocolHttp1": "HTTP/1.1",
        "vhProtocolAuto": "TLS ALPN: HTTP/2 + HTTP/1.1",
        "vhProtocolHttp2": "HTTP/2 (TLS: with HTTP/1.1 fallback; plaintext: h2c)",
        "vhAddressAllowlist": "Origin IP/CIDR allowlist (optional)",
        "vhTlsServerName": "TLS server name / SNI (optional)",
        "vhTlsVerify": "Verify backend certificate and hostname",
        "vhTlsVerifyHelp": "Disabled when omitted. Enable it when RustProxy must validate the backend certificate chain and identity. If verification fails, set TLS server name to a DNS name present in the certificate and/or add the private CA PEM. Do not use an IP address as SNI.",
        "vhCa": "Additional trusted CA (PEM, optional)",
        "vhBalancing": "Balancing & connection reuse",
        "vhAlgorithm": "Algorithm",
        "vhRoundRobin": "Smooth weighted round-robin",
        "vhLeastConnections": "Weighted least active exchanges",
        "vhLeastTraffic": "Weighted least traffic (EWMA)",
        "vhAdaptive": "Adaptive: activity + latency + traffic",
        "vhIpHash": "Client IP hash",
        "vhSlowStart": "Recovery slow-start (seconds)",
        "vhRetryMax": "Failover retries",
        "vhRetryConnect": "Retry connection failures",
        "vhRetryTimeouts": "Retry response-header timeouts",
        "vhRetryStatuses": "Retry HTTP statuses",
        "vhRetryHelp": "Retries are limited to body-free GET, HEAD and OPTIONS requests, use a different healthy backend and never replay WebSocket or write requests.",
        "vhKeepalive": "Reuse upstream connections (keepalive)",
        "vhIdleTimeout": "Idle pool timeout (seconds)",
        "vhMaxIdle": "Max idle connections / origin",
        "vhTcpKeepalive": "TCP / HTTP/2 keepalive interval (seconds)",
        "vhHealth": "Backend health",
        "vhHealthMode": "Check type",
        "vhOff": "Off",
        "vhTcp": "TCP connect",
        "vhHttp": "HTTP status + response time",
        "vhHealthPath": "HTTP check path",
        "vhHealthHost": "HTTP Host override (optional)",
        "vhInterval": "Interval (ms)",
        "vhTimeout": "Timeout (ms)",
        "vhSlow": "Slow threshold (ms; 0 = off)",
        "vhFall": "Failures before down",
        "vhRise": "Successes before recovery",
        "vhStatusMin": "Minimum HTTP status",
        "vhStatusMax": "Maximum HTTP status",
        "vhHealthNote": "HTTP probes use HTTP/1.1 and measure time to headers, not body duration. When Host override is blank, RustProxy automatically uses the first exact DNS hostname of the vhost; if none exists it falls back to the backend host. Use TCP for h2c-only services. New backends wait for successful probes. Active health is independent from passive health.",
        "vhPassiveHealth": "Passive Backend Health",
        "vhPassiveEnabled": "Allow normal request failures to mark a backend unhealthy",
        "vhPassiveHelp": "Off by default. Errors are still logged and counted, but normal user traffic cannot change backend health until this is explicitly enabled.",
        "vhPassiveConnect": "Count connection errors",
        "vhPassiveTimeouts": "Count timeouts",
        "vhPassiveIo": "Count body/read/write I/O errors",
        "vhPassive5xx": "Count HTTP 5xx responses",
        "vhPassiveSlow": "Count slow responses",
        "vhPassiveFall": "Passive failures before down (empty = active fall)",
        "vhPassiveRise": "Passive successes before recovery (empty = active rise)",
        "vhPassiveWarning": "Enabling HTTP 5xx or slow-response failures can quarantine the whole backend after repeated errors from a single endpoint.",
        "vhSticky": "Sticky sessions",
        "vhStickyMode": "Affinity mode",
        "vhCookie": "Opaque proxy cookie",
        "vhCookieName": "Cookie name (empty = per-vhost default)",
        "vhCookieTtl": "Cookie lifetime (seconds)",
        "vhStickyNote": "Cookie affinity bypasses shared cache. Drain preserves existing cookie sessions. IP affinity uses the verified client IP under the configured trusted-proxy policy.",
        "vhSecurity": "Security",
        "vhHsts": "Enable HSTS (TLS responses only)",
        "vhHstsAge": "HSTS max-age (seconds)",
        "vhHstsSub": "HSTS includeSubDomains",
        "vhHstsPreload": "HSTS preload (explicit opt-in)",
        "vhNosniff": "X-Content-Type-Options: nosniff",
        "vhFrame": "X-Frame-Options",
        "vhPreserve": "Preserve origin value",
        "vhDeny": "DENY",
        "vhSameorigin": "SAMEORIGIN",
        "vhReferrer": "Referrer-Policy (optional)",
        "vhCsp": "Content-Security-Policy (optional)",
        "vhPermissions": "Permissions-Policy (optional)",
        "vhAdvanced": "Advanced: paths, ACL and custom headers",
        "vhPaths": "Paths (JSON; optional backend_id pins a path to a single pool member)",
        "vhAcl": "Vhost ACL (JSON or null)",
        "vhHeaders": "Request / response header rules (JSON)",
        "vhEmpty": "No vhosts yet. Existing routes continue to work.",
        "vhUnsaved": "Discard unsaved vhost changes?",
        "vhDelete": "Remove this vhost? Bound sockets are closed after restart.",
        "vhConflict": "That vhost ID already exists.",
        "vhRowLimit": "The maximum number of rows has been reached.",
        "vhMigrationAmbiguous": "Hostnames overlap other legacy routes. Resolve ownership in JSON before migration.",
        "vhMigrationPending": "Legacy migration will be committed with this save.",
        "vhMigrationNone": "Select a legacy route",
        "vhJsonInvalid": "Invalid JSON or data type in paths, ACL or headers.",
        "vhUp": "Up",
        "vhDown": "Down",
        "vhChecking": "Checking",
        "vhDraining": "Draining",
        "vhDisabled": "Disabled",
        "vhHealthDisabled": "Checks off",
        "vhHealthUnknown": "Unknown",
        "vhNewLabel": "NEW",
        "vhEditLabel": "EDIT",
        "vhFrontendNote": "Use an IP assigned to this machine. A wildcard accepts every IP in its address family; host routing still checks the local destination. TLS certificates are configured in the TLS tab.",
        "close": "Close",
        "inherit": "Inherit",
        "liveLogs": "Live logs",
        "logVhost": "Filter by vhost",
        "logAllVhosts": "All vhosts",
        "logAllMethods": "All methods",
        "logPause": "Pause",
        "logPaused": "PAUSED",
        "logResume": "Resume",
        "logPin": "Dock",
        "logUndock": "Open as modal",
        "logColumns": "Columns",
        "logColumnsRequired": "At least one Live Logs column must remain visible.",
        "logLoadHistory": "Increase buffer",
        "logHistoryLoaded": "Live buffer increased to {count} retained entries.",
        "logHost": "Host",
        "logBufferHint": "Live view starts with the latest 256 completed exchanges. Increase buffer to seed it with retained history and keep accumulating live entries up to 4096 until the log window is closed. Export includes the currently filtered rows.",
        "settingsSecurityHint": "Accounts and ACLs are global. SSL, HSTS, headers and cache are also configured inside each vhost.",
        "theme": "Theme",
        "themeDark": "Dark",
        "themeLight": "Light",
        "density": "Interface density",
        "densityCompact": "Compact",
        "densityDense": "Dense",
        "densityComfortable": "Comfortable",
        "globalPages": "Default responses",
        "pagesHelp": "Pages for direct IP, unknown hosts and errors. An empty status selector preserves the original status. Static pages do not contact the upstream.",
        "pageInherit": "Default / inherited",
        "pageWelcome": "Congratulations page",
        "pageEmpty": "Empty response",
        "pageHtml": "Custom HTML",
        "pageStatus": "Response status",
        "pageOriginalStatus": "Original status",
        "pageHtmlSource": "HTML source",
        "pageUploadHtml": "Optional HTML file (32 KiB maximum)",
        "pageTooLarge": "HTML must not exceed 32 KiB in UTF-8.",
        "customErrorPages": "Custom error pages",
        "pageStaticHost": "Static / maintenance host",
        "pageMissingPath": "Unmatched path",
        "pageDirectIp": "Direct IP access",
        "pageUnknownHost": "Unknown hostname",
        "pagesSafetyHint": "HTML is public content, not an admin template. ACLs still run first. Explicit HTTP 200 for an error masks its status to clients and monitoring. Total configuration size is limited.",
        "vhDetailsTab": "Details",
        "vhSsl": "SSL certificates",
        "vhCertificate": "Named certificate",
        "vhCertificateDefault": "Global SNI / default certificate",
        "vhCertificateFile": "Certificate / full chain (PEM)",
        "vhPrivateKeyFile": "Private key (PEM)",
        "vhUploadCertificate": "Upload and validate pair",
        "vhSelectCertificateFiles": "Choose both a certificate and private key file.",
        "vhCertificateTooLarge": "Each PEM file is limited to 128 KiB.",
        "vhCertificateNeedsHosts": "Enter vhost domain names in Details first.",
        "vhCertificateStaged": "Pair verified and staged. Save this vhost to activate its certificate.",
        "vhCertificateUploadHint": "Optional upload verifies key match and domain coverage. Private keys are stored in private files, never returned by the API. Save the vhost to activate the selection. Uploads do not save other changes. Listener changes require restart.",
        "vhCompression": "Compression",
        "vhCompressionHelp": "Compression and each codec inherit by default. A scope can filter globally enabled codecs; it cannot activate a codec disabled in Settings → Response. Minimum size remains global.",
        "compressionEnabled": "Dynamic compression",
        "compressionZstd": "Zstandard (zstd)",
        "compressionBr": "Brotli (br)",
        "compressionGzip": "gzip",
        "compressionDeflate": "deflate",
        "vhCache": "Cache",
        "vhCacheTtl": "Maximum TTL (seconds, blank inherits)",
        "vhCacheDefault": "Public default TTL (blank inherits)",
        "vhCacheObject": "Object limit (KiB, blank inherits)",
        "cacheEnabled": "Enable cache",
        "cacheBypassQuery": "Bypass query strings",
        "cacheStatusHeader": "Expose X-Cache",
        "cacheHitsHeader": "Expose X-Cache-Hits",
        "cacheRfcHeader": "Expose Cache-Status",
        "cacheBypassPrefixes": "Bypass path prefixes",
        "vhCacheCustomPrefixes": "Override inherited bypass paths",
        "vhCacheHint": "Per-host policy can enable caching independently of the global default. All vhosts share global RAM and entry ceilings. Cookie affinity, private responses and authorization still bypass cache.",
        "vhPurgeCache": "Purge host cache",
        "vhPurgeConfirm": "Purge only this vhost cache? In-progress fills for this host will also be invalidated.",
        "vhPages": "Error pages",
        "vhHeadersOrder": "Order: global rules, vhost rules, path rules, then security/Server policy. Advanced JSON remains available.",
        "vhNewHealthHint": "Save the vhost to start observing its backend health.",
        "listenerAdd": "Add listener",
        "listenerMigrate": "Convert defaults to named listeners",
        "listenerScopeHint": "Internal / public is a label, not a firewall. New listeners do not expose legacy routes unless explicitly selected.",
        "listenerLimit": "Maximum 64 named listeners.",
        "listenerEndpoint": "Listener",
        "listenerName": "Display name",
        "listenerScope": "Label",
        "listenerInternal": "Internal",
        "listenerPublic": "Public",
        "listenerLegacy": "Allow legacy routes",
        "listenerInUse": "Listener is assigned to vhosts",
        "listenerDuplicate": "Listener IDs must be unique.",
        "listenerChooseHint": "Select named listeners configured in Settings > Listeners. A disabled listener grants no access.",
        "listenerMissing": "Missing listener",
        "http3Settings": "HTTP/3 / QUIC",
        "http3SettingsHelp": "HTTP/3 enablement is controlled in Settings > Listeners. Tune advertisement, connection and stream limits here.",
        "http3NoTlsListeners": "No TLS listeners are configured. Add and save a TLS listener first.",
        "http3NoEnabledListeners": "No TLS listener has HTTP/3 enabled. Enable HTTP/3 in Settings > Listeners first.",
        "http3ListenersDirty": "Save pending listener changes before editing HTTP/3 settings.",
        "http3Save": "Save HTTP/3 settings",
        "h2Configure": "Configure HTTP/2 limits",
        "h3Enable": "Enable HTTP/3 over QUIC (UDP)",
        "h3Configure": "Configure HTTP/3 limits",
        "h3Limits": "HTTP/3 limits and advertisement",
        "h3_alt_svc_max_age": "Alt-Svc lifetime (s)",
        "h3_max_concurrent_connections": "Connections per listener",
        "h3_max_concurrent_bidistream": "Bidirectional streams per connection",
        "h3_max_concurrent_unistream": "Unidirectional streams per connection",
        "h3_max_idle_timeout": "QUIC idle timeout (s; 0 = unlimited)",
        "h3Help": "HTTP/3 requires TLS. Keep TCP plus the same UDP port available; HTTP/1.1 and HTTP/2 remain. Zero disables the local QUIC idle timeout. Changes require restart.",
        "h3TuningHelp": "These limits apply only when HTTP/3 is enabled for this TLS listener. Changes require restart.",
        "h3Requests": "HTTP/3 requests",
        "certImport": "Import certificate",
        "certImportSave": "Import and save in library",
        "certLibraryHint": "Upload fullchain/certificate and private key in PEM. Save once, then assign the certificate to one or more vhosts.",
        "certCheckDomains": "Domains to verify (comma-separated)",
        "certAcmeLater": "Issued certificates are imported into the library and assigned per vhost.",
        "certAdvanced": "Existing files / advanced",
        "certLegacyNames": "Legacy SNI names (optional; prefer per-vhost assignment)",
        "certAssigned": "Assigned vhosts",
        "certUnassigned": "Not assigned",
        "certInUse": "Certificate is in use. Reassign vhosts and change the default before removal.",
        "certDuplicate": "This certificate ID exists. Use a new ID for safe rotation.",
        "certManage": "Manage certificate library",
        "certSelectHint": "Select an imported certificate. Uploads and rotation are in the Certificates tab. Assignments are validated against vhost names.",
        "vhTinyauth": "Authentication and IP access",
        "vhTabAuth": "Authentication",
        "taEnable": "Enable Tinyauth protection",
        "taUrl": "Tinyauth URL / verification endpoint",
        "taLogin": "Public login URL",
        "taRedirectForbidden": "Accept same-origin provider redirects for 403",
        "taConnect": "Connect timeout (s)",
        "taTimeout": "Total verification timeout (s)",
        "taRequestHeaders": "Client headers sent to Tinyauth",
        "taResponseHeaders": "Verified identity headers sent to application",
        "taHelp": "An origin URL adds /api/auth/nginx automatically. Verification is body-free and runs before cache and WebSocket upgrades. Protected responses use private, no-store. Configure Tinyauth to trust the actual RustProxy IP.",
        "vhResponsePolicy": "Response identity and diagnostics",
        "vhInherit": "Inherit global settings",
        "diagnosticHeaders": "Diagnostic response headers",
        "diagInherit": "Inherit diagnostic headers",
        "diagRequestId": "Expose X-Request-ID",
        "hideMockOrigin": "Hide X-Mock-Origin",
        "diagHelp": "X-Request-ID is opt-in. Other upstream response headers are controlled with ordinary response-header rules.",
        "forwardingSettings": "Client identity / forwarding",
        "forwardingHelp": "By default, client-supplied forwarding headers are discarded. Add only immediate proxies you control. Trusted chains are evaluated right-to-left, stopping at the first untrusted address.",
        "forwardingCanonical": "RustProxy generates Forwarded, X-Forwarded-For, X-Real-IP, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port and X-Forwarded-URI. Socket destination never comes from a header.",
        "trustedProxies": "Trusted proxy CIDRs (one per line; /32 for one IPv4, /128 for one IPv6)",
        "trustForwardedProto": "Trust X-Forwarded-Proto only from trusted proxies",
        "listenerId": "Listener ID",
        "cache": "Cache",
        "cacheTitle": "Cache, explained.",
        "cacheDescription": "Objects, domain effectiveness and precise decisions.",
        "cacheRefresh": "Refresh",
        "cacheLive": "Live (3 s)",
        "cachePurgeScope": "Purge selected scope",
        "cacheObjectCount": "Resident objects",
        "cacheSaved": "Body bytes served from RAM",
        "cacheCounterScope": "Domain counters since configuration revision",
        "cacheDomains": "Domains and effectiveness",
        "cacheScopeHint": "Memory limits, fills and evictions are global. Domain counters reset on configuration publication; purging objects does not reset counters.",
        "cacheDomain": "Domain",
        "cacheReasons": "Decision counters",
        "cacheNoDomains": "No cache decisions yet. Send traffic to a configured host.",
        "cacheObjectList": "Stored objects",
        "cachePrevious": "Previous",
        "cacheNext": "Next",
        "cacheObjectHint": "Most recently used first. Click Target or Cache key / tags to copy the full value. Bodies and request headers are not exposed.",
        "cachePath": "Path",
        "cacheBodySize": "Body",
        "cacheAge": "Age",
        "cacheTtlRemaining": "Remaining TTL",
        "cacheNoObjects": "No fresh objects in this scope. Inspect the decision counters above.",
        "cacheLegacy": "Unassigned",
        "cacheGlobalLimit": "Global limit",
        "cacheFills": "Active fills (global)",
        "cacheRejected": "Rejected fills (global)",
        "cacheUpdated": "Updated",
        "acmeTitle": "Let's Encrypt / ACME",
        "acmeHelp": "Issue an ACME certificate, add it to the library, then assign it to a vhost. Automatic renewal starts after import.",
        "acmeEmail": "ACME contact email",
        "acmeDomains": "DNS names, comma-separated (wildcards only with DNS-01)",
        "acmeEnvironment": "CA environment",
        "acmeStaging": "Staging - not browser-trusted",
        "acmeProduction": "Production",
        "acmeDnsServer": "DNS update server IP",
        "acmeDnsPort": "DNS update port",
        "acmeKeyName": "TSIG key name",
        "acmeSecret": "TSIG secret (base64)",
        "acmeAlgorithm": "TSIG algorithm",
        "acmePropagation": "DNS propagation wait (seconds)",
        "acmeSignQuery": "Sign SOA discovery query",
        "acmeTos": "I accept the Let's Encrypt subscriber agreement and authorize domain validation.",
        "acmeConfirmProduction": "I confirm production issuance (CA rate limits apply).",
        "acmeIssue": "Request certificate",
        "acmeIdle": "No issuance job in this process.",
        "acmeImport": "Add issued certificate to library",
        "acmeRenewalHint": "Initial issuance/import remains explicit. Managed certificate profiles are then checked automatically while RustProxy is running; saved renewal status is restored from SQLite after restart.",
        "acmeReplace": "Replace the existing library certificate? Current vhost assignments will be retained and revalidated.",
        "acmeImported": "Certificate saved. Assign it in the vhost SSL tab.",
        "certFuture": "Managed automatic renewal is available for supported ACME providers; saved renewal observations are persisted in SQLite.",
        "cacheReason_cache_hit": "Fresh object reused",
        "cacheReason_cache_miss": "No matching fresh object",
        "cacheReason_cache_disabled": "Cache disabled",
        "cacheReason_route_disabled": "Route bypass",
        "cacheReason_request_cookie": "Application cookie",
        "cacheReason_request_authorization": "Authorization header",
        "cacheReason_request_cache_control": "Client cache directive / hard refresh",
        "cacheReason_request_pragma": "Client Pragma",
        "cacheReason_request_method": "Method other than GET",
        "cacheReason_request_body": "Nonempty request body",
        "cacheReason_request_range": "Range request",
        "cacheReason_request_conditional": "Conditional request",
        "cacheReason_request_upgrade": "Protocol upgrade",
        "cacheReason_query_excluded": "Query excluded",
        "cacheReason_path_excluded": "Path excluded",
        "cacheReason_request_cache_control_invalid": "Invalid request cache directives",
        "cacheReason_response_status": "Non-200 response",
        "cacheReason_response_set_cookie": "Origin Set-Cookie",
        "cacheReason_response_cache_control": "Origin privacy/cache directive",
        "cacheReason_response_cache_control_invalid": "Invalid origin cache directives",
        "cacheReason_response_vary": "Uncacheable Vary",
        "cacheReason_response_range": "Partial response",
        "cacheReason_response_trailers": "Response trailers",
        "cacheReason_response_ttl_size_or_metadata": "TTL, size or metadata rejected",
        "cacheReason_response_headers_policy": "Response rule prevents storage",
        "cacheReason_configuration_changed": "Configuration changed",
        "cacheReason_not_proxy_response": "Local page / rejected request",
        "cacheReason_tinyauth": "Tinyauth protected content",
        "cacheReason_sticky_cookie": "Sticky-session cookie mode",
        "acme.working": "Certificate request is running.",
        "acme.ready_to_import": "Certificate validated; ready to add to the library.",
        "acme.certbot_not_installed": "Certbot is not installed or is not in the service PATH. Install Certbot and certbot-dns-rfc2136.",
        "acme.certbot_failed_check_private_log": "Certbot failed. Check the private ACME logs; the exact path is shown with the failed operation.",
        "acme.production_confirmation": "Explicit production confirmation is required.",
        "acme.consent_required": "Accept the subscriber agreement and confirm the selected CA environment.",
        "acme.provider_timeout": "Certificate provider deadline exceeded. Check the Certbot log path shown with the failed operation before retrying.",
        "acme.invalid_key_secret": "TSIG secret must be valid base64 (16-512 decoded bytes).",
        "acme.job_busy": "Another certificate request is already running.",
        "acme.cancelled": "Certificate job cancelled on shutdown.",
        "acme.certificate_validation_failed": "Issued certificate/key or domain coverage validation failed. Nothing was activated.",
        "acme.invalid_request": "ACME: invalid request.",
        "acme.unknown_field": "ACME: unknown field.",
        "acme.invalid_id": "ACME: invalid id.",
        "acme.invalid_email": "ACME: invalid email.",
        "acme.invalid_domains": "ACME: invalid domains.",
        "acme.invalid_domain": "ACME: invalid domain.",
        "acme.dns_names_only": "ACME: dns names only.",
        "acme.invalid_environment": "ACME: invalid environment.",
        "acme.tos_required": "ACME: tos required.",
        "acme.invalid_dns_server": "ACME: invalid dns server.",
        "acme.invalid_limits": "ACME: invalid limits.",
        "acme.invalid_key_algorithm": "ACME: invalid key algorithm.",
        "acme.invalid_sign_query": "ACME: invalid sign query.",
        "acme.unsafe_directory": "ACME: unsafe directory.",
        "acme.unsafe_output_path": "ACME: unsafe output path.",
        "acme.invalid_pem_size": "ACME: invalid pem size.",
        "acme.invalid_pem": "ACME: invalid pem.",
        "acme.profile_limit": "ACME: profile limit.",
        "acme.profile_busy": "ACME: profile busy.",
        "acme.staging_limit": "ACME: staging limit.",
        "acme.request_too_large": "ACME: request too large.",
        "acme.local_io_or_json_error": "ACME: local io or json error.",
        "acme.no_certificate_directory": "ACME: no certificate directory.",
        "acme.python_not_available": "ACME: python not available.",
        "acme.worker_io": "ACME: worker io.",
        "acme.invalid_worker_response": "ACME: invalid worker response.",
        "acme.worker_failed": "ACME: worker failed.",
        "acme.validation_worker_failed": "ACME: validation worker failed.",
        "cacheResidentLabel": "Cache memory",
        "certificateFuture": "ACME providers: HTTP-01, Cloudflare, OVH and RFC2136. Renewal is manual.",
        "prometheusTitle": "Prometheus",
        "prometheusHelp": "A dedicated read-only HTTP listener, separate from admin sessions. Binding, enabling or changing the token variable requires a restart; CIDRs, path and collectors apply live.",
        "prometheusEnable": "Enable the scrape endpoint",
        "prometheusListen": "Exporter bind IP and port",
        "prometheusPath": "Metrics path",
        "prometheusCidrs": "Allowed scraper IPs (CIDR, one per line)",
        "prometheusTokenEnv": "Environment variable holding the bearer token (optional on loopback)",
        "prometheusTokenHelp": "Enter a variable NAME, not the secret. Set its value to a random 32+ character token in the service environment. Non-loopback binding requires it. This endpoint is HTTP: use a private network or a TLS tunnel. The Prometheus credential file must contain the same token.",
        "prometheusCollectors": "Metric groups",
        "prometheusPreview": "Preview current metrics",
        "prometheusPreviewFailed": "Could not fetch metrics",
        "prometheusActive": "Active endpoint",
        "prometheusDisabled": "Exporter disabled. Authenticated preview remains available.",
        "certificateProvider": "Certificate source / validation method",
        "providerHttp01": "Let's Encrypt - domain validation (HTTP-01)",
        "providerCloudflare": "Let's Encrypt - Cloudflare API (DNS-01)",
        "providerOvh": "Let's Encrypt - OVH API (DNS-01)",
        "providerRfc2136": "Let's Encrypt - RFC2136 / TSIG (DNS-01)",
        "providerImport": "Import certificate and private key (PEM)",
        "providerExisting": "Existing server files / external paths (advanced)",
        "providerHint_http01": "RustProxy runs Certbot HTTP-01. You do not provide certificate file paths here. Every domain must resolve to this proxy and public TCP port 80 must reach its HTTP listener. The issued pair is stored in RustProxy-managed certificate storage. Wildcards require DNS-01.",
        "providerHint_cloudflare": "RustProxy runs Certbot DNS-01 with the Cloudflare plugin. You do not provide certificate file paths here. Use a restricted Zone:DNS:Edit API token; the issued pair is stored in RustProxy-managed certificate storage and can be renewed automatically.",
        "providerHint_ovh": "RustProxy runs Certbot DNS-01 with the OVH plugin. You do not provide certificate file paths here. Supply credentials limited to the required DNS zones; the issued pair is stored in RustProxy-managed certificate storage and can be renewed automatically.",
        "providerHint_rfc2136": "RustProxy runs Certbot DNS-01 with RFC2136/TSIG. You do not provide certificate file paths here. The DNS server must accept signed updates for the required challenge records; the issued pair is stored in RustProxy-managed certificate storage.",
        "providerHint_import": "Choose certificate/fullchain and private-key PEM files from your computer. RustProxy validates the pair and copies it into <data-dir>/certs; the browser-side source path is not saved.",
        "providerHint_existing": "Reference files already present on the RustProxy server. Choose managed filenames from <data-dir>/certs or absolute external paths such as /etc/letsencrypt/live/example.com/fullchain.pem and privkey.pem. External files are not copied into RustProxy backups.",
        "acmeCfToken": "Cloudflare API token",
        "acmeOvhEndpoint": "OVH API region",
        "acmeOvhApplicationKey": "OVH application key",
        "acmeOvhApplicationSecret": "OVH application secret",
        "acmeOvhConsumerKey": "OVH consumer key",
        "acme.invalid_provider": "Select a supported certificate provider.",
        "acme.invalid_api_credential": "API credential is missing or has invalid characters.",
        "acme.invalid_ovh_endpoint": "Select OVH Europe or Canada.",
        "acme.http01_no_wildcard": "HTTP-01 cannot issue wildcard names. Select a DNS-01 provider.",
        "acme.http01_listener_required": "HTTP-01 needs an active plaintext HTTP listener reachable on public port 80.",
        "cacheScopeLegacy": "Unassigned / old scope",
        "certificateLibrary": "Certificates",
        "certificateWorkspaceHelp": "Manage installed certificates, automatic renewal, and generation/import in separate views.",
        "certificateTabInstalled": "Installed",
        "certificateTabRenewal": "Renewal",
        "certificateTabGenerate": "Generate",
        "certificateInstalledTitle": "Installed certificates",
        "certificateInstalledHelp": "Certificates available to vhosts, redirects, 404 hosts, and the administration listener.",
        "certificateGenerateTitle": "Generate and import",
        "certificateGenerateHelp": "Choose Let's Encrypt/ACME issuance, PEM upload, or existing files from RustProxy's private certificate directory.",
        "certificateOperationStatus": "Latest ACME operation",
        "certificateNoRenewalOperation": "No renewal operation in this process.",
        "certificateStateIdle": "Idle",
        "certificateStateRunning": "Running",
        "certificateStateReady": "Ready",
        "certificateStateComplete": "Complete",
        "certificateStateFailed": "Failed",
        "certbotLogs": "Certbot logs",
        "systemDiagnostics": "System / process",
        "vhWebsockets": "WebSocket support",
        "vhLocations": "Custom locations",
        "locationPath": "Location prefix",
        "locationPool": "Vhost backends",
        "locationMissing": "Missing backend",
        "locationLimit": "A host supports up to 64 locations.",
        "locationAccess": "Location access control",
        "locationHeaders": "Location headers",
        "locationAddBackend": "Add dedicated backend",
        "locationAdd": "Add location",
        "locationHelp": "The longest matching prefix wins. The original path and query are retained. Select a backend from this host or add a dedicated backend. Host authentication and ACL always apply.",
        "aclUse": "Enable IP access list",
        "aclAllow": "Allow",
        "aclNetwork": "IP network (CIDR)",
        "aclAction": "Action",
        "aclAdd": "Add IP rule",
        "authMode": "Authentication",
        "authNone": "None",
        "authTinyauth": "Tinyauth",
        "authBasic": "HTTP Basic Auth",
        "basicRealm": "Realm (login prompt)",
        "basicRequireTls": "Require HTTPS for Basic Auth",
        "basicForward": "Forward verified Authorization to backend",
        "basicPassword": "Password (12-128 bytes)",
        "basicKeepPassword": "Leave empty to keep the password",
        "basicHashSaved": "Password set",
        "basicHashRequired": "Set a password for each user.",
        "basicAddUser": "Add user",
        "basicHelp": "Only Argon2id hashes are stored. Verified credentials are removed from upstream requests unless forwarding is enabled. Enable forwarding only to a trusted HTTPS backend or an isolated network. Protected hosts bypass shared cache.",
        "basic.too_many_users": "At most 64 users per host.",
        "basic.invalid_username": "Invalid username.",
        "basic.duplicate_username": "Duplicate username.",
        "basic.unsupported_hash": "Use an Argon2id password hash generated by RustProxy.",
        "basic.invalid_hash": "Invalid password hash.",
        "basic.invalid_realm": "Invalid login realm.",
        "basic.users_required": "Basic Auth requires at least one user.",
        "basic.busy": "Password workers are busy; try again.",
        "renewalTitle": "Automatic renewal",
        "renewalHelp": "Managed ACME certificates are checked about every 12 hours while RustProxy is running. Certbot decides when renewal is due. Validated replacements are deployed without restarting listeners. Keep provider credentials and HTTP-01 port 80 available.",
        "renewalNone": "No managed ACME certificates in the library.",
        "renewalEnabled": "Automatic renewal enabled",
        "renewalDisabled": "Automatic renewal disabled",
        "renewalEnable": "Enable automatic renewal",
        "renewalDisable": "Disable automatic renewal",
        "renewalNow": "Check now",
        "renewalDryRun": "Validate renewal (dry run)",
        "renewalLast": "Last check",
        "renewalNext": "Next check",
        "renewalExpires": "Valid until",
        "acme.renewing": "Checking certificate renewal",
        "acme.renewed": "Certificate renewed and deployed",
        "acme.not_due": "Certificate does not need renewal yet",
        "acme.renewal_test_ok": "Renewal validation passed; active certificate unchanged",
        "acme.renewal_profile_missing": "Saved renewal profile is missing or unreadable. Restore the private ACME profile.",
        "acme.configuration_changed": "Certificate configuration changed during renewal; nothing deployed.",
        "acme.deployment_failed": "Renewed certificate failed configuration validation; previous certificate remains active.",
        "acme.not_managed": "Only managed ACME certificates can be renewed automatically.",
        "acme.certificate_not_found": "Certificate no longer exists.",
        "acme.renewal_disabled": "Automatic renewal is disabled.",
        "acme.openssl_not_installed": "OpenSSL is required to inspect certificate validity.",
        "cacheReason_basic_auth": "HTTP Basic authentication",
        "locationPoolEligible": "Include in the default load-balancing pool",
        "locationId": "Location ID",
        "vhIpAccess": "Vhost IP access list",
        "apiDocs": "Documentation",
        "auth.invalid_request": "Invalid request. Check the supplied fields.",
        "locationProxyHeaders": "Proxy request headers (to backend)",
        "locationResponseHeaders": "Response headers (to client)",
        "locationHeadersHelp": "Set replaces a header, append adds a value, remove deletes it. Applied after global and vhost rules, only for this location. Values are literal (no nginx variables). Transport and verified identity headers stay system-managed.",
        "headersAdvancedJson": "Advanced header rules (JSON)",
        "headersInvalid": "Invalid header rule. Check name, operation and value.",
        "headersProtected": "Transport and proxy identity headers cannot be overridden here. Use forwarding, authentication or response settings.",
        "docsTitle": "Documentation",
        "docsSession": "Uses your administrator session. API writes require CSRF protection.",
        "docsSignIn": "Sign in to view documentation",
        "docsPanel": "Back to panel",
        "docsWrites": "Enable write operations",
        "docsWriteConfirm": "This sends a real change to RustProxy. Continue?",
        "docsExpired": "Session ended. Sign in again.",
        "docsError": "Documentation could not be loaded.",
        "docsAccount": "Signed in as",
        "docsReadOnly": "Read-only execution by default. SSE streams and login/setup are not executed here.",
        "docsLogout": "Sign out",
        "authPrivateNote": "Access is restricted to authorized administrators.",
        "advanced": "Advanced",
        "docsLicenses": "Swagger UI licenses",
        "vhTrafficPolicy": "Traffic policy",
        "vhHttp3Enabled": "Enable HTTP/3 for this vhost",
        "vhCloudflareClientIp": "Use verified Cloudflare client IP",
        "vhTimingHeaders": "Expose Server-Timing diagnostics",
        "vhRateEnabled": "Enable per-client IP rate limit",
        "vhRateRequests": "Requests per window",
        "vhRateWindow": "Window (seconds)",
        "vhRateBurst": "Burst allowance",
        "vhCountryMode": "Country access policy",
        "vhCountryBlock": "Block listed countries",
        "vhCountryAllow": "Allow only listed countries",
        "vhCountryList": "Countries (ISO 3166-1 alpha-2)",
        "vhCountryPolicyHelp": "Country rules use the installed GeoIP database. In allow-only mode, a listed country OR an explicitly allowed IP can pass this vhost scope. In block mode, a listed country OR explicitly denied IP is blocked. An unresolved country fails the country branch.",
        "vhCountry": "Country",
        "vhAddCountryRate": "Add country rate limit",
        "vhCountryRateLimit": "At most 64 country-specific rate limits are allowed.",
        "vhRateHelp": "Country-specific limits override the base per-IP limit. Exceeded limits return 429; denied countries return 403.",
        "vhHealthOffWarning": "Active backend probes are disabled. Passive Backend Health is configured separately and remains off unless explicitly enabled.",
        "vhFrontendSelectionOnly": "Select named listeners for this vhost. Listener IP addresses, ports and H2/H3 capabilities are configured only in Settings > Listeners.",
        "vhForceSsl": "Force SSL (redirect HTTP to HTTPS)",
        "vhForceSslHelp": "Plain HTTP requests for this vhost receive a 308 redirect to HTTPS while preserving path and query. Select at least one plain HTTP listener and at least one TLS listener. If several TLS ports are selected, port 443 is used; otherwise the TLS target port must be unambiguous.",
        "vhForceSslNeedsTls": "Force SSL requires at least one enabled TLS listener for this vhost.",
        "vhForceSslPortConflict": "Force SSL cannot choose the HTTPS redirect target because selected TLS listeners use multiple non-standard ports. Select one TLS port or include port 443.",
        "vhForwardClientIp": "Forward client IP to backend",
        "vhForwardClientIpHelp": "Keep enabled for normal reverse-proxy behavior. Disable to withhold Forwarded, X-Forwarded-For and X-Real-IP from the application while RustProxy, ACLs, rate limits and Tinyauth still use the real client IP.",
        "vhClientIpHidden": "Client IP hidden from backend",
        "listenerMigrateInline": "Existing vhost listener (will migrate)",
        "vhDebugOriginPreset": "Apply recommended preset",
        "vhDebugOriginTlsWarning": "This preset keeps backend TLS certificate verification disabled. The connection is encrypted, but CA and hostname identity are not checked. Continue?",
        "vhOriginPresetHelp": "Debug origin defaults for new backend rows: HTTPS by IP, default LB pool ON, private origin ON, HTTP/1.1, Preserve client Host ON and TLS verification OFF. Re-enable TLS verification whenever the origin certificate can be validated.",
        "vhDebugOriginMismatch": "This HTTPS-by-IP origin does not match the debug forwarding preset (pool ON, private origin ON, HTTP/1.1, preserve Host ON, TLS verification OFF). If you enable verification, set TLS server name to the certificate DNS name and add its private CA when needed. Continue with the current values?",
        "vhCacheStaticCookie": "Ignore request cookies for selected static file extensions",
        "vhCacheStaticCustom": "Use a custom static extension list",
        "vhCacheStaticExtensions": "Static extensions (one per line, without dot)",
        "vhCacheStaticHelp": "Inherit the global policy or override it for this vhost. Ignore Cookie only for files whose bytes do not depend on the session; Set-Cookie, private/no-store and Vary: Cookie still block shared storage.",
        "cacheStaticTitle": "Static asset cache boost",
        "cacheStaticCookie": "Ignore request cookies for static files",
        "cacheStaticExtensions": "Global static extensions (one per line, without dot)",
        "cacheStaticHelp": "Enable this only for files whose bytes do not depend on the session. Request Cookie then does not affect the shared cache key for these extensions; responses with Set-Cookie, private/no-store or Vary: Cookie are still never stored.",
        "vhHttp2Enabled": "Enable HTTP/2 for this vhost",
        "vhFrontendProtocolsHelp": "H2 and H3 are per-vhost opt-outs. A switch is available only when at least one selected listener has that protocol enabled in Settings > Listeners.",
        "administration": "Administration",
        "administrationActiveHttp": "Active HTTP administration",
        "administrationActiveHttps": "Active HTTPS administration",
        "administrationCertificate": "Certificate",
        "administrationGeneratedCertificate": "Application-generated default certificate",
        "administrationHelp": "HTTPS allows the administration listener to bind beyond loopback. Plain HTTP on the HTTPS port is redirected automatically. Listener and certificate changes take effect after restart.",
        "administrationHosts": "Allowed DNS hostnames (optional strict allowlist)",
        "administrationHttps": "Enable HTTPS for administration",
        "administrationListen": "Listen address",
        "cacheOverhead": "Overhead",
        "cacheResidentAge": "X-Cache-Resident-Age",
        "controlPlane": "CONTROL PLANE",
        "logging": "Logging",
        "loggingTitle": "Structured access logging",
        "loggingTabOutputs": "Outputs",
        "loggingTabFormat": "JSON format",
        "loggingTabErrors": "Error log",
        "loggingDescription": "Write configurable JSON access logs to a file, Logstash or Loki.",
        "loggingHelp": "Live log viewing stays in memory. External sinks use a bounded background queue and do not block request I/O.",
        "loggingFile": "JSON file",
        "loggingPath": "File path",
        "loggingAddress": "TCP address",
        "loggingTokenEnv": "Bearer token environment variable",
        "loggingLabels": "Labels (JSON object)",
        "loggingFormat": "Configurable JSON format",
        "loggingFormatHelp": "Map output names to source fields. Leave mapping empty for the complete standard entry.",
        "loggingFields": "Field mapping (JSON object)",
        "loggingStatic": "Static fields (JSON object)",
        "loggingJsonInvalid": "Logging JSON fields must contain valid JSON objects.",
        "loggingQueue": "Sink queue",
        "loggingDropped": "dropped",
        "loggingSent": "sent",
        "loggingCapacity": "capacity",
        "errorLogTitle": "Error file",
        "errorLogPath": "Error log path",
        "errorLogFormat": "Format",
        "tls12": "TLS 1.2",
        "tls13": "TLS 1.3",
        "tlsPolicy": "TLS policy",
        "tlsPolicyHelp": "This is the global TLS policy inherited by every TLS host in the application. Per-vhost policy may only narrow it. HTTP/3 requires TLS 1.3.",
        "tlsCiphers": "Cipher suites (one per line; empty = rustls defaults)",
        "tlsAvailableCiphers": "Available cipher suites",
        "tlsPolicyVersionRequired": "Enable at least one TLS version.",
        "vhTlsOverride": "Override global TLS policy",
        "vhTlsOverrideHelp": "Use only when this vhost needs different TLS versions or cipher suites. Empty cipher list keeps rustls defaults.",
        "vhTlsHttp3Conflict": "HTTP/3 uses the global TLS policy. Disable HTTP/3 on this vhost before using a different TLS override.",
        "vhListeners": "Listeners",
        "vhProtocols": "Protocols",
        "loggingMode": "JSON / ASYNC / BOUNDED",
        "loggingPushUrl": "Push URL",
        "cacheHotObjects": "Hot objects",
        "cacheHotMemory": "Hot memory",
        "cacheColdObjects": "Cold objects",
        "cacheColdDisk": "Cold disk",
        "cacheTierMoves": "Tier moves",
        "cacheColdHits": "cold hits",
        "cacheTier": "Tier",
        "cacheStorage": "Memory / disk",
        "cacheColdTitle": "Persistent cold cache",
        "cacheColdEnable": "Enable persistent disk tier",
        "cacheColdHelp": "Choose what is moved from hot RAM to persistent disk. Cold hits are read asynchronously and promoted back to RAM. Metadata is readable JSON; bodies are raw .body files.",
        "cacheColdPath": "Cold path (inside data directory)",
        "cacheColdBytes": "Cold disk budget (MiB)",
        "cacheColdEntries": "Cold object limit",
        "cacheColdAfter": "Demote after idle seconds",
        "cacheHot": "Hot",
        "cacheCold": "Cold",
        "cacheReason_request_no_cache": "Client no-cache / hard reload requires validation",
        "cacheReason_request_max_age": "Client max-age requires validation",
        "cacheReason_request_min_fresh": "Client min-fresh requires validation",
        "cacheReason_request_pragma_no_cache": "Client Pragma no-cache / legacy hard reload",
        "cacheReason_cache_revalidated": "Stored object validated by origin",
        "cacheReason_cache_conditional_hit": "Fresh object satisfied a conditional request",
        "cacheReason_request_no_store": "Client no-store bypass",
        "cacheReason_request_precondition": "Client precondition requires origin",
        "loggingPreset": "Format preset",
        "loggingPresetCustom": "Custom",
        "loggingPresetStandard": "RustProxy standard",
        "loggingPresetNginx": "Nginx-style JSON",
        "loggingPresetEcs": "ECS-style field names",
        "loggingPresetMinimal": "Minimal",
        "loggingBuilder": "Visual field builder",
        "loggingBuilderOpen": "Configure fields",
        "loggingAdvancedJson": "Advanced JSON mapping",
        "loggingBuilderHelp": "Select source fields and optionally rename their JSON keys. Applying the visual editor normalizes each source field to at most one output key; use advanced JSON for duplicate aliases.",
        "loggingSourceField": "Source field",
        "loggingOutputField": "Output JSON key",
        "loggingPreview": "Preview",
        "loggingOutputRequired": "Every enabled log field needs an output JSON key.",
        "loggingOutputDuplicate": "Output JSON keys must be unique.",
        "aclProfiles": "ACL profiles",
        "acl-profiles": "ACL profiles",
        "acl-profilesTitle": "Reusable ACL profiles",
        "acl-profilesDescription": "Define reusable IP and country access rules, then attach them to one or more virtual hosts.",
        "aclProfilesIntro": "Reusable access profiles can be attached to multiple vhosts. Per-vhost ACL and country rules remain active and are enforced together with the profile.",
        "aclProfilesReusable": "REUSABLE POLICY",
        "aclProfileNew": "New profile",
        "aclProfileEdit": "Editing profile",
        "aclProfileEditor": "Profile configuration",
        "aclProfileId": "Profile ID",
        "aclProfileName": "Display name",
        "aclProfileIpEnabled": "Enable IP ACL",
        "aclProfileRules": "IP rules — one “allow|deny CIDR” per line",
        "aclProfileCombineHelp": "Country and IP exceptions are combined with OR inside this profile. Explicit deny rules and blocked countries win; attached profile, vhost and location policies must still all pass.",
        "aclProfilePolicyMode": "Choose the base policy",
        "aclProfilePolicyModeHelp": "Use a guided allow-list or block-list for normal cases. Custom mode keeps full control for mixed policies.",
        "aclProfileModeAllowExceptions": "Block by default",
        "aclProfileModeAllowExceptionsHelp": "Allow selected countries OR selected IP/CIDR ranges.",
        "aclProfileModeBlockExceptions": "Allow by default",
        "aclProfileModeBlockExceptionsHelp": "Block selected countries OR selected IP/CIDR ranges.",
        "aclProfileModeCustom": "Custom",
        "aclProfileModeCustomHelp": "Control default action, country mode and every IP action manually.",
        "aclProfileCountryExceptions": "Country exceptions",
        "aclProfileUseCountries": "Use countries",
        "aclProfileAllowedCountries": "Allowed countries (ISO codes)",
        "aclProfileBlockedCountries": "Blocked countries (ISO codes)",
        "aclProfileAllowedCountriesHelp": "A request from any listed country is allowed even when its IP is not listed.",
        "aclProfileBlockedCountriesHelp": "A request from any listed country is blocked even when its IP is otherwise allowed.",
        "aclProfileCustomCountryHelp": "Custom country behavior is controlled below. Blocked countries always deny.",
        "aclProfileIpExceptions": "IP / CIDR exceptions",
        "aclProfileAddIpException": "Add IP exception",
        "aclProfileAllowedIpsHelp": "Add an IPv4/IPv6 address or CIDR. These addresses are allowed in addition to the selected countries.",
        "aclProfileBlockedIpsHelp": "Add an IPv4/IPv6 address or CIDR. These addresses are blocked in addition to the selected countries.",
        "aclProfileCustomIpHelp": "Each IP rule can allow or deny independently. Plain IP addresses are accepted as host rules.",
        "aclProfileBulkExceptions": "Paste many IP addresses / CIDRs",
        "aclProfilePreview": "Effective policy",
        "aclProfilePreviewDefaultDeny": "DEFAULT: BLOCK",
        "aclProfilePreviewDefaultAllow": "DEFAULT: ALLOW",
        "aclProfilePreviewAllowedCountries": "ALLOW COUNTRY",
        "aclProfilePreviewBlockedCountries": "BLOCK COUNTRY",
        "aclProfilePreviewAllowedIps": "ALLOW IP",
        "aclProfilePreviewBlockedIps": "BLOCK IP",
        "aclProfilePreviewIpRules": "IP RULES",
        "aclProfilePreviewNoExceptions": "No exceptions configured",
        "aclProfilePreviewBlocksAll": "This profile currently blocks all traffic. Add a country or IP exception to allow access.",
        "aclProfilePreviewAllowsAll": "This profile currently allows all traffic. Add a country or IP exception to block access.",
        "aclProfilePreviewAllowNote": "Access is granted when the country OR the client IP matches an allowed exception. Explicit deny rules still win in custom policies.",
        "aclProfilePreviewBlockNote": "Access is denied when the country OR the client IP matches a blocked exception.",
        "aclProfilePreviewCustomNote": "Custom mode uses backend precedence: explicit IP deny and blocked country deny; allow-only countries and explicit IP allows can satisfy the same policy scope.",
        "aclProfileOr": "OR",
        "aclProfileCountriesShortAllow": "Allowed countries",
        "aclProfileCountriesShortBlock": "Blocked countries",
        "aclProfileIpsShortAllow": "Allowed IPs",
        "aclProfileIpsShortBlock": "Blocked IPs",
        "aclProfileIpRulesShort": "IP rules",
        "aclProfileIpOff": "IP ACL disabled",
        "aclProfileCountriesOff": "Country filtering disabled",
        "aclProfileAttached": "Attached to",
        "aclProfileInUse": "Profile is attached to vhosts",
        "aclProfilesEmpty": "No reusable ACL profiles yet.",
        "aclProfileCountryInvalid": "Country codes must use two-letter ISO codes.",
        "aclProfileCountryRequired": "Add at least one country or disable country exceptions.",
        "aclProfileDuplicate": "An ACL profile with this ID already exists.",
        "vhAclProfile": "ACL profile",
        "vhAclProfileNone": "No reusable profile",
        "vhAclProfileHelp": "Optional reusable profile. Inline vhost ACL and country rules below are still enforced in addition to the profile.",
        "vhHostAdd": "Add hostname",
        "vhHostsHelp": "Add multiple hostnames (e.g. domain.local i subdomain.local) with Enter or comma. They share this vhost and its backend/settings. Wildcards are supported only as leading *. Exact hosts take priority.",
        "vhHostInvalid": "Invalid hostname or wildcard pattern.",
        "vhHostRequired": "Add at least one hostname.",
        "vhLifetimeChart": "Lifetime request rate",
        "vhReqPerSecond": "req/s",
        "vhPeak": "peak",
        "listenerAddresses": "Bind addresses",
        "listenerAddressesInvalid": "Provide 1–16 unique listener addresses.",
        "listenerAddressesExplicit": "When a listener uses multiple addresses, select explicit IPs; 0.0.0.0 and :: are not allowed.",
        "ruleSyntaxLine": "Invalid ACL rule on line",
        "vhForceSslNeedsHttp": "Force SSL needs at least one selected plain HTTP (non-TLS) listener. A listener named “HTTP” may still be configured as TLS in Settings > Listeners.",
        "aclProfileRuleBuilder": "IP rules",
        "aclProfileBulkRules": "Paste / import rules",
        "aclProfileBulkHelp": "Paste one “allow|deny CIDR” rule per line. Invisible Unicode spacing is normalized during import and errors identify the exact line.",
        "aclProfileImportRules": "Import rules",
        "aclProfileRulesImported": "ACL rules imported into the visual editor.",
        "streamHosts": "Stream hosts",
        "streamsHelp": "Raw TCP/UDP forwarding on dedicated ports. Stream traffic bypasses HTTP vhosts, ACL, cache, headers and compression.",
        "streamAdd": "Add stream host",
        "saveStreams": "Save stream hosts",
        "streamRestartHelp": "Changing a stream listener requires a RustProxy restart.",
        "streamRestartPending": "Saved stream changes are pending. Restart RustProxy to apply them.",
        "streamActive": "Currently active streams",
        "streamNone": "No stream hosts active",
        "streamEndpoint": "Stream endpoint",
        "streamId": "Stream ID",
        "streamName": "Display name",
        "streamProtocol": "Protocol",
        "streamListen": "Listen address",
        "streamUpstream": "Upstream address",
        "streamConnectTimeout": "TCP connect timeout (seconds)",
        "streamIdleTimeout": "Idle/session timeout (seconds)",
        "streamMaxConnections": "Max connections/sessions",
        "streamTcp": "TCP",
        "streamUdp": "UDP",
        "streamLimit": "At most 128 stream hosts are supported.",
        "streamDuplicate": "Stream host IDs must be unique.",
        "streams": "Streams",
        "streamsTitle": "TCP / UDP streams",
        "streamsDescription": "Manage raw Layer-4 listeners, upstreams and live traffic telemetry.",
        "streamsPageIntro": "TCP/UDP streams are independent Layer-4 proxies. Each stream owns a dedicated listener and upstream and bypasses the HTTP vhost, ACL and cache stack.",
        "streamLayer4": "LAYER 4 / TCP + UDP",
        "streamList": "Streams",
        "streamSearch": "Search streams",
        "streamSearchPlaceholder": "ID, name, listener or upstream…",
        "streamSearchEmpty": "No streams match this search.",
        "streamEmpty": "No TCP/UDP streams yet. Add a listener to start forwarding Layer-4 traffic.",
        "streamNew": "New stream",
        "streamAddListener": "Add TCP/UDP listener",
        "streamEditor": "Stream configuration",
        "streamEditLabel": "EDITING",
        "streamNewLabel": "NEW",
        "streamDetailsTab": "Details",
        "streamNetworkTab": "Listener & upstream",
        "streamLimitsTab": "Limits",
        "streamNetwork": "Listener & upstream",
        "streamLimits": "Connection / session limits",
        "streamDedicatedListenerHelp": "A stream listener is created together with the stream and is separate from HTTP/HTTPS listeners.",
        "streamLimitsHelp": "Limits apply to concurrent TCP connections or per-client UDP sessions. TCP connect timeout is not used by UDP.",
        "streamListenAdd": "Add listen address",
        "streamListenHelp": "Enter one IP:port listener address and press Enter. Listener changes become active after RustProxy restarts.",
        "streamListenInvalid": "The listener address must be one IP:port value without spaces or commas.",
        "streamListenRequired": "Add a listener address.",
        "streamDelete": "Delete this stream? The active listener remains until RustProxy restarts.",
        "streamPendingRestart": "Pending restart",
        "streamRunning": "Running",
        "streamActiveSessions": "Active connections / sessions",
        "streamSessionsTotal": "Connections / sessions",
        "streamErrors": "Errors",
        "streamRejected": "Rejected",
        "streamTransferred": "Transferred",
        "streamTrafficChart": "Live traffic rate",
        "streamClientToUpstream": "client → upstream",
        "streamUpstreamToClient": "upstream → client",
        "streamNoLiveMetrics": "No live metrics until this stream is active after restart.",
        "streamIdleShort": "Idle timeout",
        "listenerAddressAdd": "Add bind address",
        "listenerAddressesHelp": "Press Enter or comma to add a bind address. Multiple addresses use the same listener policy; wildcard 0.0.0.0/:: cannot be mixed with explicit addresses.",
        "cacheColdOnIdle": "Move old/idle objects to cold storage",
        "cacheColdOnLru": "Move hot LRU evictions to cold storage",
        "cacheColdOnShutdown": "Flush hot cache to cold storage during graceful shutdown",
        "certificateCovers": "Certificate domains",
        "certificateCoverageUnknown": "Domain data (DNS SAN) is unavailable. Reload certificate files or import the certificate again.",
        "certificateDetails": "Certificate details",
        "certificateFiles": "Certificate / key files",
        "redirects": "Redirects",
        "redirectsTitle": "Redirect with intent.",
        "redirectsDescription": "Local redirect hosts with explicit match, target, status, path and query behavior.",
        "redirectsPageIntro": "Redirect hosts answer locally without opening an upstream connection. Rules can match scheme and path, then redirect to a URL, another host or a path.",
        "redirectLayer": "HTTP REDIRECTION",
        "redirectList": "Redirect hosts",
        "redirectSearch": "Search redirects",
        "redirectSearchPlaceholder": "ID, hostname, target…",
        "redirectNew": "New redirect",
        "redirectEmpty": "No redirect hosts configured.",
        "redirectSearchEmpty": "No redirects match this search.",
        "redirectEditor": "Redirect configuration",
        "redirectId": "Redirect ID",
        "redirectName": "Display name",
        "redirectHosts": "Source hostnames",
        "redirectFrontend": "FRONTEND",
        "redirectListeners": "Listeners",
        "redirectBehavior": "BEHAVIOR",
        "redirectRules": "Rules",
        "redirectAddRule": "Add rule",
        "redirectRulesHelp": "Longest matching path wins. 307/308 preserve the request method; 301/302/303 may change it in clients.",
        "redirectSafetyHint": "Redirect hosts do not contact a backend. Global host ACLs still apply. Avoid self-referential rules that can create browser redirect loops.",
        "redirectRule": "Rule",
        "redirectRuleId": "Rule ID",
        "redirectSourceScheme": "Incoming scheme",
        "redirectSchemeAny": "HTTP or HTTPS",
        "redirectSchemeHttp": "HTTP",
        "redirectSchemeHttps": "HTTPS",
        "redirectSchemePreserve": "Preserve incoming scheme",
        "redirectMatchType": "Path match",
        "redirectMatchPrefix": "Prefix",
        "redirectMatchExact": "Exact",
        "redirectSourcePath": "Source path",
        "redirectTargetType": "Target type",
        "redirectTargetUrl": "Absolute URL",
        "redirectTargetHost": "Host / application",
        "redirectTargetPath": "Path on the same host",
        "redirectTarget": "Target",
        "redirectTargetScheme": "Target scheme",
        "redirectPathMode": "Path handling",
        "redirectPathAppend": "Append full source path",
        "redirectPathStrip": "Strip matched prefix and append remainder",
        "redirectPathReplace": "Use configured target path only",
        "redirectQueryMode": "Query handling",
        "redirectQueryPreserve": "Preserve source query",
        "redirectQueryDrop": "Drop source query",
        "redirectStatus": "HTTP status",
        "redirect301": "301 Moved Permanently",
        "redirect302": "302 Found",
        "redirect303": "303 See Other",
        "redirect307": "307 Temporary Redirect (preserve method)",
        "redirect308": "308 Permanent Redirect (preserve method)",
        "redirectCacheSeconds": "Browser/shared cache max-age (seconds; 0 = no-store)",
        "redirectHostsRequired": "Add at least one source hostname.",
        "redirectListenersRequired": "Select at least one listener.",
        "redirectRulesRequired": "Add at least one redirect rule.",
        "redirectDuplicate": "A redirect with this ID already exists.",
        "redirectUnsaved": "Discard unsaved redirect changes?",
        "redirectNewLabel": "NEW",
        "administrationSessionDays": "Administrator session lifetime (days)",
        "administrationSessionDaysHelp": "Browser sessions use an absolute 7–30 day lifetime. Changing this value applies immediately; password changes and “revoke all sessions” still invalidate sessions at once.",
        "vhLocalListenerRisk": "Allow local RustProxy listener as backend (risk)",
        "vhLocalListenerRiskHelp": "Shown when the backend URL directly targets the configured or active RustProxy administration listener. localhost, 127.0.0.1 and ::1 are treated as equivalent loopback forms on the same administration port. Enabling it can expose the control plane or create a proxy loop; private/loopback targets still require “Allow private origin IP”.",
        "vhLocalListenerRiskConfirm": "This can route requests into a local RustProxy listener, including the administration port, and may create a loop or expose the control plane. Accept this risk?",
        "cacheResidentHistory": "Resident RAM history",
        "networkHistory": "RX / TX history",
        "responseLatencyHistory": "Response time history",
        "sourceIp": "Source IP",
        "cacheColdOnAge": "Move objects to cold storage after a maximum hot-tier age",
        "cacheColdMaxHot": "Maximum hot-tier age (seconds)",
        "cacheColdPolicyHelp": "Idle time measures how long an object has not been used. Hot-tier age measures continuous residency in RAM even if the object is still requested. LRU pressure and graceful-shutdown handoff are independent policies.",
        "documentation": "Documentation",
        "locationPathPattern": "Path / regex pattern",
        "locationMatchType": "Match type",
        "locationMatchPrefix": "Prefix",
        "locationMatchPriority": "Priority prefix (^~)",
        "locationMatchExact": "Exact path (=)",
        "locationMatchRegex": "Regex (~)",
        "locationMatchRegexI": "Regex, case-insensitive (~*)",
        "locationMatch_prefix": "prefix",
        "locationMatch_prefix_priority": "priority prefix",
        "locationMatch_exact": "exact",
        "locationMatch_regex": "regex",
        "locationMatch_regex_insensitive": "regex i",
        "locationAction": "Action",
        "locationProxyAction": "Proxy to backend",
        "locationReturnAction": "Custom response (return)",
        "locationProxyShort": "proxy",
        "locationReturnShort": "local response",
        "locationHandling": "Request handling",
        "locationRewriteMode": "Backend path rewrite",
        "locationRewritePreserve": "Keep original path",
        "locationRewriteStrip": "Strip matched prefix",
        "locationRewriteReplace": "Replace matched prefix",
        "locationRewriteRegex": "Regex replacement",
        "locationRewriteValue": "Replacement path / expression",
        "locationRewriteHelp": "Query parameters are preserved. Prefix rewrites operate on the normalized routing path. Regex replacement supports Rust regex captures such as $1. Rewritten paths are validated before forwarding.",
        "locationResponseStatus": "Response status",
        "locationResponseType": "Content-Type",
        "locationResponseBody": "Response body",
        "headersVisualBuilder": "Visual configurator",
        "locationDocsTitle": "Custom locations documentation",
        "headersDocsTitle": "Header rules documentation",
        "locationDocsIntro": "Custom locations are evaluated inside the selected vhost after host authentication and ACL. They never bypass vhost security.",
        "locationDocsPrefix": "Prefix: matches a complete path segment prefix. The longest prefix wins. Priority prefix behaves like nginx ^~ and prevents regex locations from taking precedence.",
        "locationDocsExact": "Exact: matches only the exact normalized path, like nginx location = /path.",
        "locationDocsRegex": "Regex: first matching regex wins after exact/priority-prefix processing. Case-sensitive and case-insensitive modes are supported. Rust regex syntax is used; look-around/backreferences in the pattern are intentionally unsupported.",
        "locationDocsReturn": "Custom response: answer locally with a chosen HTTP status, Content-Type and body without opening a backend connection. Location response-header rules still apply.",
        "locationDocsRewrite": "Backend path rewrite: keep the original target, strip/replace a matched prefix, or use regex capture replacement. The original query string is preserved.",
        "locationDocsAccess": "Per-location IP ACL, cache override and request/response header rules are composed with the vhost policy. A location cannot disable host authentication or host ACL.",
        "locationDocsLimits": "Up to 64 locations per vhost. Regexes and response bodies are bounded; transport, forwarding identity and WebSocket protocol headers remain system-managed.",
        "headersDocsIntro": "Header rules are applied in order: global → vhost → matching location. Use the visual configurator for normal changes; JSON remains an advanced escape hatch.",
        "headersDocsSet": "Set: replace all existing values of a header with the configured literal value.",
        "headersDocsAppend": "Append: add another value without deleting existing values.",
        "headersDocsRemove": "Remove: delete the header before forwarding or before sending the response.",
        "headersDocsProtected": "Protected transport/identity headers (Host, Connection, Content-Length, Forwarded/X-Forwarded-*, WebSocket proof headers and similar) cannot be overridden here.",
        "headersDocsOrder": "Values are literal; nginx variables are not interpreted. Request rules run before canonical forwarding metadata is applied, and response rules run before final RustProxy security/diagnostic policy.",
        "cacheColdPolicyTitle": "Hot → cold policy",
        "headerRule": "Header rule",
        "headerRulesEmpty": "No rules yet. Add a rule below.",
        "headerRuleHelp": "Choose Set, Append or Remove. Transport, forwarding identity and WebSocket protocol headers remain protected.",
        "locationPreviewTitle": "Effective behavior preview",
        "locationPreviewMatch": "Matching",
        "locationPreviewHandling": "Handling",
        "locationPreviewRewrite": "Backend path",
        "locationPreviewCache": "Cache",
        "locationPreviewAccess": "Access",
        "locationPreviewHeaders": "Header rules",
        "locationPreviewDisabled": "This location is disabled and will not match requests.",
        "locationPreviewBackendSkipped": "backend is not contacted",
        "locationPreviewVhostAcl": "Vhost authentication and ACL only",
        "locationPreviewCustomAcl": "Vhost policy + location ACL",
        "locationPreviewRequestRules": "request",
        "locationPreviewResponseRules": "response",
        "locationPreviewQueryPreserved": "query string is preserved",
        "locationDocsMatchHeading": "1. Matching and precedence",
        "locationDocsActionHeading": "2. Proxy, rewrite and local response",
        "locationDocsPolicyHeading": "3. Access, cache and headers",
        "locationDocsExamplesHeading": "Common examples",
        "locationDocsExampleExact": "Health endpoint: Exact (=) /health + Custom response 200 answers locally without a backend connection.",
        "locationDocsExampleStatic": "Static assets: Priority prefix (^~) /static/ keeps regex locations from overriding it; cache can be enabled for this location.",
        "locationDocsExampleRegex": "Versioned API: Regex (~) ^/api/v[0-9]+/ can select a backend and use regex replacement groups such as $1.",
        "cacheOutcomeHistory": "HIT / MISS / BYPASS activity",
        "cacheHotMemoryHistory": "HOT RAM usage / limit",
        "cacheTransientMemoryHistory": "Transient RAM usage / limit",
        "cacheColdStorageHistory": "COLD storage usage / limit",
        "processCpuHistory": "Process CPU history",
        "processRssHistory": "Process RSS history",
        "cacheMemoryBreakdown": "Hot / transient cache RAM",
        "cacheTransientBreakdown": "Fill / cold queue / cold I/O",
        "cacheColdStorageUsage": "COLD storage / budget",
        "cacheColdStorageObjects": "objects",
        "cacheTransientMemory": "Transient cache RAM",
        "cacheTransientShort": "TOTAL",
        "cacheFillShort": "fill",
        "cacheQueueShort": "cold queue",
        "cacheIoShort": "cold I/O",
        "processRssTotal": "RSS total",
        "memoryCacheHot": "HOT cache RAM / limit",
        "memoryCacheTransient": "Cache transient RAM / limit",
        "memoryTransform": "Transform reserved RAM / budget",
        "memoryTransformInflight": "Active transforms / limit",
        "memoryNonCacheRss": "Non-cache process RSS",
        "transformMemoryUsage": "Transform RAM reservation",
        "transformConcurrencyUsage": "Active transform slots",
        "transformBudgetShort": "budget",
        "processRssAnon": "Anonymous RSS",
        "processRssFile": "File-backed / shared RSS",
        "processDataSwap": "Data address space / swap",
        "memoryAccountingHint": "RSS is the real process footprint. HOT/transient cache values are RustProxy-accounted allocations; transform memory is a conservative active reservation. Non-cache RSS is RSS minus accounted cache and includes transforms, connections, TLS, logging, Tokio/runtime state, allocator overhead and other buffers, so these rows are not all additive.",
        "memoryAccountingInfo": "Memory accounting information",
        "logTransport": "Transport",
        "logWebSocket": "WebSocket",
        "logUpstreamError": "Upstream error",
        "listenerDefaultPortsHint": "New vhosts automatically select the standard HTTP :80 listener when it is available.",
        "vhBackendDiagnostics": "Backend diagnostics",
        "vhBackendHeader": "Expose selected backend (X-RustProxy-Backend)",
        "vhBackendTimingHeader": "Expose backend response time (X-RustProxy-Backend-Time)",
        "vhBackendDiagnosticsHelp": "Opt-in response headers. Backend time measures origin request-to-response-headers latency; responses served without contacting an origin do not report a backend.",
        "authModeHelp": "Choose one authentication provider. The IP access list below is independent and can be combined with either provider.",
        "taAdvanced": "Advanced Tinyauth settings",
        "notfound": "404 hosts",
        "notfoundTitle": "404 hosts, under control.",
        "notfoundDescription": "Reserve domains that should answer locally with a status, placeholder or custom HTML.",
        "notfoundPageIntro": "404 hosts reserve selected domains and answer locally without contacting a backend. They can use the same listeners and certificates as vhosts.",
        "notfoundLayer": "LOCAL RESPONSE",
        "notfoundList": "404 hosts",
        "notfoundSearch": "Search 404 hosts",
        "notfoundSearchPlaceholder": "ID, name or hostname…",
        "notfoundNew": "New 404 host",
        "notfoundEditor": "404 host configuration",
        "notfoundId": "Host ID",
        "notfoundName": "Display name",
        "notfoundFrontend": "FRONTEND",
        "notfoundBehavior": "RESPONSE",
        "notfoundResponse": "Local response",
        "notfoundMode": "Response type",
        "notfoundModeWelcome": "RustProxy placeholder",
        "notfoundModeEmpty": "Status only / empty",
        "notfoundModeHtml": "Custom HTML",
        "notfoundStatus": "HTTP status",
        "notfoundHtml": "Custom HTML",
        "notfoundResponseHelp": "The host never opens an upstream connection. The built-in placeholder is no-store and intentionally omits optional RustProxy diagnostic/server headers.",
        "notfoundHosts": "Hostnames",
        "notfoundNewLabel": "NEW",
        "notfoundHostsRequired": "Add at least one hostname.",
        "notfoundListenersRequired": "Select at least one listener.",
        "notfoundHtmlRequired": "Custom HTML cannot be blank.",
        "notfound204Empty": "HTTP 204, 205 and 304 responses must use Empty mode.",
        "notfoundDuplicate": "A 404 host with this ID already exists.",
        "notfoundUnsaved": "Discard unsaved 404 host changes?",
        "notfoundEmpty": "No 404 hosts configured.",
        "notfoundSearchEmpty": "No 404 hosts match the search.",
        "prometheusTrustedNoToken": "Allow token-free reads from trusted CIDRs",
        "prometheusTrustedNoTokenHelp": "Clients still must match Allowed client CIDRs. Enable only on a private, trusted monitoring network; forwarded headers are never trusted for this check.",
        "docker-vhosts": "Docker vhosts",
        "docker-vhostsTitle": "Docker services, named.",
        "docker-vhostsDescription": "Discover published Docker ports and map services to base-domain names, custom domains and aliases without copying observed state into SQLite.",
        "dockerVhosts": "Docker vhosts",
        "dockerVhostsIntro": "Published TCP ports discovered by configured Docker agents. Map each service to a short name under the agent base domain or to any FQDN, add aliases, choose the Docker host IP, and inspect or tune live backend health.",
        "dockerDiscovery": "DOCKER DISCOVERY",
        "dockerRefresh": "Refresh agents",
        "dockerAgentsSettings": "Docker agents settings",
        "dockerAgents": "Docker agents",
        "dockerDesiredState": "DESIRED STATE / SQLITE",
        "dockerAgentsHelp": "Configure one agent per Docker host. HTTPS with a persistent self-signed certificate is the agent default; paste its SHA-256 fingerprint to pin it. Each agent keeps its own base domain and optional default backend IP.",
        "dockerAgentAdd": "Add Docker agent",
        "dockerAgentsSave": "Save and connect agents",
        "dockerAgent": "DOCKER AGENT",
        "dockerAgentNew": "New agent",
        "dockerAgentId": "Agent ID",
        "dockerAgentName": "Display name",
        "dockerAgentEndpoint": "Agent endpoint",
        "dockerAgentToken": "Bearer token",
        "dockerBaseDomain": "Base domain",
        "dockerTargetOverride": "Target IP override",
        "dockerTargetAuto": "automatic",
        "dockerListeners": "Listeners",
        "dockerListenersRequired": "Select at least one listener for the Docker agent.",
        "dockerNoAgents": "No Docker agents configured.",
        "dockerNoAgentsConfigured": "Configure a Docker agent in Settings first.",
        "dockerPublish": "Publish",
        "dockerPreserveHost": "Preserve Host",
        "dockerServiceMissing": "Not present in the latest inventory",
        "dockerConnected": "CONNECTED",
        "dockerError": "ERROR",
        "dockerWaiting": "WAITING",
        "dockerAgentDisabled": "This Docker agent is disabled.",
        "dockerNoObservation": "No observation yet. Refresh the agents.",
        "dockerHost": "Docker host",
        "dockerDetectedIp": "Detected IP",
        "dockerEffectiveIp": "Routing IP",
        "dockerNoPublishedPorts": "No published TCP ports were reported.",
        "dockerAssignmentsSave": "Save Docker vhosts",
        "dockerDefaultTarget": "Default backend IP",
        "dockerDetectedIps": "Detected host IPs",
        "dockerHostname": "Hostname",
        "dockerHostnameHelp": "Short names use {domain}; a full FQDN uses its own domain.",
        "dockerAliases": "Aliases",
        "dockerAliasAdd": "Add alias",
        "dockerAliasesHelp": "Add aliases with Enter or comma. Short names use the agent base domain; full FQDNs are kept as entered.",
        "dockerBackendIp": "Backend host IP",
        "dockerBackendIpAuto": "Auto / agent default",
        "dockerBackendScheme": "Backend protocol",
        "dockerBindingIp": "Docker binding",
        "dockerAgentDefaultIp": "agent default",
        "dockerAgentEndpointHelp": "Use https:// for the default agent setup. Plain HTTP is supported only for compatibility and is visibly marked insecure.",
        "dockerTlsFingerprint": "TLS certificate SHA-256",
        "dockerTlsFingerprintHelp": "For the default self-signed agent certificate, paste the fingerprint printed by install.sh or rustproxy-docker-agent --print-fingerprint. Leave empty only for a certificate trusted by a public CA.",
        "dockerTlsPinned": "TLS PINNED",
        "dockerTlsPublicCa": "TLS / PUBLIC CA",
        "dockerTlsPlain": "PLAIN HTTP",
        "dockerTlsPlainHelp": "The agent token and inventory are not protected by TLS on this endpoint.",
        "dockerTlsPublicCaHelp": "Certificate chain and hostname are verified against the system/public CA roots.",
        "dockerAgentConnectionFailed": "Agent connection failed",
        "dockerAgentVersion": "Agent version",
        "dockerLastChecked": "Last checked",
        "dockerNeverChecked": "never",
        "dockerJustNow": "just now",
        "dockerSecondsAgo": "{seconds}s ago",
        "dockerMinutesAgo": "{minutes}m ago",
        "dockerBackendMissing": "SERVICE MISSING",
        "dockerBackendNotActive": "NOT PUBLISHED",
        "dockerBackendChecking": "CHECKING",
        "dockerBackendHealthOff": "HEALTH OFF",
        "dockerBackendUp": "UP",
        "dockerBackendDown": "DOWN",
        "dockerBackendDraining": "DRAINING",
        "dockerBackendNoMetrics": "Runtime metrics appear after the dynamic backend is active.",
        "dockerHealthCheck": "Backend health check",
        "dockerHealthSummary": "Active TCP/HTTP probes; passive health is configured separately",
        "dockerPassiveHealth": "Passive backend health",
        "dockerPassiveHealthSummary": "Off by default; opt in to health decisions from normal requests",
        "dockerHealthMode": "Mode",
        "dockerHealthHttp": "HTTP",
        "dockerHealthTcp": "TCP",
        "dockerHealthOff": "Off",
        "dockerHealthPath": "HTTP path",
        "dockerHealthHost": "Health Host header",
        "dockerHealthHostAuto": "backend host / automatic",
        "dockerHealthInterval": "Interval (ms)",
        "dockerHealthTimeout": "Timeout (ms)",
        "dockerHealthSlow": "Slow threshold (ms)",
        "dockerHealthFall": "Failures to mark down",
        "dockerHealthRise": "Successes to mark up",
        "dockerHealthStatusMin": "Min HTTP status",
        "dockerHealthStatusMax": "Max HTTP status",
        "dockerHealthLatency": "Latency",
        "dockerHealthResult": "Last probe",
        "dockerHealthRequests": "Requests",
        "dockerHealthErrors": "Errors",
        "dockerHealthActive": "Active",
        "loggingPerVhost": "Separate file per vhost",
        "loggingDirectory": "Per-vhost directory",
        "loggingPerVhostHelp": "When enabled, each vhost writes to its own JSONL file. Unmatched traffic uses _unmatched.jsonl.",
        "listenerStartupLocked": "This startup/systemd address cannot be changed or removed here. Other addresses and listener options remain editable.",
        "administrationStartupLocked": "This address is fixed by the process startup/systemd configuration and cannot be changed here.",
        "notfoundStatusInvalid": "Select a supported HTTP error status.",
        "tlsEffectiveCiphers": "Currently effective cipher suites",
        "certificateManaged": "ACME managed",
        "certManagedReadOnly": "ACME-managed certificates are renewed automatically and cannot be edited as custom file certificates.",
        "vhWebsocketTransport": "WebSocket transport",
        "vhWebsocketHttp1": "HTTP/1.1 Upgrade (recommended)",
        "vhWebsocketRfc9220": "RFC 9220 Extended CONNECT over HTTP/3",
        "vhWebsocketTransportHelp": "Enable WebSocket with the separate switch, then choose the transport. H2/H3 modes use Extended CONNECT while HTTP/1.1 Upgrade remains the fallback.",
        "dockerLiveView": "Live view",
        "dockerPollInterval": "Agent poll interval (s)",
        "dockerPollIntervalHelp": "How often RustProxy contacts this agent for Docker inventory. Live view only reads RustProxy memory.",
        "dockerAgentPollEvery": "Agent poll interval",
        "dockerSearch": "Search Docker vhosts",
        "dockerSearchPlaceholder": "Search service, host, alias or agent...",
        "dockerShowHidden": "Show Hidden",
        "dockerHideHidden": "Hide Hidden",
        "dockerHideVhost": "Hide from view",
        "dockerUnhideVhost": "Show in view",
        "dockerCertificate": "Frontend certificate",
        "dockerCertificateHelp": "Certificate assigned to every generated vhost for this agent. Default uses normal TLS/SNI certificate selection.",
        "dockerDefaultAcl": "Default ACL profile",
        "dockerDefaultAclNone": "No default ACL profile",
        "dockerDefaultAclHelp": "Inherited by generated Docker vhosts that do not select their own per-app ACL profile.",
        "dockerApplyService": "Apply changes",
        "dockerAccessControl": "Access control",
        "dockerAclSummary": "Optional ACL profile and per-app IP rules",
        "dockerAclProfile": "ACL profile",
        "dockerAclProfileNone": "No ACL profile",
        "dockerAclProfileInherit": "Agent default",
        "dockerAclInline": "Use additional per-app ACL",
        "dockerAclDefault": "Default ACL action",
        "dockerAclRules": "IP/CIDR rules",
        "dockerAclHelp": "One rule per line, for example allow 10.0.0.0/8. Profile and per-app ACL are both enforced.",
        "dockerProxyTimeouts": "Proxy timeouts",
        "dockerProxyTimeoutsHelp": "Explicit per-app limits: connect 10 s, response headers 120 s, upstream read 60 s and request send 60 s by default.",
        "dockerHostnameRequired": "Hostname is required before publishing.",
        "dockerForceSsl": "Redirect HTTP to HTTPS",
        "dockerForceSslUnavailable": "Requires an active plain HTTP listener and one unambiguous TLS listener on this agent.",
        "dockerWebsockets": "WebSockets",
        "dockerCompression": "Compression",
        "dockerCompressionHelp": "Enable or disable compression for this Docker vhost. The enabled codecs and their priority come from global Response settings.",
        "dockerCache": "Cache",
        "vhProxyTimeouts": "Proxy timeouts",
        "vhProxyConnectTimeout": "Proxy connect timeout (s)",
        "vhProxyHeaderTimeout": "Proxy response header timeout (s)",
        "vhProxyReadTimeout": "Proxy read timeout (s)",
        "vhProxySendTimeout": "Proxy send timeout (s)",
        "vhProxyTimeoutsHelp": "Defaults: connect 10 s, response headers 120 s, read 60 s and send 60 s. Read/send are idle-gap timeouts for streaming bodies.",
        "notfoundModeBuiltin": "Application-style status page",
        "pageBuiltin": "Built-in status page",
        "vhOpenBrowser": "Open",
        "securityPasswordHint": "Requires the current password and signs out all sessions.",
        "securityAccessControl": "ACCESS CONTROL",
        "securityPoliciesHint": "Keep the policy list visible; open the editor only when adding or changing a rule set.",
        "securityPolicyEditorHint": "Hostname scope, default action and CIDR rules.",
        "securityAuditOpen": "Administration audit",
        "securityAuditHint": "Recent administration changes are loaded only when this window is opened.",
        "dockerConfigureService": "Configure vhost",
        "dockerAliasesShort": "aliases",
        "dockerAgentDetails": "Agent details",
        "dockerServices": "Services",
        "dockerOpenApp": "Open app",
        "networkInterfacesHistory": "Traffic by interface",
        "networkInterfaceRate": "RX / TX",
        "networkNoInterfaces": "No non-loopback network interfaces are available.",
        "networkInterfacesCount": "{count} interfaces",
        "logExpandBuffer": "Increase buffer",
        "logExpandedBuffer": "Buffer 4096",
        "logBufferExpanded": "Live buffer increased to {count} retained entries.",
        "vhIdRenameHelp": "Changing the vhost ID starts a new metrics/log/cache identity and resets its live health/traffic history. Hostnames and configured backend IDs are unchanged.",
        "vhIdRenameConfirm": "Change vhost ID from {old} to {new}? Live health/traffic history and metric/cache identity for this vhost will restart.",
        "cacheDomainFilter": "Show",
        "cacheDomainFilterAll": "All domains",
        "cacheDomainFilterEnabled": "Cache enabled",
        "cacheDomainFilterDisabled": "Cache disabled",
        "cacheNoDomainsFiltered": "No domains match this filter.",
        "cacheColdCleanup": "Clean cold cache",
        "cacheColdCleanupHelp": "Runs asynchronously and uses the same eviction mechanism as automatic cold-cache GC.",
        "cacheColdUnusedSeconds": "Unused for at least (seconds, optional)",
        "cacheColdOldestCount": "Remove up to oldest objects",
        "cacheColdHitsZero": "Only objects with hits = 0",
        "cacheColdCleanupStart": "Start cleanup",
        "cacheColdCleanupRunning": "Cold-cache cleanup is running…",
        "cacheColdCleanupDone": "Removed {count} objects and freed {bytes}.",
        "cacheColdCleanupFailed": "Cold-cache cleanup failed.",
        "cacheColdCleanupInvalidJob": "Cold-cache cleanup did not return a job identifier.",
        "cacheColdGcInterval": "Cold-cache GC interval (seconds)",
        "cacheColdGcMaxDelete": "Maximum deletes per GC pass",
        "transformSettings": "Static response transformation",
        "transformEnable": "Enable transformation engine globally",
        "transformHelp": "Transformation happens after upstream decoding and before cache storage and client compression. Each vhost must opt in separately.",
        "transformJavascript": "JavaScript minification",
        "transformCss": "CSS minification",
        "transformHtml": "HTML minification",
        "transformSvg": "SVG optimization",
        "transformJson": "JSON compaction",
        "transformExtensions": "Allowed file extensions, one per line",
        "transformMaxBody": "Maximum transformable response (KiB)",
        "transformResourcePresetTitle": "Resource preset",
        "transformResourcePresetHelp": "Presets tune the temporary memory ceiling, maximum transformable response size and global concurrent transformation limit. Content types and extension allow-lists are left unchanged.",
        "transformPresetConservative": "RAM saver",
        "transformPresetRecommended": "Recommended",
        "transformPresetPerformance": "Performance",
        "transformPresetUber": "Uber performance",
        "transformMemoryBudget": "Temporary transform memory budget (MiB)",
        "transformMaxInflight": "Maximum concurrent transformations",
        "transformMaxInflightShort": "concurrent",
        "transformResourceCurrent": "Current limits",
        "transformBudgetTooSmallWarning": "The memory budget is smaller than the worst-case temporary buffers for one maximum-size compressed response. Such responses can be skipped with memory_pressure.",
        "transformBudgetHighWarning": "The transform memory ceiling is more than 50% of effective host/cgroup RAM:",
        "transformSafety": "Cache-Control: no-transform is always respected. Transformed representations receive a new ETag and are cached before gzip, Brotli or zstd encoding.",
        "saveTransform": "Apply transformation policy",
        "vhTransform": "Transform",
        "vhTransformEnable": "Enable transformations for this vhost",
        "vhTransformExtensionsCustom": "Override global transform extensions",
        "vhTransformHelp": "The global engine must also be enabled. Format selectors inherit the global policy unless explicitly enabled or disabled here.",
        "dockerTransform": "Transform static responses",
        "vhPassive5xxWarning": "Counting HTTP 5xx can quarantine the whole backend after repeated application errors from one endpoint.",
        "vhPassiveSlowWarning": "Counting slow responses can quarantine the backend after repeated responses that are correct but exceed the slow-response threshold.",
        "transform": "Transform",
        "transformTitle": "Static response transformation.",
        "transformDescription": "Runtime transformation effectiveness, savings, skips and cache reuse.",
        "transformApplied": "Transformed responses",
        "transformExamined": "Examined",
        "transformCacheHits": "Transformed cache HITs",
        "transformCacheHitsHelp": "Served without running the transformer again",
        "transformSaved": "Bytes saved before compression",
        "transformReduction": "Average reduction",
        "transformReductionHelp": "For responses that changed representation",
        "transformSkipped": "Skipped / fail-open",
        "transformErrors": "Body / transport errors",
        "transformAvgTime": "Avg time",
        "transformByType": "Transformations by type",
        "transformType": "Type",
        "transformSkipReasons": "Skip / fail-open reasons",
        "transformNoSkips": "No skipped transformations in this scope.",
        "transformNoSkipsShort": "No skips",
        "transformVhosts": "Vhost effectiveness",
        "transformScopeHint": "Counters are in-memory runtime diagnostics. A transformed cache HIT does not execute the transformer again.",
        "transformNoData": "No transform activity yet.",
        "transformBadge": "transformed",
        "cacheLiveChartTitle": "Live cache activity",
        "cacheLiveChartHelp": "HIT / MISS / BYPASS per second for the selected scope",
        "liveChartSamples": "Samples",
        "transformLiveChartTitle": "Live transformation activity",
        "transformLiveChartHelp": "Applied / cache HIT / skipped / errors per second for the selected scope",
        "transformChartApplied": "Applied",
        "transformChartCacheHits": "Cache HIT",
        "transformChartSkipped": "Skipped",
        "cacheInvalidationTitle": "Cache purge / ban",
        "cacheInvalidationOperation": "Operation",
        "cacheInvalidationSelector": "Selector",
        "cacheInvalidationValue": "Value",
        "cacheInvalidationHost": "Host (optional)",
        "cacheBanTtl": "BAN TTL (seconds)",
        "cacheInvalidationHelp": "The selected vhost limits the operation. Exact and prefix values include the query string. Regex and root-prefix / operations require an additional confirmation.",
        "cacheRunInvalidation": "Run operation",
        "cacheActiveBans": "Active BAN rules",
        "cacheBanExpires": "Expires",
        "cacheNoBans": "No active BAN rules.",
        "cacheTarget": "Target",
        "cacheKeyTags": "Cache key / tags",
        "cachePurgeUrl": "Purge URL",
        "cacheRemoveBan": "Remove BAN",
        "cacheBanCreated": "BAN created",
        "cacheConfirmPurgeUrl": "Purge this cached URL from RAM and cold storage?",
        "cacheConfirmRemoveBan": "Remove this BAN rule?",
        "cacheWideInvalidationConfirm": "This broad invalidation may affect many cached objects. Continue?",
        "cacheCollapseWaiters": "waiting",
        "cacheCollapsed": "collapsed",
        "actions": "Actions",
        "cacheCollapseTitle": "Request collapsing",
        "cacheCollapseEnable": "Collapse concurrent fills for one cache key",
        "cacheCollapseTimeout": "Follower wait timeout (ms)",
        "cacheCollapseFallback": "Timeout fallback",
        "cacheCollapseFallbackOrigin": "Origin",
        "cacheCollapseFallbackStale": "Stale if available",
        "cacheStaleErrorTitle": "Stale-if-error policy",
        "cacheSieTimeout": "Timeout",
        "cacheSieConnection": "Connection failure",
        "cacheSieDns": "DNS failure",
        "cacheSieTls": "TLS failure",
        "cacheSieStatuses": "HTTP 5xx statuses eligible for stale fallback",
        "cacheProactiveTitle": "Proactive refresh",
        "cacheProactiveEnable": "Refresh sampled cached objects before expiry",
        "cacheProactiveBefore": "Refresh before expiry (seconds)",
        "cacheProactivePercent": "Sampled objects (%)",
        "cacheProactiveInflight": "Maximum concurrent refreshes",
        "cacheProactiveHelp": "Uses validator revalidation, deterministic sampling and a global concurrency cap to avoid refresh storms.",
        "cacheInvalidationOpen": "Purge / Ban",
        "cacheBanListOpen": "Active BANs",
        "cacheBanRemoved": "BAN rule removed",
        "tunnelsOpen": "Active tunnels",
        "tunnelsTitle": "Active WebSocket / tunnels",
        "tunnelsReload": "Reload",
        "tunnelsEmpty": "No active tunnels.",
        "tunnelId": "ID",
        "tunnelClient": "Client",
        "tunnelHost": "Host",
        "tunnelUpstream": "Upstream",
        "tunnelProtocol": "Protocol",
        "tunnelDuration": "Duration",
        "tunnelRx": "RX",
        "tunnelTx": "TX",
        "tunnelKill": "Kill",
        "tunnelKilled": "Tunnel closed by administrator",
        "tunnelKillConfirm": "Close this tunnel?",
        "tunnelKillReason": "Close reason",
        "tunnelKillReasonPlaceholder": "Administrative close",
        "tunnelKillReasonDefault": "admin panel",
        "listenerH2c": "h2c cleartext HTTP/2 (prior knowledge + HTTP/1.1 Upgrade)",
        "vhWebsocketRfc8441": "RFC 8441 Extended CONNECT over HTTP/2",
        "wsH1": "H1 Upgrade",
        "wsH2Rfc8441": "H2 RFC 8441",
        "wsH3Rfc9220": "H3 RFC 9220",
        "wsEstablished": "Established",
        "httpProtocolMix": "HTTP protocol mix",
        "wsProtocolMix": "WebSocket protocol mix",
        "vhWebsocketMode": "WebSocket transport",
        "vhWebsocketDisabled": "Disabled",
        "vhWebsocketH1": "HTTP/1.1 Upgrade",
        "vhWebsocketH2Fallback": "HTTP/2 RFC 8441 + H1 fallback",
        "vhWebsocketH3Fallback": "HTTP/3 RFC 9220 + H1 fallback",
        "vhWebsocketH2H3Fallback": "HTTP/2 + HTTP/3 + H1 fallback",
        "vhMaxConcurrentRequests": "Max concurrent requests",
        "vhBackendQueueTimeout": "Capacity queue timeout (ms)",
        "vhBackendCapacityHelp": "0 concurrent requests means unlimited. A queue timeout of 0 rejects immediately with HTTP 503 when the backend is at capacity.",
        "vhLastFailure": "Last failure",
        "vhLastRecovery": "Last recovery",
        "certificateIssuerName": "Certificate issuer",
        "certificateValidFrom": "Valid from",
        "certificateDaysRemaining": "Days remaining",
        "certificateExpired": "Certificate expired",
        "certificateExpiresSoon": "Certificate expires soon",
        "certificateRenewalStatus": "Renewal status",
        "certificateRenewalError": "Last renewal error",
        "vhActiveHealth": "Active health",
        "vhPassiveFailures": "Passive failures",
        "certificateAdminRestartRequired": "Administration TLS uses a startup-fixed listener; restart RustProxy to refresh that certificate.",
        "cacheTabGeneral": "General",
        "cacheTabResilience": "Resilience",
        "cacheTabCold": "Cold cache",
        "cacheTabDiagnostics": "Static & diagnostics",
        "certificateApiTitle": "Certificate API",
        "certificateApiHelp": "Create separate Key ID + Bearer Token credentials for certificate automation. New tokens are reload-only by default and are restricted to the listed certificate IDs. Enable deploy only for automation that must upload certificate material.",
        "certificateApiKeyId": "Key ID",
        "certificateApiToken": "Bearer token (optional custom value)",
        "certificateApiTokenHelp": "Leave the field empty to generate a strong token. Each cleartext token is shown only once; RustProxy stores only its hash.",
        "certificateApiRotate": "Generate / rotate token",
        "certificateApiRevoke": "Revoke token",
        "certificateApiOneTimeToken": "Copy this token now",
        "certificateApiCurlHelp": "External automation sends the Key ID header and Bearer token over HTTPS (or loopback HTTP). Reload tokens must use the targeted /api/certificates/{id}/reload endpoint; a token cannot call the global reload endpoint.",
        "certificateApiUnknown": "Loading certificate API status…",
        "certificateApiConfigured": "Certificate API enabled",
        "certificateApiDisabled": "Certificate API disabled",
        "certificateApiLastUsed": "last used",
        "certificateApiRotated": "Certificate API token created / rotated. Copy the token now.",
        "certificateApiRevoked": "Certificate API token revoked.",
        "certificateApiRevokeConfirm": "Revoke the external certificate API token? Certbot/API deployments using it will stop immediately.",
        "certificate_api.invalid_token": "Invalid certificate API Key ID or Bearer Token.",
        "certificate_api.https_required": "External certificate API tokens require HTTPS unless the request comes from loopback.",
        "certificate_api.invalid_token_format": "Certificate API tokens must be 32–128 URL-safe characters.",
        "certificate_api.invalid_key_id": "Invalid certificate API Key ID.",
        "vhWebsocketLegacySupport": "Enable WebSocket legacy support",
        "vhWebsocketLegacySupportHelp": "For older appliances and embedded servers. WebSocket handshakes use HTTP/1.1 upstream, Host and Origin are aligned to the configured backend authority, and legacy 101 response framing is tolerated. Ordinary HTTP traffic is unchanged.",
        "vhWebsocketLegacyBadge": "WebSocket legacy",
        "runtimeInformation": "Runtime information",
        "runtimeInformationHelp": "Reported by the running RustProxy process and available only from the authenticated administrator status API.",
        "runtimePlatform": "Platform",
        "statisticsSource": "Statistics source",
        "dataDirectory": "Data directory",
        "databaseLocation": "Database",
        "connectionActivity": "CONNECTION ACTIVITY",
        "reloadCertificate": "Reload certificate",
        "certificateApiComment": "Comment",
        "certificateApiCertificateIds": "Allowed certificate IDs",
        "certificateApiCertificateIdsHelp": "One or more certificate IDs separated by commas or new lines. The token is rejected for every other certificate ID.",
        "certificateApiCertificateIdsRequired": "Enter at least one certificate ID for this token.",
        "certificateApiAllowDeploy": "Also allow deploy",
        "certificateApiAllowDeployHelp": "Leave disabled for Certbot/acme.sh renewal hooks. Reload-only is the recommended least-privilege mode.",
        "certificateApiScopeReloadOnly": "reload only",
        "certificateApiScopeDeployReload": "deploy + reload",
        "certificateApiAllowedIds": "allowed IDs",
        "certificateApiConfiguredCount": "Certificate API tokens: {count} / {max}",
        "certificateApiNeverUsed": "never used",
        "certificateApiRevokeAll": "Revoke all tokens",
        "certificateApiRevokeOneConfirm": "Revoke Certificate API token {key}? Any automation using it will stop immediately.",
        "certificateApiRevokeAllConfirm": "Revoke every Certificate API token? All external certificate automation using these tokens will stop immediately.",
        "certificate_api.invalid_comment": "Certificate API comments must be at most 256 characters and contain no control characters.",
        "certificate_api.limit_reached": "The Certificate API token limit has been reached.",
        "certificate_api.not_found": "Certificate API token not found.",
        "certificate_api.invalid_certificate_ids": "Certificate API tokens require 1-32 valid certificate IDs.",
        "certificate_api.target_required": "Certificate API tokens cannot reload every certificate at once; use the targeted certificate reload endpoint.",
        "certificate_api.certificate_forbidden": "This Certificate API token is not allowed to operate on that certificate ID.",
        "certificate_api.deploy_forbidden": "This Certificate API token is reload-only. Rotate it with deploy permission only if upload/deploy automation is required.",
        "networkInterfacesVisibleCount": "{visible} / {total} interfaces",
        "hideMetric": "Hide",
        "showMetric": "Show",
        "hiddenInterfaces": "Hidden interfaces",
        "networkNoVisibleInterfaces": "All detected interfaces are hidden in this browser.",
        "cacheMemorySizingTitle": "Memory sizing",
        "cacheMemorySizingHelp": "Presets use effective memory available to RustProxy (host RAM capped by cgroup when present). They tune HOT, transient RAM, object size, entry count and the demotion queue; the COLD disk budget is left unchanged.",
        "cachePresetConservative": "Conservative",
        "cachePresetRecommended": "Recommended",
        "cachePresetPerformance": "Performance",
        "cachePresetSelected": "Selected",
        "cachePresetCustom": "Custom",
        "cacheColdPresetTitle": "COLD policy preset",
        "cacheColdPresetHelp": "The recommended policy enables idle/LRU/shutdown demotion, sizes the COLD queue from transient RAM and uses conservative GC timings. Disk path, disk budget and object limit are left unchanged.",
        "cacheTransientLimit": "Transient RAM budget (MiB)",
        "cacheEvictionLimit": "LRU removals per admission",
        "cacheColdQueueLimit": "COLD queue RAM budget (MiB)",
        "cacheMemoryNotDetected": "Memory not detected",
        "cacheMemoryPresetUnavailable": "Automatic presets require host or cgroup memory telemetry.",
        "cacheMemoryCgroup": "Effective cgroup RAM",
        "cacheMemoryDetected": "Detected RAM",
        "cacheQueueOverTransientWarning": "COLD queue budget cannot exceed the transient RAM budget.",
        "cacheMemoryHighWarning": "Warning: HOT + transient cache budgets are a large share of effective RAM:",
        "cachePresetTransientShort": "transient",
        "cachePresetObjectShort": "max object",
        "cachePresetQueueShort": "COLD queue",
        "cacheLogicalShort": "logical",
        "cacheLimitShort": "limit",
        "cacheMemoryPressureShort": "memory pressure",
        "cacheNukeLimitShort": "LRU limit",
        "cacheMemoryPresetTooSmall": "Automatic cache presets are disabled below 256 MiB of effective RAM; configure the cache manually if this is intentional.",
        "cacheMemoryRecommendedFor": "Recommended for detected memory:",
        "cacheMemoryHeadroomWarning": "Warning: the additional cache budget is large compared with currently available host/cgroup memory:",
        "cacheObjectOverTransientWarning": "Maximum object exceeds the transient RAM budget; objects near that size will pass through instead of being cached.",
        "vhCacheGlobalDisabled": "Global cache is disabled. This vhost cannot enable cache until the global cache is enabled.",
        "responseLatencyInfo": "Response time information",
        "responseLatencyHint": "The value is the cumulative mean duration of completed HTTP exchanges since process start. The chart shows successive samples of that mean; it is not a percentile or the latency of one request.",
        "web-server": "Web Server",
        "web-serverTitle": "Serve local files.",
        "web-serverDescription": "Create reusable Web Services and attach them to vhosts or Custom locations.",
        "webServer": "Web Server",
        "webServerIntro": "Create reusable local Web Services here, then attach them to a vhost or Custom location.",
        "webServiceList": "Web Services",
        "webServiceSearch": "Search Web Services",
        "webServiceSearchPlaceholder": "Search name, ID or document root",
        "webServiceNew": "New Web Service",
        "webServiceEditor": "Web Service configuration",
        "webServiceTabGeneral": "General",
        "webServiceTabRouting": "Routing",
        "webServiceTabMime": "MIME",
        "webServiceTabCacheHeaders": "Cache & headers",
        "webServiceTabDelivery": "Delivery",
        "webServiceTabPhp": "PHP-FPM",
        "webServiceTabSecurity": "Security",
        "webServiceId": "Service ID",
        "webServiceName": "Name",
        "webServiceRoot": "Document root",
        "webServiceIndex": "Index files",
        "webServiceDirectoryListing": "Directory listing",
        "webServiceMimeOverrides": "MIME overrides",
        "webServiceMimeBuiltin": "Built-in mappings",
        "webServiceMimeHelp": "Optional extension-to-Content-Type overrides, one per line. Use: ext = media/type.",
        "webServiceMimeInvalid": "MIME overrides must use one unique 'ext = media/type' entry per line.",
        "webServiceDefaultMime": "Default MIME type",
        "webServiceCacheControl": "Cache-Control",
        "webServiceCacheRules": "Cache-Control rules",
        "webServiceCacheRulesHelp": "Specific rules are evaluated in order before the default policy. Match ext:css or mime:image/.",
        "webServiceCacheRulesInvalid": "Cache-Control rules must use matcher = value, for example ext:css = public, max-age=3600.",
        "webServiceResponseHeaders": "Response headers",
        "webServiceResponseHeadersHelp": "Fixed headers for this Web Service. Vhost/location response headers run later and can override them.",
        "webServiceResponseHeadersInvalid": "Response headers must use one unique Header-Name = value entry per line.",
        "webServiceCacheHelp": "Local files use filesystem/OS page cache. These settings control browser/proxy caching and do not create a second RustProxy object cache.",
        "webServiceTryFiles": "try_files",
        "webServiceTryFilesHelp": "One candidate per line. Supports $uri, $query_string and a final =404/other error status.",
        "webServiceRewrites": "Rewrite rules",
        "webServiceRewritesHelp": "One regex rule per line. Use pattern => /target for an internal rewrite or pattern => 301:/target for a redirect.",
        "webServiceRewritesInvalid": "Rewrite rules must use pattern => /target or pattern => 301:/target (301/302/307/308).",
        "webServiceCompression": "Dynamic compression",
        "webServiceCompressionHelp": "Inherits the vhost/global policy by default. Individual codecs can be filtered here; globally disabled codecs remain unavailable and minimum size stays global.",
        "webServicePrecompressed": "Serve precompressed sidecars",
        "webServicePrecompressedBr": "Brotli (.br)",
        "webServicePrecompressedGzip": "Gzip (.gz)",
        "webServiceDownloadExtensions": "Download extensions",
        "webServiceDownloadExtensionsHelp": "Files with these extensions receive Content-Disposition: attachment.",
        "webServiceRangeHelp": "Static and precompressed representations keep validators, single and multipart byte-range requests, 206/416 and streaming delivery.",
        "webServicePhpEnabled": "Enable PHP-FPM / FastCGI",
        "webServicePhpEndpoint": "PHP-FPM endpoint",
        "webServicePhpEndpointHelp": "Unix: unix:/run/php/php-fpm.sock. TCP: tcp:127.0.0.1:9000 or tcp:[::1]:9000. TCP is intentionally limited to loopback addresses.",
        "webServicePhpExtensions": "PHP extensions",
        "webServicePhpPassAuthorization": "Forward Authorization header",
        "webServicePhpConnectTimeout": "Connect timeout (ms)",
        "webServicePhpRequestTimeout": "Total FastCGI request timeout (ms)",
        "webServicePhpConcurrency": "Max concurrent PHP requests",
        "webServicePhpBodyLimit": "PHP request body limit (bytes, 0 = unlimited)",
        "webServicePhpHeaderLimit": "Max FastCGI response header bytes",
        "webServicePhpStderrLimit": "Max PHP-FPM stderr log bytes",
        "webServicePhpCustomParams": "Custom FastCGI parameters",
        "webServicePhpCustomParamsHelp": "One NAME = value entry per line. Static trusted values only; core CGI, HTTP_* and PHP_* control names are reserved.",
        "webServicePhpCustomParamsInvalid": "Custom FastCGI parameters must use one unique NAME = value entry per line.",
        "webServicePhpCustomDataTooLarge": "Custom FastCGI parameters and PHP INI overrides may use at most 128 KiB combined.",
        "webServicePhpValues": "PHP INI overrides (PHP_VALUE)",
        "webServicePhpValuesHelp": "One php.ini directive = value per line. RustProxy sends the validated set as PHP_VALUE; PHP_ADMIN_VALUE is never accepted here.",
        "webServicePhpValuesInvalid": "PHP INI overrides must use one unique directive = value entry per line.",
        "webServicePhpDocsButton": "FastCGI syntax and safety",
        "webServicePhpDocsTitle": "PHP-FPM / FastCGI configuration",
        "webServicePhpDocsIntro": "RustProxy connects directly to an existing PHP-FPM pool. Prefer a Unix socket on the same host. TCP is accepted only on loopback and is not a public/network FastCGI transport.",
        "webServicePhpDocsEndpointTitle": "Endpoint syntax",
        "webServicePhpDocsEndpoint": "For TCP, include the tcp: prefix, a literal loopback IP and port. Hostnames and non-loopback addresses are rejected. For Unix sockets, RustProxy must have permission to connect to the socket.",
        "webServicePhpDocsCustomTitle": "Custom FastCGI parameters",
        "webServicePhpDocsCustom": "Use one NAME = value entry per line. Names are normalized to uppercase and may contain A-Z, 0-9 and underscore. These are static trusted operator values. RustProxy rejects core CGI names, HTTP_* names, PHP_VALUE and PHP_ADMIN_VALUE so they cannot override request routing, script selection or HTTP-derived parameters.",
        "webServicePhpDocsValuesTitle": "PHP INI overrides",
        "webServicePhpDocsValues": "These lines are combined into the FastCGI PHP_VALUE parameter. PHP-FPM/PHP still decides which directives are changeable at this scope. Newlines/control characters are rejected and PHP_ADMIN_VALUE is intentionally unavailable.",
        "webServicePhpDocsLimitsTitle": "Limits and headers",
        "webServicePhpDocsLimits": "Request timeout covers the FastCGI exchange. The body limit is enforced while streaming and returns 413 when exceeded; 0 disables the RustProxy-side body limit. Response-header and stderr limits bound memory/diagnostic data. Up to 64 custom FastCGI parameters and 64 PHP INI overrides are accepted, with at most 128 KiB of combined custom data. Authorization forwarding can be disabled for applications that do not need HTTP_AUTHORIZATION.",
        "webServicePhpDocsSecurity": "Do not put secrets in custom parameters or PHP_VALUE unless you accept storing them in normal Web Service configuration. Use a dedicated non-root PHP-FPM pool identity and keep PHP-FPM off public networks.",
        "webServicePhpHelp": "RustProxy speaks FastCGI directly to a long-running PHP-FPM pool. PHP is not spawned per request and PHP source is never served when PHP handling is selected.",
        "webServicePhpSymlinkConflict": "PHP-FPM currently requires the symlink policy to be Deny.",
        "webServiceSymlinkPolicy": "Symlink policy",
        "webServiceSymlinkDeny": "Deny",
        "webServiceSymlinkInsideRoot": "Allow only inside document root (Linux)",
        "webServiceSafety": "Document root is a strict filesystem boundary. The default denies symlinks. Linux can optionally follow only targets that resolve inside the root; PHP-FPM currently requires the deny policy.",
        "webServiceSelect": "Select Web Service",
        "webService": "Web Service",
        "webServiceUsedBy": "Used by",
        "webServiceUnused": "Not attached",
        "webServiceEmpty": "No Web Services yet.",
        "webServiceSearchEmpty": "No Web Services match this search.",
        "webServiceInUse": "Web Service is still used by",
        "webServiceDelete": "Delete this Web Service?",
        "webServiceIndexRequired": "Index files are optional.",
        "webServiceDuplicate": "A Web Service with this ID already exists.",
        "webServiceRequired": "Select a Web Service.",
        "sourceType": "Source type",
        "sourceReverseProxy": "Reverse Proxy",
        "sourceWebServer": "Web Server",
        "sourceHelp": "The vhost stores only the source choice. Web Server settings remain in the selected reusable Web Service.",
        "locationWebServerAction": "Web Server",
        "locationWebServerShort": "Web Server",
        "docsReader": "Reader",
        "docsApi": "API",
        "docsReaderSearch": "Search documentation",
        "docsReaderSearchPlaceholder": "Search title or path",
        "docsReaderEmpty": "No documentation matches this search.",
        "docsCategoryProject": "Project",
        "docsCategoryGuides": "Functional guides",
        "docsCategoryTechnical": "Technical",
        "docsCategoryAudits": "Audits and history",
        "docsCategoryHistorical": "Historical",
        "webServiceIndexHelp": "Optional. Leave empty to skip index lookup; with directory listing enabled, the file list is shown directly.",
        "webServiceNoIndex": "No index files",
        "vhBackendRequired": "Reverse Proxy requires at least one backend. Add a backend or change the source to Web Server.",
        "vhListenerRequired": "Select at least one listener for this vhost.",
        "traffic": "Traffic",
        "trafficTitle": "Traffic, per vhost.",
        "trafficDescription": "Bounded request analytics: countries, User-Agents, client IPs, paths, routes and protocol outcomes.",
        "trafficSinceStart": "Since process start",
        "trafficResponseBytes": "Response bytes",
        "trafficRequestBytes": "Request bytes",
        "trafficMeanLatency": "Mean latency",
        "trafficDroppedSamples": "Dropped analytics samples",
        "trafficBoundedLabel": "BOUNDED / ASYNC",
        "trafficDimensionsTitle": "Traffic dimensions",
        "trafficApproxHelp": "Top lists are approximate and bounded so high-cardinality traffic cannot grow proxy memory without limit.",
        "trafficTopCountries": "Top countries",
        "trafficTopUserAgents": "Top User-Agents",
        "trafficTopClientIps": "Top client IPs",
        "trafficClientIp": "Client IP",
        "trafficTopPaths": "Top paths",
        "trafficTopRoutes": "Top routes",
        "trafficMethods": "Methods",
        "trafficStatusClasses": "Status classes",
        "trafficCacheOutcomes": "Cache outcomes",
        "trafficValue": "Value",
        "trafficOther": "Other",
        "trafficNoCountryData": "Country collection is disabled or no GeoIP data is available.",
        "trafficNoUserAgentData": "No User-Agent data collected.",
        "trafficNoData": "No traffic data yet.",
        "trafficUserAgentEnabled": "User-Agent collection enabled",
        "trafficUserAgentDisabled": "User-Agent collection disabled",
        "trafficCountryEnabled": "Country collection enabled",
        "trafficCountryDisabled": "Country collection disabled",
        "trafficCountryNoDb": "Country collection enabled, GeoIP database unavailable",
        "trafficUpdated": "Updated",
        "loggingCaptureTitle": "Captured request dimensions",
        "loggingCaptureUserAgent": "Capture User-Agent",
        "loggingCaptureCountry": "Capture country from GeoIP",
        "loggingCaptureCountryHelp": "Country lookup is optional and disabled by default. Enable it only when country logs/statistics are needed; country ACL/rate-limit rules still resolve GeoIP when required.",
        "cacheAutoTrimEnabled": "Automatically release idle HOT cache memory",
        "cacheAutoTrimAfter": "Idle age before HOT trim (seconds)",
        "cacheAutoTrimTarget": "HOT trim target (%)",
        "cacheAutoTrimHelp": "When HOT memory is above the target, only entries idle for the configured age are removed in bounded passes. Active objects are not purged.",
        "webServiceTabHtaccess": ".htaccess",
        "webServiceHtaccessEnabled": "Enable .htaccess compatibility",
        "webServiceHtaccessFilename": "Configuration file",
        "webServiceHtaccessRecursive": "Scan subdirectories",
        "webServiceHtaccessStrict": "Strict unsupported-directive mode",
        "webServiceHtaccessDocs": "Compatibility documentation",
        "webServiceHtaccessHelp": "RustProxy compiles a bounded Apache-compatible subset when the Web Service is applied. Files are not parsed on every request; apply the Web Service again after editing .htaccess on disk.",
        "webServiceHtaccessDocsTitle": ".htaccess compatibility",
        "webServiceHtaccessDocsIntro": "This is a migration-oriented compatibility layer, not a complete Apache runtime. Supported directives are compiled into RustProxy Web Server rules.",
        "webServiceHtaccessDocsSupportedTitle": "Supported subset",
        "webServiceHtaccessDocsRewriteTitle": "Rewrite compatibility",
        "webServiceHtaccessDocsRewrite": "Rewrite conditions support REQUEST_FILENAME file tests (-f, -d, -s), REQUEST_URI, REQUEST_METHOD, QUERY_STRING, HTTP_HOST, HTTPS, DOCUMENT_ROOT, THE_REQUEST and HTTP headers. Flags: L, END, R, R=301/302/307/308, QSA, NC, F, OR. PT/NE are accepted as no-ops. E= is accepted as a compatibility no-op because request HTTP headers already reach PHP-FPM.",
        "webServiceHtaccessDocsPhpTitle": "PHP-FPM",
        "webServiceHtaccessDocsPhp": ".htaccess may add PHP extensions with AddHandler, but the PHP-FPM endpoint, timeouts and concurrency remain controlled by the Web Service PHP-FPM tab. Apache SetHandler proxy socket syntax is intentionally not accepted.",
        "webServiceHtaccessDocsReloadTitle": "Loading and limits",
        "webServiceHtaccessDocsReload": "Files are read and compiled on Validate, save and apply. RustProxy does not parse .htaccess per request. Re-apply after changing a file. The scan is bounded to 128 files, depth 16, 128 KiB per file and 1 MiB total.",
        "webServiceHtaccessDocsUnsupportedTitle": "Not Apache-complete",
        "webServiceHtaccessDocsUnsupported": "ErrorDocument, SetEnvIf, Redirect/RedirectMatch and FallbackResource are not implemented in this compatibility layer. General Files/FilesMatch, unsupported authentication/authorization directives, non-PHP handlers and SetHandler are rejected even when Strict mode is off because silently ignoring them could weaken access control or expose source. .htaccess/.htpasswd files are always blocked from HTTP delivery. Other unsupported non-security directives are logged and ignored unless Strict mode is enabled.",
        "webServiceHtaccessDocsSecurity": "Vhost/location ACL, authentication, error pages and response rules still remain authoritative. .htaccess cannot escape the document root, select an arbitrary FastCGI socket or override protected framing headers.",
        "webServicePresetTitle": "Configuration preset",
        "webServicePreset": "Preset",
        "webServicePresetCustom": "Custom",
        "webServicePresetStatic": "Static site",
        "webServicePresetSpa": "SPA",
        "webServicePresetPhpGeneric": "PHP generic",
        "webServicePresetDownloads": "Downloads / file repository",
        "webServicePresetAction": "Preset action",
        "webServicePresetApply": "Apply preset",
        "webServicePresetHelp": "Presets fill normal Web Service settings and remain fully editable. Document root, service ID/name and PHP-FPM endpoint are not replaced.",
        "webServicePresetChoose": "Choose a preset before applying it.",
        "webServicePresetApplied": "Preset applied. Review the generated settings before saving.",
        "webServicePresetHintStatic": "Static site: HTML indexes, precompressed sidecars and cache rules for CSS/JS/images/fonts.",
        "webServicePresetHintSpa": "SPA: index.html fallback via try_files, precompressed assets and long-lived static asset caching.",
        "webServicePresetHintPhpGeneric": "Generic PHP: PHP-FPM enabled, index.php first and only existing files/directories are served directly.",
        "webServicePresetHintWordpress": "WordPress: PHP-FPM, index.php and front-controller routing. Keep document root on the WordPress public directory.",
        "webServicePresetHintDrupal": "Drupal: PHP-FPM, index.php and front-controller routing with static asset caching.",
        "webServicePresetHintLaravel": "Laravel: PHP-FPM and front-controller routing. Point document root at the application public/ directory.",
        "webServicePresetHintSymfony": "Symfony: PHP-FPM and front-controller routing. Point document root at the application public/ directory.",
        "webServicePresetHintJoomla": "Joomla: PHP-FPM, index.php and front-controller routing with static asset caching.",
        "webServicePresetHintPrestashop": "PrestaShop: PHP-FPM, index.php and front-controller routing with static asset caching.",
        "webServicePresetHintDownloads": "Downloads: directory listing enabled, Range-friendly static delivery and common archive/document extensions forced as attachments.",
        "webServiceHardeningTitle": "Hardening",
        "webServiceHardeningAttacks": "Block common attack probes",
        "webServiceHardeningHeaders": "Strip unnecessary fingerprint headers",
        "webServiceHardeningSecurityHelp": "Hardening switches are shown beside the preset selector on General. They remain independent settings after a preset is applied.",
        "trafficTabOverview": "Overview",
        "trafficTabClients": "Clients",
        "trafficTabRequests": "Requests",
        "trafficTabDelivery": "Delivery",
        "trafficVolume": "Traffic volume",
        "vhMethodMode": "HTTP method policy",
        "vhMethodList": "HTTP methods (one per line)",
        "vhMethodHelp": "Allow only listed methods or block listed methods for this vhost. The policy stacks with location rules.",
        "locationAclProfile": "ACL profile",
        "locationMethodMode": "HTTP method policy",
        "locationMethodList": "HTTP methods (one per line)",
        "locationMethodAllow": "Allow only",
        "locationMethodBlock": "Block listed",
        "locationMethodHelp": "The location policy stacks with the vhost method policy. Example: GET, HEAD and POST.",
        "locationCountryMode": "Country access policy",
        "locationCountryList": "Country codes (one per line)",
        "locationCountryHelp": "Location country policy stacks with vhost/profile policy. GeoIP is resolved only when required.",
        "configHistory": "Revision history",
        "configHistoryRetention": "SQLITE / LAST 512 REVISIONS",
        "configHistoryHelp": "Select a marked day to inspect retained configuration revisions and their changes. History retention starts with 0.25.3.",
        "configHistoryChanges": "CHANGES",
        "configHistorySelectDay": "Select a day.",
        "configHistoryRevision": "Revision",
        "configHistoryRevisionShort": "rev",
        "configHistoryBefore": "Before",
        "configHistoryAfter": "After",
        "configHistoryBaseline": "This is the oldest retained baseline; no earlier revision is available for comparison.",
        "configHistoryNoChanges": "No configuration differences were found.",
        "configHistoryDiffLimit": "Diff truncated after 200 changed paths.",
        "configHistoryMissing": "(not present)",
        "configHistoryEntries": "revisions",
        "configHistorySummary": "{count} retained revisions",
        "configHistoryEmpty": "No retained revisions.",
        "configHistoryLoading": "Loading revision history...",
        "configHistoryFailed": "Could not load revision history.",
        "configHistoryRestoreAction": "Restore revision",
        "configHistoryRestoreConfirm": "Restore revision {revision}? It will be validated and saved as a new revision after current revision {current}. The existing history will be preserved.",
        "configHistoryRestored": "Revision {revision} restored as new revision {new_revision}.",
        "about": "About",
        "aboutTitle": "About RustProxy",
        "aboutAuthor": "Author",
        "aboutLicense": "License",
        "aboutLicenseValue": "Open Source",
        "aboutOpenSourceText": "RustProxy is an open-source project. Its source code is publicly available for inspection, development and community contribution.",
        "aboutRepository": "Official source repository",
        "aboutPackagesRepository": "Official package repository",
        "aboutPythonRuntime": "Certificate Python runtime",
        "runtimePython": "Python",
        "runtimePip": "pip",
        "runtimeCertbot": "Certbot",
        "runtimeAcmeMode": "ACME mode",
        "runtimeAvailable": "Available",
        "runtimeUnavailable": "Unavailable",
        "vhPoolRecycleRequests": "Recycle upstream pool after requests (0 = off)",
        "vhPoolRecycleSeconds": "Maximum upstream pool age (seconds, 0 = off)",
        "vhHttp1MaxBuffer": "HTTP/1 upstream max read buffer (bytes)",
        "vhPoolRecycleHelp": "Recycling replaces only the Hyper client generation for each backend; active exchanges continue normally. Defaults bound long-lived pool/TLS buffer retention without reloading the vhost or cache. Request recycling accepts 0 or 1000..10000000; age accepts 0 or 60..604800.",
        "backendSearch": "Search backends",
        "backendSearchPlaceholder": "Search vhost, backend or state",
        "backendSortBy": "Sort by",
        "backendSortAscending": "Ascending sort",
        "backendSortDescending": "Descending sort",
        "backendColumns": "Columns",
        "backendSearchEmpty": "No backends match the current search.",
        "vhQuickEnable": "Enable",
        "vhQuickDisable": "Disable",
        "vhEnableHint": "Controls whether this vhost accepts traffic.",
        "backendColumnsRequired": "At least one backend table column must remain visible.",
        "logs": "Logs",
        "storedLogs": "Stored logs",
        "fileLogsSearchHelp": "Search syntax",
        "fileLogsSearchHelpTitle": "Kibana-style field search",
        "fileLogsSearchHelpText": "Use field:value clauses. Clauses are joined with AND; prefix a clause with ! to exclude it. Quotes keep spaces together.",
        "fileLogsParsedFields": "Parsed fields",
        "fileLogsRawJson": "Raw JSON",
        "filelogs": "Logs",
        "filelogsTitle": "Stored log explorer",
        "filelogsDescription": "Search configured on-disk RustProxy logs without coupling to the Live Logs memory buffer.",
        "fileLogsTitle": "Stored log explorer",
        "fileLogsMode": "LOCAL / READ-ONLY / BOUNDED",
        "fileLogsHelp": "Searches bounded RustProxy access/error logs and parses structured fields without exposing filesystem paths.",
        "fileLogsSettingsHelp": "Browse configured access and error files with server-side filters. File logging can be off while Live Logs continues to use its memory buffer.",
        "openLogs": "Open Logs",
        "fileLogsSource": "Source",
        "fileLogsAllSources": "All configured files",
        "fileLogsNoSources": "No configured log files are available.",
        "fileLogsEvent": "Event",
        "fileLogsPageSize": "Page size",
        "fileLogsRecord": "Request / reason",
        "fileLogsEmpty": "No records match the current filters.",
        "fileLogsDetails": "Record details",
        "fileLogsSelectRecord": "Select a record to inspect its JSON.",
        "fileLogsSearchPlaceholder": "req: GET AND !country: Poland",
        "fileLogsTruncated": "scan limit reached",
        "fileLogsSummary": "{from}–{to} of {total} matches · scanned {bytes} / {lines} lines",
        "fileLogsMatchedBy": "Matched by",
        "fileLogsSni": "SNI",
        "fileLogsAuthority": "Authority / Host",
        "fileLogsColumnsRequired": "At least one Stored Logs column must remain visible.",
        "fileLogsSourcesRead": "Configured files",
        "search": "Search",
        "all": "All",
        "clientIp": "Client IP",
        "vhost": "Vhost",
        "previous": "Previous",
        "next": "Next",
        "refresh": "Refresh",
        "applyFilters": "Apply filters",
        "appearance": "Appearance",
        "appearanceEyebrow": "INTERFACE",
        "appearanceHelp": "These preferences are saved for your administrator account and follow you between sessions.",
        "languageAutomatic": "Automatic (browser)",
        "interfaceScale": "Interface scale",
        "interfaceScaleHelp": "Scale the entire administration interface, including dialogs and overlays, without changing browser zoom.",
        "timeFormat": "Time format",
        "timeFormat24": "24-hour",
        "timeFormat12": "12-hour",
        "chartStyle": "Chart style",
        "chartStyleDefault": "Default",
        "chartStyleSoft": "Soft",
        "chartStyleTechnical": "Technical",
        "chartStyleHighContrast": "High contrast",
        "chartStylePreview": "Preview",
        "draftDockTitle": "Drafts",
        "draftUntitled": "New",
        "draftRestore": "Restore draft",
        "draftDiscard": "Discard draft",
        "draftDiscardConfirm": "Discard this unsaved draft?",
        "draftMinimized": "Draft moved to the dock.",
        "chartStyleNeon": "Neon",
        "chartStyleMonochrome": "Monochrome",
        "chartStyleWarm": "Warm",
        "chartStyleCool": "Cool",
        "settingsSearch": "Find settings",
        "settingsSearchPlaceholder": "Search settings, sections and options...",
        "settingsSearchResults": "Matching sections",
        "appearanceReset": "Reset appearance",
        "appearanceResetDone": "Appearance preferences reset",
        "appearanceInterfaceSection": "INTERFACE",
        "appearanceInterfaceTitle": "Interface",
        "appearanceChartsSection": "CHARTS",
        "appearanceDataSection": "TABLES / LOGS",
        "appearanceDashboardSection": "DASHBOARD",
        "resetSection": "Reset section",
        "appearanceSectionResetDone": "Section preferences reset",
        "chartStylePalettes": "Chart style palettes",
        "tableDensity": "Tables and logs density",
        "densityNormal": "Normal",
        "densityUltra": "Ultra compact",
        "tableDensityHelp": "Changes row height and log spacing independently from interface scale.",
        "dashboardLayout": "Dashboard layout",
        "dashboardDensity": "Dashboard density",
        "dashboardDensityHelp": "Controls Overview telemetry card size without changing the rest of the interface.",
        "dashboardWidgets": "Overview cards",
        "dashboardWidgetsHelp": "Show, hide and reorder the telemetry cards at the top of Overview.",
        "dashboardWidgetVisible": "Visible",
        "moveUp": "Move up",
        "moveDown": "Move down",
        "draftDockCollapse": "Collapse drafts",
        "draftDockExpand": "Expand drafts",
        "draftAgeNow": "now",
        "draftAgeMinutes": "{count} min",
        "draftAgeHours": "{count} h",
        "draftAgeDays": "{count} d",
        "buttonStyle": "Button style",
        "buttonStyleNormal": "Normal",
        "buttonStyleCompact": "Compact",
        "buttonStyleHelp": "Normal uses the refreshed controls; Compact restores the smaller source-style buttons across all actions and dialog tabs.",
        "entityEnableHint": "Controls whether this item is active.",
        "setupCommandExample": "Standard service installation example:",
        "certificateRuntimeTitle": "ACME runtime",
        "certificateRuntimePreparing": "Preparing",
        "certificateRuntimeManaged": "Managed Python",
        "certificateRuntimeSystem": "System fallback",
        "certificateRuntimeUnavailable": "Unavailable",
        "certificateRuntimePath": "Managed environment",
        "acme.runtime_checking": "Checking the local Python environment for certificate management.",
        "acme.runtime_initializing": "Creating a private Python environment in the RustProxy data directory and installing Certbot modules with pip.",
        "acme.runtime_ready": "The private Python/pip environment for certificate management is ready.",
        "acme.runtime_fallback": "The private environment could not be used. RustProxy is using the distribution Python and Certbot available in PATH.",
        "acme.runtime_python_missing": "Python is not available on this system. Automatic ACME generation and renewal are unavailable; PEM import and existing certificate files still work.",
        "acme.runtime_pip_missing": "Python is available, but RustProxy could not create a local pip environment and no distribution Certbot is available. Install Python with venv/pip or Certbot packages. PEM import and existing files still work.",
        "acme.runtime_setup_failed": "RustProxy could not create the local Python/pip environment and no distribution Certbot is available. Check network/package access or install Certbot from the distribution. PEM import and existing files still work.",
        "acme.runtime_venv_failed": "Python and pip are available, but RustProxy could not create its private environment in the data directory. Check venv/virtualenv support and data-directory permissions. No system Certbot is available.",
        "acme.runtime_venv_pip_failed": "The private Python environment was created, but pip/ensurepip could not be started inside it. Check the Python venv/ensurepip installation. No system Certbot is available.",
        "acme.runtime_certbot_install_failed": "The private Python environment works, but pip could not install the Certbot packages. Check PyPI/proxy/DNS/TLS access. No system Certbot is available.",
        "acme.runtime_certbot_validation_failed": "ACME packages were installed, but Certbot or one of the required plugins failed validation. Remove the acme-python directory and restart RustProxy, or check compatibility with the local Python.",
        "acme.runtime_data_dir_missing": "The RustProxy data directory is unavailable, so a private Python environment cannot be created. PEM import and existing certificate files still work.",
        "geoipUpdatesTitle": "GeoIP updates",
        "geoipUpdatesHelp": "Download direct GeoIP country sources in the background and hot-reload them without restarting proxy traffic. Publisher SHA-256 verification is optional per file.",
        "geoipUpdatesEnable": "Enable automatic GeoIP updates",
        "geoipReleaseUrl": "Release files base URL",
        "geoipChecksumUrl": "Checksum files base URL",
        "geoipMaxFileMiB": "Maximum file size (MiB)",
        "geoipIntervalHours": "Update interval (hours)",
        "geoipStatusLoaded": "GeoIP database loaded",
        "geoipStatusMissing": "GeoIP database is not loaded yet. The background worker will retry automatically.",
        "geoipStatusDisabled": "Automatic GeoIP updates are disabled.",
        "cacheViaEnable": "Add Via response header",
        "cacheViaValue": "Via header value",
        "cacheViaHelp": "Defaults to Via: RustProxy. Bypass and response-only diagnostic header changes apply immediately without purging cached objects.",
        "geoipUpdateNow": "Download now",
        "geoipUpdateNowHelp": "Uses the saved direct source URLs and optional checksum URLs. Manual download works even when automatic updates are disabled and hot-reloads the validated database.",
        "geoipUpdateSaveFirst": "Save GeoIP settings before running a manual download.",
        "geoipUpdateWorking": "Downloading and validating GeoIP data…",
        "geoipUpdateUpdated": "GeoIP database downloaded and hot-reloaded.",
        "geoipUpdateCurrent": "GeoIP database is already current and loaded.",
        "geoipUpdateBusy": "Another GeoIP update is already running; try again shortly.",
        "geoipFormat": "Database format",
        "geoipFormatCsvPair": "CSV ranges (separate IPv4 + IPv6)",
        "geoipFormatMmdb": "MaxMind DB (.mmdb, IPv4 + IPv6)",
        "geoipIpv4Url": "IPv4 CSV direct URL",
        "geoipIpv4ChecksumUrl": "IPv4 SHA-256 URL (optional)",
        "geoipIpv6Url": "IPv6 CSV direct URL",
        "geoipIpv6ChecksumUrl": "IPv6 SHA-256 URL (optional)",
        "geoipMmdbUrl": "MaxMind DB direct URL",
        "geoipMmdbChecksumUrl": "MaxMind DB SHA-256 URL (optional)",
        "geoipSourceHelp": "CSV mode uses separate IPv4 and IPv6 range files. MMDB mode uses one native MaxMind DB file and supports standard country.iso_code, registered_country.iso_code, or country_code records. Leave a checksum URL empty to skip publisher-checksum verification; every download is still size-bounded and format-validated before atomic publish. For a local custom MMDB, place it at <data-dir>/geoip/country.mmdb, select MMDB and disable automatic updates.",
        "certificateFileSource": "File location",
        "certificateSourceManaged": "RustProxy certificate directory (<data-dir>/certs)",
        "certificateSourceExternal": "External files (absolute paths)",
        "certificateSourceManagedHelp": "Enter filenames only, for example app.pem and app.key. RustProxy loads them from <data-dir>/certs (normally /var/lib/rustproxy/certs for a packaged service).",
        "certificateSourceExternalHelp": "Enter absolute server paths. Certbot example: /etc/letsencrypt/live/example.com/fullchain.pem and /etc/letsencrypt/live/example.com/privkey.pem. live/ symlinks are resolved on every reload. POSIX ACL read access is supported; RustProxy does not require an exact chmod. The private key must not be world-readable or group/world-writable, and the path must stay under root- or rustproxy-owned non-writable directories.",
        "certificateExternalAclExample": "ACL example (grant traversal, not directory read):\nsetfacl -m u:rustproxy:--x /etc/ssl/\nsetfacl -m u:rustproxy:--x /etc/letsencrypt/ /etc/letsencrypt/live/ /etc/letsencrypt/archive/\nsetfacl -m u:rustproxy:--x /etc/letsencrypt/live/example.com/ /etc/letsencrypt/archive/example.com/\nsetfacl -m u:rustproxy:r-- /etc/letsencrypt/archive/example.com/fullchain*.pem /etc/letsencrypt/archive/example.com/privkey*.pem\nAfter renewal, reapply read ACL to the current resolved files before API reload:\nsetfacl -m u:rustproxy:r-- \"$(readlink -f /etc/letsencrypt/live/example.com/fullchain.pem)\" \"$(readlink -f /etc/letsencrypt/live/example.com/privkey.pem)\"",
        "certificateExternalFiles": "External file paths",
        "vhWwwRedirect": "Redirect www ↔ non-www",
        "vhWwwRedirectTarget": "Choose the domain and redirect direction (308 destination)",
        "vhWwwRedirectHelp": "Only the selected www/non-www pair redirects (308). Other names use the same backend without cross-domain redirects. TLS must cover both variants.",
        "vhCacheForceEnabled": "Unsafe forced cache for selected URLs",
        "vhCacheForceTargets": "Forced cache path/query prefixes (one per line)",
        "vhCacheForceHelp": "Per-vhost only. Matching GET/HEAD targets may ignore query bypass, request Cookie/Authorization and client no-cache/no-store. Cookie/Authorization remain separate cache variants. Origin Set-Cookie, private and no-store responses are still never stored.",
        "vhCacheForceConfirm": "Forced cache can serve stale or user-specific content if configured incorrectly. Enable it only for explicitly reviewed URL prefixes?",
        "locationRedirectAction": "Redirect to URL",
        "locationRedirectShort": "redirect",
        "locationRedirectStatus": "Redirect status",
        "locationRedirectTarget": "Target URL template",
        "locationRedirectPattern": "Optional rewrite regex for captures",
        "locationRedirectQuery": "Preserve request query string",
        "locationRedirectHelp": "Target must be an absolute http/https URL. Optional rewrite regex supports $1/${name} replacements in the path/query portion, for example ^/(.*)$ → https://storage.example/o/$1.",
        "locationRedirect301": "301 Permanent",
        "locationRedirect302": "302 Found",
        "locationRedirect303": "303 See Other",
        "locationRedirect307": "307 Temporary",
        "locationRedirect308": "308 Permanent",
        "cacheReason_cache_miss_forced": "Forced-cache target miss",
        "vhWwwPanelTitle": "WWW address routing",
        "vhWwwInactive": "Redirect is off. Choose a destination below and then enable the switch above. All hostnames currently serve the same vhost.",
        "vhWwwOtherDomains": "Other domains (no redirect):",
        "vhWwwNoHosts": "Add an exact hostname above to enable a WWW redirect. Wildcards cannot be the destination.",
        "vhWwwSharedCount": "{count} names / one vhost",
        "vhWwwEnable": "Enable 308 redirect",
        "vhErrorFallbackTarget": "Main error fallback target",
        "vhErrorFallbackStatuses": "Intercepted status codes",
        "vhErrorFallbackHelp": "Target must be an enabled internal Custom Location. Supported statuses: 403, 404, 500, 502, 503, 504. The request is dispatched internally without an HTTP redirect.",
        "locationInternal": "Internal named location",
        "locationErrorFallbackTarget": "Error fallback target",
        "locationErrorFallbackStatuses": "Intercepted status codes",
        "locationErrorFallbackHelp": "Optional Nginx-style error fallback. Target an enabled internal location by ID. Supported statuses: 403, 404, 500, 502, 503, 504.",
        "webServicePhpPathInfo": "Enable PHP PATH_INFO splitting"
    }
}