<?php

return [
    'title' => 'Integrations',
    'subtitle' => 'Connected services, grouped by purpose — credentials and settings side by side, not on separate pages by storage mechanism.',

    // The switch — above every credential, because it governs which slot of
    // each entry below applies.
    'mode_title' => 'Operating mode',
    'mode_body' => 'Decides which slot of each credential below applies. In test mode, an empty test slot falls back to the live slot — except the Stripe key, which does not fall back either way.',
    'mode_switch_to_test' => 'Switch to test mode',
    'mode_switch_to_live' => 'Switch to live mode',
    'mode_switched' => 'Operating mode switched: :mode.',
    'mode_switch_title_test' => 'Really switch to test mode?',
    'mode_switch_body_test' => 'From now on, every credential uses its test slot — or, where that one is empty, the live slot. Payments continue to go through whichever Stripe key belongs to the active mode.',
    'mode_switch_confirm_test' => 'Switch',
    'mode_switch_title_live' => 'Really switch to live mode?',
    'mode_switch_body_live' => 'From now on, real money moves: every order is charged through the live Stripe key, not the test one. This is not a switch to click by accident.',
    'mode_switch_confirm_live' => 'Switch',

    'catalogue_title' => 'Price catalogue in Stripe',
    'catalogue_body' => 'Creates a product and prices in Stripe for every published plan version. The dry run shows what would be created first.',
    'catalogue_dry_run' => 'Dry run',
    'catalogue_sync' => 'Sync',
    'catalogue_dry_run_queued' => 'Dry run queued — the result appears here once it is through.',
    'catalogue_sync_queued' => 'Sync queued — the result appears here once it is through.',
    'catalogue_never_run' => 'Never run.',
    'catalogue_ok' => 'Completed',
    'catalogue_failed' => 'Failed',
    'catalogue_was_dry_run' => 'Dry run',
    'catalogue_was_live_run' => 'Live run',
    'catalogue_sync_title' => 'Really write the catalogue to Stripe?',
    'catalogue_sync_body' => 'Products and prices are created in the Stripe account belonging to the current operating mode. A Stripe price cannot be edited afterwards, only archived. The dry run shows what would be created first.',
    'catalogue_sync_confirm' => 'Sync',

    'payments_title' => 'Payments (Stripe)',
    'payments_body' => 'The secret key used to accept payments and verify webhooks.',

    'dns_title' => 'DNS (Hetzner)',
    'dns_body' => 'The API token, the zone, and where Traefik expects its dynamic configuration.',
    'dns_zone' => 'DNS zone',
    'dns_zone_hint' => 'For example clupilot.com — customer instances get <subdomain>.<zone>.',
    'traefik_path' => 'Traefik dynamic config path',
    'traefik_path_hint' => 'Directory on the traffic host that routes get written into.',

    'monitoring_title' => 'Monitoring',
    'monitoring_body' => 'This is how CluPilot notices that a customer cloud is down — before the customer calls. Every new instance automatically gets a check on its status page; when one fails, the notice appears on the overview. With no customer instances there is nothing to see here. Leaving it empty turns monitoring off, nothing else changes.',
    'monitoring_url' => 'Monitoring bridge URL',
    'monitoring_url_hint' => 'For example http://kuma-bridge:8080. Leave blank to leave monitoring off.',

    'vpn_title' => 'VPN/WireGuard',
    'vpn_body' => 'How a new host reaches CluPilot as the VPN hub. The private hub key stays in the server file — only the public half and the address live here.',
    'wg_endpoint' => 'Hub endpoint',
    'wg_endpoint_hint' => 'Publicly reachable address and port, e.g. vpn.clupilot.com:51820.',
    'wg_hub_pubkey' => 'Hub public key',
    'wg_hub_pubkey_hint' => 'Output of wg pubkey < /etc/wireguard/privatekey on this server.',

    'ssh_title' => 'SSH identity',
    'ssh_body' => 'The key deployed to every fresh host — its public and private halves, together in one place.',
    'ssh_public_key' => 'SSH key (public)',
    'ssh_public_key_hint' => 'Written into authorized_keys during host onboarding.',

    'save_settings' => 'Save settings',
    'settings_saved' => 'Saved. The new value applies immediately.',

    // .env editor (Part B).
    'env_title' => 'Advanced: server file (.env)',
    'env_subtitle' => 'Everything above with no field of its own — raw, as it sits on the server. Without this editor, that still needs a shell.',
    'env_locked' => 'Locked. Unlock above to see the server file.',

    'env_danger_title' => 'These lines can lock you out of the console itself',
    'env_danger_body' => 'A wrong value on one of these lines makes the console unreachable for you too: APP_KEY, DB_* (the database connection), REDIS_* (sessions, cache, queue), SESSION_*. Not blocked — full control was the decision — but these lines are worth a second look.',

    'env_vault_title' => 'Managed by credential storage',
    'env_vault_body' => 'SecretVault::get() prefers a value stored there and only falls back to the server file when none is stored. While a value is stored above, the matching line below changes nothing — otherwise the console would contradict itself.',
    'env_vault_active' => 'stored — this line has no effect',
    'env_vault_inactive' => 'not stored — this line applies',

    'env_label' => 'Contents of .env',
    'env_save' => 'Save',

    'env_backup_title' => 'Backup',
    'env_backup_body' => 'A copy is placed beside .env before every save (filename .env.bak-timestamp). Nothing deletes them automatically.',

    // queue, queue-provisioning, scheduler and reverb only read .env at
    // their own startup. Until here that was homework — "go restart that
    // yourself" — the same complaint as the update button before it: working
    // back over the command line what the console already knew. Saving now
    // triggers that itself (App\Livewire\Admin\Integrations::saveEnv()):
    // clearing the config cache (immediately, no host agent needed for that)
    // and asking the agent for the restart
    // (App\Services\Deployment\UpdateChannel::requestRestart()).
    'env_restart_title' => 'What happens automatically on save',
    'env_restart_body' => 'queue, queue-provisioning, scheduler and reverb only read .env at their own startup. Saving here therefore triggers this automatically: the configuration cache is cleared, and these four services are restarted. This console itself (app) is never touched — it is serving the very request that triggered this, and its PHP reads .env fresh on every request anyway.',
    'env_restarting' => 'Restarting services …',
    'env_restart_done' => 'Services restarted.',

    'env_save_title' => 'Really overwrite .env?',
    'env_save_body' => 'It holds every credential in the system. A backup is made first, and the affected services are restarted automatically after saving.',
    'env_save_confirm' => 'Overwrite',
    // Three outcomes after writing, never a glossed-over success message: the
    // restart was requested, or it could not be — because the host agent is
    // not running, or because something else is already in flight — and then
    // the manual command is shown here instead of a promise.
    'env_saved_restarting' => 'Saved. Backup: :backup. Configuration cache cleared — queue, queue-provisioning, scheduler and reverb are restarting now.',
    'env_saved_restart_busy' => 'Saved. Backup: :backup. Another request to the update service is already in flight — the restart does not happen automatically this time. Please run manually: docker compose restart queue scheduler reverb.',
    'env_saved_no_agent' => 'Saved. Backup: :backup. The server-side update service is not running — queue, scheduler and reverb still hold the old values. Please run manually: docker compose restart queue scheduler reverb.',
    // Only when no .env existed before — then there is nothing to back up.
    'env_no_previous_file' => 'none, no file existed before this',

    'env_invalid' => 'Line :line is neither blank, a comment, nor KEY=value. Nothing was saved.',
    'env_empty' => 'An empty file would erase every setting. Nothing was saved.',
    'inbound_title' => 'Support mailbox (inbox)',
    'inbound_body' => 'Where CluPilot fetches customer mail from, shown under Operations → Inbox. IMAP, not the mailcow API: the API administers domains and mailboxes, reading one is IMAP. The password is kept encrypted in the vault.',
    'inbound_host' => 'IMAP server',
    'inbound_port' => 'Port',
    'inbound_port_hint' => '993 is IMAP over TLS. Anything else is unencrypted — and this connection carries a password and your customers own words.',
    'inbound_username' => 'Mailbox',
    'inbound_folder' => 'Folder',
    'inbound_test' => 'Test the connection',
    'inbound_never' => 'Never checked.',
    'inbound_last_ok' => 'Last reached: :when (:ago)',
    'inbound_last_failed' => 'Last failed: :when (:ago)',
    'inbound_ok' => 'Mailbox reachable.',
    'inbound_ok_waiting' => '{0} Mailbox reachable, nothing unread.|{1} Mailbox reachable, :count unread message.|[2,*] Mailbox reachable, :count unread messages.',
    'inbound_failed_incomplete' => 'Something is still missing: server, mailbox or password.',
    'inbound_failed_unreachable' => 'The server cannot be reached. Are the address and port right?',
    'inbound_failed_credentials' => 'The server refused the sign-in. Are the mailbox and password right?',
    'inbound_failed_folder' => 'The sign-in worked, but that folder does not exist.',
    'inbound_failed_failed' => 'The connection failed. There is more in the log.',

    // The tabs. Split by what a section is for — not by which storage
    // mechanism happens to hold a given value.
    'tab' => [
        'services' => 'Services',
        'platform' => 'Platform',
        'env' => 'Environment (.env)',
    ],
];
