<?php

return [
    'title' => 'Integrations',
    'subtitle' => 'Connected services, grouped by purpose — credentials and settings side by side, not on separate pages by storage mechanism.',

    'payments_title' => 'Payments (Stripe)',
    'payments_body' => 'The secret key used to accept payments and verify webhooks.',

    'dns_title' => 'DNS (Hetzner)',
    'dns_body' => 'The API token, the zone, and where Traefik expects its dynamic configuration.',
    'dns_zone' => 'DNS zone',
    'dns_zone_hint' => 'For example clupilot.com — customer instances get <subdomain>.<zone>.',
    'traefik_path' => 'Traefik dynamic config path',
    'traefik_path_hint' => 'Directory on the traffic host that routes get written into.',

    'monitoring_title' => 'Monitoring',
    'monitoring_body' => 'The API token and where the Kuma bridge is reachable.',
    'monitoring_url' => 'Monitoring bridge URL',
    'monitoring_url_hint' => 'For example http://kuma-bridge:8080. Leave blank to leave monitoring off.',

    'vpn_title' => 'VPN/WireGuard',
    'vpn_body' => 'How a new host reaches CluPilot as the VPN hub. The private hub key stays in the server file — only the public half and the address live here.',
    'wg_endpoint' => 'Hub endpoint',
    'wg_endpoint_hint' => 'Publicly reachable address and port, e.g. vpn.clupilot.com:51820.',
    'wg_hub_pubkey' => 'Hub public key',
    'wg_hub_pubkey_hint' => 'Output of wg pubkey < /etc/wireguard/privatekey on this server.',

    'ssh_title' => 'SSH identity',
    'ssh_body' => 'The key deployed to every fresh host — its public and private halves, together in one place.',
    'ssh_public_key' => 'SSH key (public)',
    'ssh_public_key_hint' => 'Written into authorized_keys during host onboarding.',

    'save_settings' => 'Save settings',
    'settings_saved' => 'Saved. The new value applies immediately.',
];