{{ __('integrations.title') }}

{{ __('integrations.subtitle') }}

@if ($canSecrets && ! $usable) {{ __('secrets.no_key') }} @endif {{-- The one lock for everything write-only on this page: every vault entry below, and the .env editor further down. Plain settings never sit behind this — they were never gated by a password before, and nothing about merging the pages makes them more dangerous. --}} @if ($canSecrets && ! $unlocked)

{{ __('secrets.locked_title') }}

{{ __('secrets.locked_body') }}

{{ __('secrets.unlock') }}
@elseif ($canSecrets)

{{ __('secrets.unlocked_note') }}

@endif {{-- Zahlungen (Stripe) — vault only, no plain setting belongs here. --}} @if ($canSecrets)

{{ __('integrations.payments_title') }}

{{ __('integrations.payments_body') }}

@if ($unlocked) {{ __('secrets.webhook_secret_note') }} @endif
@endif {{-- DNS (Hetzner) — token and the zone/Traefik settings that use it. --}} @if ($canSecrets || $canInfra)

{{ __('integrations.dns_title') }}

{{ __('integrations.dns_body') }}

@if ($canInfra)
@endif @if ($canSecrets) @if ($canInfra)
@endif @endif
@endif {{-- Monitoring — token and where the Kuma bridge is reachable. --}} @if ($canSecrets || $canInfra)

{{ __('integrations.monitoring_title') }}

{{ __('integrations.monitoring_body') }}

@if ($canInfra) @endif @if ($canSecrets) @if ($canInfra)
@endif @endif
@endif {{-- VPN/WireGuard — no vault entry: the private hub key stays in .env. --}} @if ($canInfra)

{{ __('integrations.vpn_title') }}

{{ __('integrations.vpn_body') }}

@endif {{-- SSH-Identität — public half a setting, private half the vault entry. --}} @if ($canSecrets || $canInfra)

{{ __('integrations.ssh_title') }}

{{ __('integrations.ssh_body') }}

@if ($canInfra)

{{ __('integrations.ssh_public_key_hint') }}

@error('sshPublicKey')

{{ $message }}

@enderror
@endif @if ($canSecrets) @if ($canInfra)
@endif @endif
@endif @if ($canInfra)
{{ __('integrations.save_settings') }}
@endif @if ($canSecrets && $unlocked && $check !== null)

{{ __('secrets.check_title') }}

@if (! $check['ok']) {{ __('secrets.check_'.$check['reason']) }} @else
{{ __('secrets.check_account') }}:
{{ $check['account'] }}{{ $check['business'] ? ' · '.$check['business'] : '' }}
{{ __('secrets.check_mode') }}:
{{ $check['live'] ? __('secrets.mode_live') : __('secrets.mode_test') }}{{ $check['restricted'] ? ' · '.__('secrets.mode_restricted') : '' }}

{{ __('secrets.check_webhooks') }}

@if ($check['webhooks'] === null)

{{ __('secrets.check_webhooks_unknown') }}

@elseif ($check['webhooks'] === []) {{ __('secrets.check_webhooks_none') }} @else @endif @endif
@endif {{-- Part B: the raw .env editor. Everything above has a field; everything that does not still needs to be reachable from the console, or an operator needing it needs a shell and this whole page misses the point. Shares the lock above: secrets.manage AND a confirmed password, because it is the one place on this page that can reach every credential the vault otherwise keeps write-only. --}} @if ($canSecrets)

{{ __('integrations.env_title') }}

{{ __('integrations.env_subtitle') }}

@if (! $unlocked)

{{ __('integrations.env_locked') }}

@else

{{ __('integrations.env_danger_title') }}

{{ __('integrations.env_danger_body') }}

{{ __('integrations.env_vault_title') }}

{{ __('integrations.env_vault_body') }}

    @foreach ($entries as $entry)
  • {{ $entry['envKey'] }} {{ $entry['source'] === 'stored' ? __('integrations.env_vault_active') : __('integrations.env_vault_inactive') }}
    • @endforeach
@error('envContent')

{{ $message }}

@enderror
{{ __('integrations.env_save') }}

{{ __('integrations.env_backup_title') }}

{{ __('integrations.env_backup_body') }}

{{ __('integrations.env_restart_title') }}

{{ __('integrations.env_restart_body') }}

docker compose restart queue queue-provisioning scheduler reverb

{{ __('integrations.env_config_clear') }}

@endif
@endif