<?php

return [
    'title' => 'Infrastructure',
    'subtitle' => 'Deployment settings — visible and changeable here, without server access. The matching credentials live under Credentials.',

    'dns_title' => 'DNS & Traefik',
    'dns_body' => 'The zone customer instances and hosts live under, and where Traefik expects its dynamic configuration.',
    'dns_zone' => 'DNS zone',
    'dns_zone_hint' => 'For example clupilot.com — customer instances get <subdomain>.<zone>.',
    'traefik_path' => 'Traefik dynamic config path',
    'traefik_path_hint' => 'Directory on the traffic host that routes get written into.',

    'wg_title' => 'WireGuard hub',
    'wg_body' => 'How a new host reaches CluPilot as the VPN hub. The private hub key stays in the server file — only the public half and the address live here.',
    'wg_endpoint' => 'Hub endpoint',
    'wg_endpoint_hint' => 'Publicly reachable address and port, e.g. vpn.clupilot.com:51820.',
    'wg_hub_pubkey' => 'Hub public key',
    'wg_hub_pubkey_hint' => 'Output of wg pubkey < /etc/wireguard/privatekey on this server.',

    'ssh_title' => 'SSH identity',
    'ssh_body' => 'The public half of the key deployed to every fresh host. The private half is secret and lives under Credentials.',
    'ssh_public_key' => 'SSH key (public)',
    'ssh_public_key_hint' => 'Written into authorized_keys during host onboarding.',

    'monitoring_title' => 'Monitoring',
    'monitoring_body' => 'Where the Kuma bridge is reachable. Kuma itself (KUMA_URL/KUMA_USERNAME/KUMA_PASSWORD/KUMA_TOTP) stays in the server file — that is the bridge, a separate container that reads them at startup, not this application.',
    'monitoring_url' => 'Monitoring bridge URL',
    'monitoring_url_hint' => 'For example http://kuma-bridge:8080. Leave blank to leave monitoring off.',

    'save' => 'Save',
    'saved' => 'Saved. The new value applies immediately.',
];