<?php

// Modal dialogs (wire-elements/modal). English translation of lang/de/modals.php.
// Same keys in both files (R16). Shared strings come from common.*.
return [
    // ── Add SSH key ───────────────────────────────────────────────────────
    'add_ssh_key' => [
        'title' => 'Add SSH key',
        'name_label' => 'Name (optional)',
        'name_placeholder' => 'e.g. Backup laptop · Admin notebook',
        'subtitle_before' => 'Paste a public key — it is appended to',
        'subtitle_after' => '.',
        'public_key_label' => 'Public key',
        'generate' => 'Generate new pair',
        'generating' => 'generating…',
        'public_key_placeholder' => 'ssh-ed25519 AAAA… comment — or generate above',
        'private_key_warning' => 'Private key — shown only now, store it securely.',
        'notify_added' => 'SSH key added.',
    ],

    // ── Create server ─────────────────────────────────────────────────────
    'create_server' => [
        'title' => 'Add server',
        'subtitle' => 'Add a new host to the fleet and store its SSH access in the encrypted vault.',
        'name_label' => 'Name',
        'name_placeholder' => 'e.g. Prod-Web-01',
        'ip_host_label' => 'IP/Host',
        'ip_host_placeholder' => '203.0.113.10 or host.example.com',
        'ssh_port_label' => 'SSH port',
        'user_label' => 'User',
        'auth_label' => 'Authentication',
        'auth_password' => 'Password',
        'auth_key' => 'Private key',
        'secret_key_label' => 'Private key (PEM)',
        'secret_password_label' => 'Password',
        'key_placeholder' => '-----BEGIN OPENSSH PRIVATE KEY-----',
        'passphrase_label' => 'Passphrase (optional)',
        'passphrase_placeholder' => 'empty = none',
        'credential_name_label' => 'Access name (optional)',
        'credential_name_placeholder' => 'e.g. Root login · Deploy user',
        'validation_ip_or_host' => 'Please enter a valid IP address or hostname.',
        'validation_ssh_failed' => 'SSH connection failed: :error. Please check the credentials.',
        'attr_name' => 'Name',
        'attr_ip' => 'IP/Host',
        'attr_ssh_port' => 'SSH port',
        'attr_user' => 'User',
        'attr_auth' => 'Authentication',
        'attr_secret_key' => 'Private key',
        'attr_secret_password' => 'Password',
        'attr_credential_name' => 'Access name',
        'notify_added' => 'Server added.',
    ],

    // ── Edit credential ───────────────────────────────────────────────────
    'edit_credential' => [
        'title' => 'SSH access',
        'subtitle_before' => 'Store the access here — e.g.',
        'subtitle_after' => 'for full control (systemctl, journal).',
        'name_label' => 'Name (optional)',
        'name_placeholder' => 'e.g. Prod-Server X · Backup user',
        'user_label' => 'User',
        'auth_label' => 'Authentication',
        'auth_password' => 'Password',
        'auth_key' => 'Private key',
        'secret_key_label' => 'Private key (PEM)',
        'secret_password_label' => 'Password',
        'key_placeholder' => '-----BEGIN OPENSSH PRIVATE KEY-----',
        'passphrase_label' => 'Passphrase (optional)',
        'passphrase_placeholder' => 'empty = none',
        'error_required' => 'User and password/key are required.',
        'error_name_too_long' => 'Name may be at most 120 characters long.',
        'notify_saved' => 'Credentials saved.',
    ],

    // ── fail2ban: ban IP ──────────────────────────────────────────────────
    'fail2ban_ban' => [
        'title' => 'Ban IP manually',
        'subtitle' => 'Bans an IP address immediately in the selected jail. Loopback and the Clusev access cannot be banned.',
        'jail_label' => 'Jail',
        'ip_label' => 'IP address',
        'ip_placeholder' => 'e.g. 203.0.113.10',
        'submit' => 'Ban IP',
        'error_ban_failed' => 'Ban failed.',
        'notify_banned' => 'IP :ip banned.',
    ],

    // ── fail2ban: config ──────────────────────────────────────────────────
    'fail2ban_config' => [
        'title' => 'Configure fail2ban',
        'subtitle' => 'Defines when fail2ban bans an IP on :server and for how long. Repeated failed logins within the time window lead to a ban.',
        'this_server' => 'this server',
        'bantime_label' => 'Ban duration',
        'bantime_placeholder' => 'e.g. 600, 10m, 1h, -1 = permanent',
        'maxretry_label' => 'Max. retries',
        'findtime_label' => 'Time window',
        'findtime_placeholder' => 'e.g. 600, 10m, 1h',
        'error_read_locked' => 'Current configuration could not be read — saving is blocked.',
        'error_bantime_invalid' => 'Invalid duration (e.g. 600, 10m, 1h, -1 for permanent).',
        'error_findtime_invalid' => 'Invalid duration (e.g. 600, 10m, 1h).',
        'error_save_failed' => 'Save failed. :output',
        'attr_bantime' => 'Ban duration',
        'attr_maxretry' => 'Max. retries',
        'attr_findtime' => 'Time window',
        'notify_saved' => 'fail2ban configured.',
    ],

    // ── File editor ───────────────────────────────────────────────────────
    'file_editor' => [
        'too_big' => 'File too large to edit (over 256 KB) — please download it.',
        'image_too_big' => 'Image too large to preview (over 5 MB) — please download it.',
        'image_read_failed' => 'Image could not be read.',
        'binary' => 'Binary file — cannot be shown in the editor.',
        'notify_saved' => '“:name” saved.',
    ],

    // ── Firewall rule ─────────────────────────────────────────────────────
    'firewall_rule' => [
        'title' => 'Add firewall rule',
        'subtitle_firewalld' => 'Opens a port in firewalld’s default zone.',
        'subtitle_ufw' => 'New UFW rule. Leave source empty = from anywhere.',
        'action_label' => 'Action',
        'action_allow' => 'Allow (allow)',
        'action_deny' => 'Drop (deny)',
        'action_reject' => 'Reject (reject)',
        'action_limit' => 'Limit (limit)',
        'port_label' => 'Port',
        'port_optional' => '(optional)',
        'port_placeholder' => 'e.g. 8080',
        'proto_label' => 'Protocol',
        'proto_both' => 'Both',
        'source_label' => 'Source (optional)',
        'source_placeholder' => 'IP or CIDR, e.g. 10.0.0.0/8',
        'error_add_failed' => 'Rule could not be added.',
        'summary_port_opened' => 'Port :port/:proto opened',
        'summary_from' => 'from :source',
        'notify_added' => 'Firewall rule added.',
    ],

    // ── Hardening action ──────────────────────────────────────────────────
    'hardening_action' => [
        'title_fallback' => 'Apply hardening',
        'result_ok' => 'Applied successfully.',
        'result_failed' => 'Failed.',
        'error_unknown' => 'Unknown error.',
        'audit_failed_suffix' => '(failed)',
        'notify_applied' => ':action applied.',
        'notify_failed' => ':action failed.',
    ],

    // ── System update ─────────────────────────────────────────────────────
    'system_update' => [
        'title' => 'System updates',
        'subtitle' => 'Updates the installed packages on :server via the package manager. No new version jumps are forced — only available updates are applied.',
        'this_server' => 'this server',
        'unsupported_fallback' => 'Not available on this system.',
        'count_unknown' => 'Update count unknown',
        'count_one' => '1 package update available',
        'count_many' => ':count package updates available',
        'hint_unknown' => 'Could not be determined — updating is still possible.',
        'hint_recommended' => 'Updating recommended.',
        'hint_up_to_date' => 'The system is up to date.',
        'result_ok' => 'System updated.',
        'result_failed' => 'Update failed.',
        'submit' => 'Update now',
        'audit_failed_suffix' => '(failed)',
        'notify_updated' => 'System updated.',
        'notify_failed' => 'Update failed.',
    ],

    // ── SSH key provision ─────────────────────────────────────────────────
    'ssh_key_provision' => [
        'title' => 'Create SSH key & disable password login',
        'subtitle' => 'An SSH key will be generated and installed on :server; password login is disabled only afterwards.',
        'steps_title' => 'Process',
        'step_generate' => 'Generate key and store it on the server.',
        'step_verify' => 'Verify key login — password login stays active until then.',
        'step_disable' => 'Only after successful verification: disable password login.',
        'safety_note' => 'If verification fails, password login remains active — no lockout.',
        'confirm' => 'Create & disable',
        'running' => 'Running…',
        'result_ok' => 'Password login disabled — access via key only.',
        'key_warning' => 'Save this private key now — it is shown only once.',
        'download' => 'Download key',
        'done' => 'Done',
        'notify_ok' => 'SSH key set up, password login disabled (:server).',
        'notify_failed' => 'SSH key setup failed.',
        'error_unknown' => 'Unknown error.',
    ],

    // ── Generic confirm dialog defaults (ConfirmAction) ───────────────────
    'confirm_action' => [
        'default_heading' => 'Confirm action',
        'default_notify' => 'Action completed.',
        'rejected' => 'Confirmation invalid or expired.',
    ],
];