{{-- Header --}}

{{ __('system.eyebrow') }}

{{ __('system.heading') }}

{{ __('system.subheading') }}

$hasTls, 'border-warning/30 bg-warning/10 text-warning' => ! $hasTls, ])> {{ $hasTls ? __('system.https_active') : __('system.https_plain') }}
{{-- ── Critical alerts (full-width, above the grid) ───────────────────────── Restart-required and bare-IP notices stay prominent banners — never buried in a sidebar. --}} {{-- Restart-required notice (shown after a successful save). One-click: the button writes a sentinel a HOST-side watcher reacts to and restarts the stack — the container never gets the Docker socket. No terminal needed. --}} @if ($restartPending)

{{ __('system.restart_title') }}

{{ __('system.restart_body') }}

@if ($restartRequested)

{{ __('system.restart_running') }}

@else {{ __('system.restart_now') }} @endif

{{ __('system.restart_watcher_hint') }}

{{ __('system.restart_lockout_hint') }}

@endif {{-- Bare-IP warning: no domain set → plaintext HTTP. Full-width call to action. --}} @unless ($hasTls)

{{ __('system.tls_bare_title') }}

{{ __('system.tls_bare_body') }}

@endunless {{-- ── 2-column working area ──────────────────────────────────────────────── LEFT (main): the actionable form — domain + Speichern, TLS-mode selector. RIGHT (side): the status & recovery stack — access address, TLS state, SSH reset. --}}
{{-- LEFT / main column — "DO" ────────────────────────────────────────── --}}
{{-- Editable panel domain. Saving persists it and asks for a restart; on restart app URL, the Reverb endpoint, Caddy's cert and the secure cookie re-derive from it. --}}

{{ __('system.section_config') }}

{{ __('common.save') }}
@error('domainInput')

{{ $message }}

@enderror

{{ __('system.domain_help') }}

{{-- TLS-mode selector --}}

{{ __('system.tls_mode_title') }}

{{-- Segmented control (mirrors the channel selector) --}}
{{-- Per-mode description --}}

@if ($tlsMode === 'caddy') {{ __('system.tls_mode_caddy_desc') }} @else {{ __('system.tls_mode_external_desc') }} @endif

{{-- External-proxy hint (warning tone) --}} @if ($tlsMode === 'external')

{{ __('system.tls_external_hint') }}

@endif
{{-- RIGHT / side column — "KNOW / RECOVER" ──────────────────────────── --}}
{{-- Current access address (read-only status) --}}

{{ __('system.access_address') }}

@if ($panelUrl) {{ $panelUrl }} @else {{ __('system.access_bare_ip') }} @endif

{{-- Current TLS state --}} @if ($hasTls)

{{ $tlsMode === 'external' ? __('system.tls_active_external_title') : __('system.tls_active_title') }}

{{ __('system.tls_active_body_pre') }} {{ $panelUrl }} · {{ $tlsMode === 'external' ? __('system.tls_active_external_post') : __('system.tls_active_body_post') }}

@else

{{ __('system.tls_bare_title') }}

{{ __('system.tls_bare_body') }}

@endif {{-- TLS certificate: explicit DNS check + on-demand issuance trigger + status. Only in Caddy mode with an active domain; the external proxy owns TLS otherwise. --}} @if ($showCert) @php $certState = $certStatus['status'] ?? null; @endphp

{{ __('system.cert_title') }}

@switch($certState) @case('issued') {{ __('system.cert_status_issued') }} @break @case('dns_mismatch') {{ __('system.cert_status_dns_mismatch') }} @break @case('failed') {{ __('system.cert_status_failed') }} @break @default {{ __('system.cert_status_unknown') }} @endswitch

{{ __('system.cert_button') }}
@elseif ($tlsMode === 'external')

{{ __('system.cert_title') }}

{{ __('system.cert_external_note') }}

@endif {{-- Last-resort recovery: SSH into the host and reset admin access. --}}

{{ __('system.ssh_reset_hint') }}
{{-- ── Release-Kanal (full-width band, below the grid) ──────────────────── --}}
{{-- Segmented control --}}
@foreach ($channels as $key => $desc) @endforeach
{{-- Per-channel description --}}

{{ __('system.channel_current') }} {{ $channel }}

{{ $channels[$channel] ?? '' }}