<?php

return [
    'title' => 'WireGuard — Clusev',
    'eyebrow' => 'Network',
    'heading' => 'WireGuard',
    'subtitle' => 'Tunnel access to the panel — live status.',
    'stale' => 'Status is stale — the host collector is not responding. Is the stack running?',
    'gate' => 'Gate (panel lock)',
    'gate_on' => 'on — panel only via the tunnel',
    'gate_off' => 'off — panel publicly reachable',
    'gate_escape' => 'Escape over SSH: "clusev wg down".',
    'server_title' => 'Server',
    'subnet' => 'Subnet',
    'server_ip' => 'Server IP',
    'port' => 'Port',
    'endpoint' => 'Endpoint',
    'service' => 'Service',
    'peers_title' => 'Peers',
    'peers_count' => ':count peer|:count peers',
    'no_peers' => 'No peers yet — over SSH run "clusev wg add-peer <name>".',
    'online' => 'online',
    'offline' => 'offline',
    'last_handshake' => 'last handshake',
    'never' => 'never',
    'down_up' => '↓ :rx · ↑ :tx',
    'traffic_title' => 'Traffic',
    'window_1h' => '1h',
    'window_24h' => '24h',
    'window_7d' => '7d',
    'total_down' => 'Received',
    'total_up' => 'Sent',
    'no_traffic' => 'No history yet — it accrues once peers are connected.',
    'add_peer' => 'Add peer',
    'peer_name_placeholder' => 'Name (e.g. laptop)',
    'peer_name_invalid' => 'Only A–Z a–z 0–9 . _ - (max 64).',
    'remove' => 'Remove',
    'remove_confirm_title' => 'Remove peer?',
    'remove_confirm_body' => 'The client loses access immediately. This cannot be undone.',
    'pending' => 'Applying …',
    'action_done' => 'Action applied.',
    'action_failed' => 'Action failed — check on the host.',
    'throttled' => 'Too many actions — wait a moment.',
    'new_peer_title' => 'New peer — configuration',
    'new_peer_once' => 'This configuration is shown ONCE and never stored. Import it now (scan the QR or copy the text).',
    'close' => 'Close',
    'download' => 'Download',
    'import_hint' => 'Scan the QR code with the WireGuard app (phone) or download the configuration and import it (PC).',
    'settings_title' => 'Settings',
    'apply' => 'Apply',
    'gate_toggle' => 'Gate',
    'gate_turn_on' => 'Turn on',
    'gate_turn_off' => 'Turn off',
    'gate_on_title' => 'Turn gate on?',
    'gate_on_body' => 'The panel will then only be reachable through the tunnel. Make sure the tunnel reaches the panel first — otherwise only SSH ("clusev wg down") gets you back.',
    'gate_off_title' => 'Turn gate off?',
    'gate_off_body' => 'The panel becomes publicly reachable again (only 2FA + login protection then guard it).',
    'ssh_lock' => 'SSH lock (port 22)',
    'ssh_lock_on_state' => 'on — SSH only through the tunnel',
    'ssh_lock_off_state' => 'off — SSH reachable normally',
    'ssh_lock_turn_on' => 'Lock SSH',
    'ssh_lock_turn_off' => 'Unlock',
    'ssh_lock_hint' => 'Also locks SSH (port 22) to the tunnel. WARNING: if you lose your WG access you can NO LONGER reach the host over SSH — only through the server console ("clusev wg down"). Create a second WG peer as a backup first. You can still reach the dashboard through the tunnel without SSH.',
    'ssh_lock_on_title' => 'Really lock SSH?',
    'ssh_lock_on_body' => 'Port 22 will then only be reachable through the tunnel. If you lose your WG access you lock yourself out of SSH — recovery only via the server console. Recommended: create a second WG peer as a backup first. Existing SSH sessions stay connected.',
    'ssh_lock_off_title' => 'Unlock SSH?',
    'ssh_lock_off_body' => 'Port 22 becomes reachable normally again (subject to any cloud/host firewall).',
    'endpoint_label' => 'Public endpoint',
    'endpoint_hint' => 'IP or DNS:port — affects only future peer configs.',
    'endpoint_invalid' => 'Invalid endpoint.',
    'port_label' => 'Listen port (UDP)',
    'port_hint' => 'Changing this restarts the tunnel — all clients must update the port.',
    'port_invalid' => 'Port 1–65535.',
    'port_confirm_title' => 'Change port?',
    'port_confirm_body' => 'The tunnel restarts. All clients must set the new port in their config or they lose the connection.',
    'subnet_label' => 'Subnet',
    'subnet_hint' => 'Highly destructive — re-addresses the server; existing peers must be re-created.',
    'subnet_invalid' => 'Invalid subnet (CIDR).',
    'subnet_confirm_title' => 'Change subnet?',
    'subnet_confirm_body' => 'The server gets a new address and the tunnel restarts. ALL existing peers lose access and must be re-created.',
    'setup_title' => 'Set up WireGuard',
    'setup_intro' => 'Set the tunnel up right here. The gate stays OFF afterwards — the panel remains public until you turn it on.',
    'setup_subnet' => 'Subnet',
    'setup_port' => 'Listen port (UDP)',
    'setup_endpoint' => 'Public endpoint (optional)',
    'setup_endpoint_hint' => 'Empty = auto-detected public IP. Format host:port (e.g. 10.10.90.165:51820) — if the port is missing the listen port is appended.',
    'setup_peer' => 'First client name',
    'setup_submit' => 'Set up',
    'no_host_response' => 'No response from the host — the WireGuard host service is not running. Update the stack (Versions page) and try again.',
];