<?php

// System settings (Domain/TLS + release channel) page strings (R16). Shared buttons live in common.php.
return [
    // Header
    'eyebrow' => 'System',
    'heading' => 'Domain, TLS & release channel',
    'subheading' => 'Panel access address and update source',
    'https_active' => 'HTTPS active',
    'https_plain' => 'Plaintext HTTP',

    // Section labels (redesigned 2-column layout)
    'section_config' => 'Configuration',
    'section_status' => 'Status & recovery',

    // Domain & TLS panel
    'tls_title' => 'Domain & TLS',
    'tls_subtitle' => 'Panel reachability and Let\'s Encrypt certificate',
    'tls_active_title' => 'TLS active — certificate issued automatically via Let\'s Encrypt',
    'tls_active_body_pre' => 'Reachable at',
    'tls_active_body_post' => 'issued and renewed automatically. Requirement: the domain points to this server via DNS.',
    'tls_bare_title' => 'Bare-IP mode: plaintext HTTP',
    'tls_bare_body' => 'Without a domain the panel — including 2FA and audit — runs over unencrypted HTTP. Enter a domain and TLS is then set up automatically, with no further steps.',

    // Domain form + status
    'domain' => 'Domain',
    'domain_placeholder' => 'panel.example.com',
    'domain_help' => 'The domain must point to this server via DNS. After saving, restart the stack — the TLS certificate, URL, WebSocket and cookie security set themselves up automatically. Leave empty for access via IP over HTTP.',
    'domain_invalid' => 'Please enter a valid domain (e.g. panel.example.com) — without http://, port or path.',
    'access_address' => 'Access address',
    'access_bare_ip' => 'HTTP (bare IP)',
    'ssh_reset_hint' => 'Fully locked out? SSH into the host and run `clusev:reset-admin` to reset dashboard access.',

    // Change-domain confirmation modal
    'change_domain_heading' => 'Change domain',
    'change_domain_body' => 'The panel domain will be set to “:domain”. After a stack restart the panel is reachable at https://:domain; the certificate is issued automatically. Requirement: DNS already points to this server.',
    'clear_domain_body' => 'The domain will be removed. After a restart the panel is reachable via IP over unencrypted HTTP (no TLS). You can set a domain again at any time.',
    'change_domain_confirm' => 'Change',
    'domain_saved_notify' => 'Domain saved — restart the stack to apply it.',

    // Restart-required notice
    'restart_title' => 'Restart required',
    'restart_body' => 'The change is saved. Restart the stack to apply it.',
    'restart_now' => 'Restart now',
    'restart_running' => 'Restart is running …',
    'restart_watcher_hint' => 'If nothing happens after ~30 s, the host watcher may not be installed — see the docs (docker/restart-sentinel).',
    'restart_lockout_hint' => 'You may need to sign in again after the restart. If the new domain (DNS/certificate) is not reachable yet, the panel stays available at http://<server-IP> as a fallback.',

    // Release channel panel
    'channel_title' => 'Release channel',
    'channel_subtitle' => 'Source for updates',
    'channel_radiogroup_label' => 'Release channel',
    'channel_current' => 'Channel:',

    // Channel descriptions (CHANNELS array)
    'channel_stable' => 'Only tested releases approved by the maintainer (tagged versions). Recommended for production use.',
    'channel_beta' => 'Pre-releases of upcoming versions for testing new features. May be unstable. Development builds are never offered to users.',

    // Change-channel confirmation modal
    'change_channel_heading' => 'Switch release channel',
    'change_channel_body' => 'The release channel will be set to “:channel”. Updates will then be pulled from this source.',
    'change_channel_confirm' => 'Switch',
    'change_channel_notify' => 'Release channel set to “:channel”.',

    // TLS-mode selector
    'tls_mode_title' => 'TLS termination',
    'tls_mode_caddy' => 'Built-in TLS',
    'tls_mode_caddy_desc' => 'The panel fetches its own certificate for the domain.',
    'tls_mode_external' => 'External reverse proxy',
    'tls_mode_external_desc' => 'A proxy in front (e.g. Zoraxy) terminates TLS; the panel serves HTTP.',
    'tls_external_hint' => 'External proxy: set TRUSTED_PROXY_CIDR to your proxy\'s address and firewall the HTTP port so it is only reachable from the upstream proxy. The panel will not fetch a certificate.',
    'change_tls_heading' => 'Change TLS mode',
    'change_tls_body_external' => 'Switch to "External reverse proxy"? The panel will no longer fetch a certificate; TLS must be provided by the proxy in front. Takes effect after a stack restart.',
    'change_tls_body_caddy' => 'Switch to "Built-in TLS (Let\'s Encrypt)"? The panel will fetch its own certificate again. Takes effect after a stack restart.',
    'change_tls_confirm' => 'Switch',
    'tls_saved_notify' => 'TLS mode saved — restart the stack to apply.',

    // TLS certificate (manually trigger on-demand issuance)
    'cert_title' => 'TLS certificate',
    'cert_button' => 'Check DNS & request certificate',
    'cert_status_issued' => 'Certificate active — valid and trusted.',
    'cert_status_dns_mismatch' => 'DNS does not point here (yet) — certificate pending.',
    'cert_status_failed' => 'Issuance failed — are ports 80 and 443 reachable from the internet?',
    'cert_status_unknown' => 'Not checked yet. Once the domain points here via DNS, click “request”.',
    'cert_external_note' => 'TLS is handled by the external reverse proxy — the panel issues no certificate.',
    'cert_issued' => 'Certificate issued for :domain.',
    'cert_dns_mismatch' => 'DNS points to :resolved instead of this server (:server) — no certificate requested.',
    'cert_failed' => 'Could not issue the certificate — are ports 80/443 reachable from the internet? Try again later.',
    'cert_not_applicable' => 'Certificate request not available here (bare IP or external proxy).',
    'cert_throttled' => 'Too many requests — try again in :seconds seconds.',

    // Page title
    'title' => 'System — Clusev',
];