{
  "profiles": {
    "web": {
      "label": "Web host",
      "short": "SSH · 80 · 443"
    },
    "mail": {
      "label": "Web + mail",
      "short": "Also 25/465/587/993"
    },
    "ftps": {
      "label": "Web + FTPS",
      "short": "21 + PASV 30000–30100"
    }
  },
  "appliedProfile": "Applied profile: {{label}}",
  "backToProtection": "Protection",
  "statRules": "Rules",
  "statDenyIps": "Permanent deny IPs",
  "statAllow": "Allow",
  "statDeny": "Deny",
  "statDefaultIn": "Default incoming",
  "defaultNotApplied": "n/a (UFW off)",
  "ufwOffHint": "Default incoming is not applied while UFW is off",
  "executeOn": "On",
  "executeOff": "Off",
  "ufwDisabled": "UFW disabled",
  "ufwEnabled": "UFW enabled",
  "disableUfw": "Disable UFW",
  "enableUfw": "Enable UFW",
  "notInstalled": "UFW is not installed",
  "toolHintPrefix": "Underlying tools:",
  "toolHintBody": "UFW = ports / permanent rules · for attack response and auto-ban use",
  "toolHintfail2ban": "fail2ban = temporary log-based bans",
  "toolHintFail2ban": "fail2ban = temporary log-based bans",
  "executeOffHint": "System changes off — status is readable;",
  "tabs": {
    "rules": "Rules",
    "ports": "Open ports",
    "deny": "Permanent deny IP",
    "profiles": "Profiles",
    "about": "About",
    "services": "Services"
  },
  "currentRules": "Current rules",
  "rulesSourceHint": "UFW numbered rules (ufw status numbered)",
  "colAction": "Action",
  "colTo": "To",
  "colFrom": "From",
  "deleteShort": "Delete",
  "denyBadge": "DENY",
  "emptyRulesTitle": "No rules or no permission to read",
  "emptyRulesInstalled": "UFW inactive or needs root to read",
  "emptyRulesNotInstalled": "Install UFW then refresh",
  "allowPortTitle": "Allow port",
  "protocol": "Protocol",
  "protoBoth": "Both",
  "protoBothLabel": "TCP+UDP",
  "port": "Port",
  "portHint": "Pick a common port, or custom below",
  "portHintYsk": "All YSK service ports (Panel, Web, SSH, mail, FTP, DNS, DB, Redis);",
  "privatePortWarn": "{{service}} should usually stay private; public allow is risky. Prefer a source IP/CIDR.",
  "privatePortWarnWithFrom": "{{service}} will only allow the given source; double-check the IP/CIDR.",
  "allowFrom": "Source IP/CIDR (optional)",
  "allowFromHint": "Empty = anywhere; set an IP or CIDR to allow only that source on this port",
  "allowFromPlaceholder": "e.g. 203.0.113.10 or 10.0.0.0/8",
  "customPort": "Custom port (e.g. 8080 or 30000:30100)",
  "allowedPort": "Allowed {{proto}}/{{port}}",
  "allowedPortFrom": "Allowed {{proto}}/{{port}} from {{from}}",
  "allowThisPort": "Allow this port",
  "allowPortHint": "Keep 22/80/443 for a web host;",
  "denyTitle": "Permanent deny IP",
  "denySub": "UFW DENY · different from temporary fail2ban bans",
  "denyPlaceholder": "IPv4 or IPv6 to deny",
  "deniedOk": "Permanently denied",
  "removedDeny": "DENY removed",
  "remove": "Remove",
  "noDenyRules": "No permanent deny IP rules",
  "oneClickProfiles": "One-click profiles",
  "oneClickDesc": "Write panel script and apply UFW (does not install fail2ban — use the fail2ban page)",
  "customApply": "Custom apply",
  "allowSmtp": "Allow SMTP/IMAP ports",
  "extraTcp": "Extra TCP ports",
  "extraTcpHint": "Pick a preset; or custom comma/ranges",
  "noExtra": "None extra",
  "mailGroup": "Mail set",
  "customExtraPlaceholder": "Custom: 8080,9000:9010",
  "appliedCustom": "Custom rules applied",
  "applyToSystem": "Apply to system",
  "deletedRule": "Deleted #{{n}}",
  "deleteRuleTitle": "Delete rule #{{n}}?",
  "deleteRuleDesc": "Removes that UFW rule number (needs system-change permission).",
  "servicesTitle": "Managed services",
  "servicesHint": "Desired network exposure for YSK services. Opening a service syncs these rules automatically.",
  "servicesUfwOff": "UFW is off. This list is the desired exposure, not rules the host is enforcing.",
  "servicesEmpty": "No service exposure data yet",
  "servicesEmptyDesc": "Start a managed service (web, FTPS, VPN, DB…) to populate this list.",
  "servicesManualHint": "Manual port chips are under the Ports tab — prefer managing access here so rules stay tagged (ysk-svc).",
  "portsManualHint": "Advanced manual rules. Prefer the Services tab for managed software.",
  "colService": "Service",
  "colMode": "Mode",
  "colPorts": "Ports",
  "colSync": "Status",
  "synced": "Synced",
  "syncNow": "Sync",
  "disableConfirmTitle": "Disable UFW?",
  "disableConfirmDesc": "The host firewall will stop filtering traffic. SSH and the panel can be exposed if the host is on a public network.",
  "disableConfirmConsequence": "Existing allow/deny rules stay stored but are not enforced until UFW is enabled again.",
  "desiredOnlyUfwOff": "Desired: {{mode}} · UFW off (not applied)",
  "syncNotApplied": "UFW off · not applied"
}