{
  "title": "Network access",
  "manage": "Manage access",
  "manageTitle": "Service network access",
  "manageDesc": "Control how {{service}} is reachable on the host firewall.",
  "mode": "Access mode",
  "modePrivate": "Local only",
  "modePublic": "Public",
  "modeRestricted": "Restricted",
  "modeUndecided": "Not set",
  "modePublicLive": "Public (live bind)",
  "summaryPublicLive": "Listening on {{bind}} — reachable on all interfaces. Confirm access mode; this is not private.",
  "modeLoading": "Loading",
  "summaryPrivate": "Not open on the public firewall.",
  "summaryPublic": "Open · {{ports}}",
  "summaryUndecided": "Access mode not confirmed (catalog default: {{suggested}}).",
  "summaryNotEnforced": "Firewall is off — the panel is not opening or blocking these ports.",
  "roleSmtp": "SMTP submission",
  "roleImap": "IMAP / POP3 mailbox",
  "summaryRestricted": "Restricted · {{count}} source(s)",
  "summaryFirewallOff": "Host firewall: {{detail}} — rules not enforced until UFW is active.",
  "summaryFirewallOffOnly": "Host firewall is not enabled, so port rules are not enforced.",
  "outOfSync": "Out of sync",
  "openButStopped": "Ports open — service not running",
  "openNoTenants": "Public ports with no tenants",
  "firewallOff": "Firewall off",
  "ufwMissing": "UFW not installed",
  "ufwInactive": "inactive",
  "firewallLink": "Firewall",
  "portsLabel": "Ports",
  "allowFrom": "Allowed sources (IP / CIDR)",
  "allowCountries": "Allowed countries (ISO)",
  "hintPrivate": "Service may still listen on localhost; no public UFW allow rules.",
  "hintPublic": "Warning: opens this port to the whole Internet. Prefer restricted for databases.",
  "hintRestricted": "Comma-separated IPs or CIDRs. Only these sources may connect.",
  "hintCountries": "L2 best-effort via ipset + country zone CIDRs. Requires root, EXECUTE, and ipset. Cloud security groups are separate.",
  "restrictedNeedIp": "Add at least one IP or CIDR for restricted mode.",
  "restrictedNeedSource": "Add at least one IP/CIDR or country code for restricted mode.",
  "privateStartTitle": "Expose {{service}} on the network?",
  "confirmAndStart": "Confirm and start",
  "cloudSgNote": "Host firewall only — cloud security groups (AWS/GCP/Azure) are not changed.",
  "serviceNotInstalled": "This service is not installed, so firewall rules do not apply."
}