{
  "remoteAccess": {
    "pageTitle": "Remote access",
    "pageSubtitle": "Connect to this gateway from other devices. Pick one method — only one exposure mode should be active at a time.",
    "docsLink": "Read the remote access guide",
    "tabsAria": "Remote access methods",
    "tabs": {
      "guide": "Overview",
      "tailscale": "Tailscale",
      "public": "Public internet",
      "reverse-proxy": "Reverse proxy",
      "ssh": "SSH tunnel",
      "lan": "Local network"
    },
    "tabIntro": {
      "guide": "Compare options and see what's active on this gateway.",
      "tailscale": "Best for personal devices on your tailnet. Gateway stays on loopback; Tailscale Serve publishes HTTPS.",
      "public": "Create a Tunnel Registration Key in the Console and save it here, then start the tunnel for a public URL and pair your mobile app.",
      "reverse-proxy": "Front the gateway with your own HTTPS reverse proxy (Caddy / nginx / Cloudflare Tunnel) at a custom domain, then scan to pair your mobile app.",
      "ssh": "CLI SSH port forwarding when VPN or a public tunnel are unavailable.",
      "lan": "Reach the gateway on the same Wi‑Fi or LAN via its bind address, then scan to pair your mobile app."
    },
    "guide": {
      "pickMethod": "Choose a connection method",
      "recommended": "Recommended",
      "configure": "Configure",
      "statusActive": "Active",
      "statusOff": "Off",
      "statusConnecting": "Connecting",
      "tailscaleCardTitle": "Tailscale Serve",
      "tailscaleCardDesc": "HTTPS on your tailnet only. No public internet exposure.",
      "publicCardTitle": "Public tunnel",
      "publicCardDesc": "Share a public URL for mobile pairing and remote clients.",
      "reverseProxyCardTitle": "Reverse proxy",
      "reverseProxyCardDesc": "Use your own HTTPS reverse proxy at a custom domain.",
      "sshCardTitle": "SSH tunnel",
      "sshCardDesc": "CLI forwarding when VPN or public tunnel are unavailable.",
      "sshCardStatus": "CLI",
      "lanCardTitle": "Same Wi‑Fi / LAN",
      "lanCardDesc": "Use the gateway bind address on your local network.",
      "lanCardStatus": "Local",
      "conflictsTitle": "Configuration conflict",
      "conflictsHint": "Only one exposure method should be active. Disable the other before switching.",
      "oneAtATimeHint": "Tailscale Serve and the public tunnel cannot run together. Use Overview to check status before switching.",
      "needToken": "Sign in to the gateway (valid token) to manage remote access.",
      "docsLink": "Full guide in the docs"
    },
    "advanced": {
      "proxyTitle": "Reverse proxy & remote URL",
      "proxyBody": "When the gateway sits behind nginx, Caddy, or another proxy, configure trusted headers and optional gateway.remote for CLI clients.",
      "proxyDocs": "Read remote access docs"
    },
    "lan": {
      "title": "Same network (LAN)",
      "subtitle": "Reach the gateway from phones or laptops on the same Wi‑Fi without exposing it to the internet.",
      "body": "Set the gateway bind address to your LAN IP (or 0.0.0.0) and connect using http://<host>:<port>. Keep firewall rules in mind.",
      "link": "Open Gateway settings",
      "pairTitle": "Mobile app pairing",
      "pairSubtitle": "On the same Wi‑Fi, scan to connect your phone. The app exchanges a one-time pairing key for your gateway token.",
      "pairBlockedNextSteps": "Or use the Public internet tab to pair through a tunnel.",
      "pairPublicTabLink": "Open Public internet tab"
    },
    "tailscale": {
      "title": "Tailscale Serve (recommended)",
      "subtitle": "Expose the gateway on your tailnet over HTTPS while keeping the process bound to loopback.",
      "statusLabel": "Serve status",
      "stepInstallBefore": "Install ",
      "stepInstallLink": "Tailscale",
      "stepInstallAfter": " on this machine and sign in to your tailnet.",
      "stepEnable": "Enable Serve below to publish HTTPS on your tailnet hostname.",
      "stepCopy": "Open or copy the HTTPS URL on any device on the same tailnet.",
      "loading": "Loading Tailscale status…",
      "statusActive": "Tailscale Serve is active.",
      "statusOff": "Tailscale Serve is off.",
      "enableServe": "Enable Serve",
      "disableServe": "Disable Serve",
      "copyUrl": "Copy HTTPS URL",
      "copied": "Copied",
      "hint": "Requires Tailscale installed and logged in on this machine. API routes still require your gateway token.",
      "docsLink": "Tailscale Serve docs",
      "cliMissingIntro": "Tailscale CLI not found on this machine.",
      "cliMissingDownloadLink": "Download from tailscale.com/download",
      "cliMissingSuffix": " — install, sign in, then retry."
    },
    "ssh": {
      "title": "SSH tunnel (CLI)",
      "subtitle": "Forward the remote gateway loopback port to your laptop when Tailscale is unavailable.",
      "hint": "Replace user@your-host with your SSH login. Run on the machine where you want to use the gateway console.",
      "copy": "Copy command",
      "copied": "Copied"
    },
    "reverseProxy": {
      "title": "Reverse proxy (self-hosted HTTPS)",
      "subtitle": "Front the gateway with your own Caddy / nginx / Cloudflare Tunnel at a custom domain.",
      "urlLabel": "Public URL",
      "urlPlaceholder": "https://gateway.example.com",
      "urlHint": "No trailing path. https required for public hostnames; http is only allowed for RFC1918 / .local.",
      "probeButton": "Test",
      "probing": "Testing…",
      "autoDetectedTitle": "Detected from your current browser address",
      "autoDetectedHint": "The QR below already uses this URL. Click \"Save as default\" to persist it so other machines see the same URL.",
      "saveAsDefault": "Save as default",
      "saving": "Saving…",
      "clear": "Clear configured URL",
      "certWarning": "Mobile clients require a certificate trusted by the system root store (Let's Encrypt / Cloudflare / commercial CA). Self-signed certificates are not supported in v1.",
      "qrTitle": "Mobile pairing QR",
      "qrSubtitle": "Scan from the xopc mobile app to pair through your reverse proxy.",
      "noUrlYet": "Enter your reverse-proxy public URL above to generate the pairing QR.",
      "mintingSecret": "Minting pairing secret…",
      "encoding": "Encoding QR…",
      "refreshQr": "Refresh QR",
      "copyLink": "Copy deeplink",
      "copied": "Copied",
      "probeStatus": {
        "ok": "Reachable",
        "mobileReady": "mobile pairing ready",
        "codeUnknown": "Probe failed",
        "code_TIMEOUT": "Timed out reaching the URL",
        "code_TLS_INVALID": "TLS / certificate error",
        "code_DNS_OR_CONN_REFUSED": "DNS or connection refused",
        "code_NETWORK_ERROR": "Network error",
        "code_AUTH_BLOCKED": "Reverse proxy returned 401/403 — remove auth in front of /api/tunnel/pair/ping",
        "code_HTTP_ERROR": "HTTP error from the URL",
        "code_NOT_XOPC_GATEWAY": "URL did not identify as an xopc gateway",
        "code_invalid_url": "Invalid URL",
        "code_invalid_scheme": "Scheme must be http(s)",
        "code_has_userinfo": "URL must not contain userinfo",
        "code_has_path": "URL must not contain a path",
        "code_has_query_or_fragment": "URL must not contain query or fragment",
        "code_requires_https": "Public hostnames require https",
        "code_INVALID_JSON": "Invalid JSON body"
      }
    }
  }
}
