New translations en-us.json (Spanish)

[ci skip]

.cursor/rules/Localization.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+Always localize strings and use the `t` function to convert keys to strings. Add the keys to the en-us.json file. Never edit the other language files, as en-us.json is the single source of truth.

.cursor/rules/Nomenclature.mdc

@@ -0,0 +1,7 @@
+---
+description: 
+alwaysApply: true
+---
+
+Proxy resources = public resources
+Private resources = client resources = site resources

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @oschwartz10612 @miloschwartz

.github/FUNDING.yml

@@ -1,3 +0,0 @@
-# These are supported funding model platforms
-
-github: [fosrl]

.github/ISSUE_TEMPLATE/1.bug_report.yml

@@ -14,12 +14,13 @@ body:
           label: Environment
           description: Please fill out the relevant details below for your environment.
           value: |
-              - OS Type & Version: (e.g., Ubuntu 22.04)
+              - OS Type & Version:
               - Pangolin Version:
+              - Edition (Community or Enterprise):
               - Gerbil Version:
               - Traefik Version:
               - Newt Version:
-              - Olm Version: (if applicable)
+              - Client Version:
       validations:
           required: true
 

.github/workflows/cicd.yml

@@ -77,7 +77,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -264,7 +264,7 @@ jobs:
               shell: bash
 
             - name: Install Go
-              uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
               with:
                   go-version: 1.25
 
@@ -299,7 +299,7 @@ jobs:
               shell: bash
 
             - name: Upload artifacts from /install/bin
-              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: install-bin
                   path: install/bin/
@@ -407,35 +407,27 @@ jobs:
               shell: bash
 
             - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
               with:
                 registry: ghcr.io
                 username: ${{ github.actor }}
                 password: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Install cosign
-              # cosign is used to sign and verify container images (key and keyless)
-              uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+              # cosign is used to sign container images using keyless (OIDC) signing
+              uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+              with:
+                cosign-release: v3.0.6
 
-            - name: Dual-sign and verify (GHCR & Docker Hub)
-              # Sign each image by digest using keyless (OIDC) and key-based signing,
-              # then verify both the public key signature and the keyless OIDC signature.
+            - name: Sign (GHCR, keyless)
+              # Sign each GHCR image by digest using keyless (OIDC) signing via Sigstore/Rekor.
+              # Signatures are stored in the registry alongside the image.
               env:
                   TAG: ${{ env.TAG }}
-                  COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-                  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-                  COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
                   COSIGN_YES: "true"
               run: |
                   set -euo pipefail
 
-                  issuer="https://token.actions.githubusercontent.com"
-                  id_regex="^https://github.com/${{ github.repository }}/.+"  # accept this repo (all workflows/refs)
-
-                  # Track failures
-                  FAILED_TAGS=()
-                  SUCCESSFUL_TAGS=()
-
                   # Determine if this is an RC release
                   IS_RC="false"
                   if [[ "$TAG" == *"-rc."* ]]; then
@@ -463,95 +455,47 @@ jobs:
                       )
                   fi
 
-                  # Sign each image variant for both registries
-                  for BASE_IMAGE in "${GHCR_IMAGE}" "${DOCKERHUB_IMAGE}"; do
-                    for IMAGE_TAG in "${IMAGE_TAGS[@]}"; do
-                      echo "Processing ${BASE_IMAGE}:${IMAGE_TAG}"
-                      TAG_FAILED=false
+                  FAILED_TAGS=()
+                  SUCCESSFUL_TAGS=()
 
-                      # Wrap the entire tag processing in error handling
-                      (
-                        set -e
-                        DIGEST="$(skopeo inspect --retry-times 3 docker://${BASE_IMAGE}:${IMAGE_TAG} | jq -r '.Digest')"
-                        REF="${BASE_IMAGE}@${DIGEST}"
-                        echo "Resolved digest: ${REF}"
+                  for IMAGE_TAG in "${IMAGE_TAGS[@]}"; do
+                    echo "Processing ${GHCR_IMAGE}:${IMAGE_TAG}"
+                    TAG_FAILED=false
 
-                        echo "==> cosign sign (keyless) --recursive ${REF}"
-                        cosign sign --recursive "${REF}"
+                    (
+                      set -e
+                      DIGEST="$(skopeo inspect --retry-times 3 docker://${GHCR_IMAGE}:${IMAGE_TAG} | jq -r '.Digest')"
+                      REF="${GHCR_IMAGE}@${DIGEST}"
+                      echo "Resolved digest: ${REF}"
 
-                        echo "==> cosign sign (key) --recursive ${REF}"
-                        cosign sign --key env://COSIGN_PRIVATE_KEY --recursive "${REF}"
+                      echo "==> cosign sign (keyless) --recursive ${REF}"
+                      cosign sign --recursive "${REF}"
+                    ) || TAG_FAILED=true
 
-                        # Retry wrapper for verification to handle registry propagation delays
-                        retry_verify() {
-                          local cmd="$1"
-                          local attempts=6
-                          local delay=5
-                          local i=1
-                          until eval "$cmd"; do
-                            if [ $i -ge $attempts ]; then
-                              echo "Verification failed after $attempts attempts"
-                              return 1
-                            fi
-                            echo "Verification not yet available. Retry $i/$attempts after ${delay}s..."
-                            sleep $delay
-                            i=$((i+1))
-                            delay=$((delay*2))
-                            # Cap the delay to avoid very long waits
-                            if [ $delay -gt 60 ]; then delay=60; fi
-                          done
-                          return 0
-                        }
-
-                        echo "==> cosign verify (public key) ${REF}"
-                        if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${REF}' -o text"; then
-                          VERIFIED_INDEX=true
-                        else
-                          VERIFIED_INDEX=false
-                        fi
-
-                        echo "==> cosign verify (keyless policy) ${REF}"
-                        if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${REF}' -o text"; then
-                          VERIFIED_INDEX_KEYLESS=true
-                        else
-                          VERIFIED_INDEX_KEYLESS=false
-                        fi
-
-                        # Check if verification succeeded
-                        if [ "${VERIFIED_INDEX}" != "true" ] && [ "${VERIFIED_INDEX_KEYLESS}" != "true" ]; then
-                          echo "⚠️  WARNING: Verification not available for ${BASE_IMAGE}:${IMAGE_TAG}"
-                          echo "This may be due to registry propagation delays. Continuing anyway."
-                        fi
-                      ) || TAG_FAILED=true
-
-                      if [ "$TAG_FAILED" = "true" ]; then
-                        echo "⚠️  WARNING: Failed to sign/verify ${BASE_IMAGE}:${IMAGE_TAG}"
-                        FAILED_TAGS+=("${BASE_IMAGE}:${IMAGE_TAG}")
-                      else
-                        echo "✓ Successfully signed and verified ${BASE_IMAGE}:${IMAGE_TAG}"
-                        SUCCESSFUL_TAGS+=("${BASE_IMAGE}:${IMAGE_TAG}")
-                      fi
-                    done
+                    if [ "$TAG_FAILED" = "true" ]; then
+                      echo "⚠️  WARNING: Failed to sign ${GHCR_IMAGE}:${IMAGE_TAG}"
+                      FAILED_TAGS+=("${GHCR_IMAGE}:${IMAGE_TAG}")
+                    else
+                      echo "✓ Successfully signed ${GHCR_IMAGE}:${IMAGE_TAG}"
+                      SUCCESSFUL_TAGS+=("${GHCR_IMAGE}:${IMAGE_TAG}")
+                    fi
                   done
 
-                  # Report summary
                   echo ""
                   echo "=========================================="
-                  echo "Sign and Verify Summary"
+                  echo "Sign Summary"
                   echo "=========================================="
                   echo "Successful: ${#SUCCESSFUL_TAGS[@]}"
                   echo "Failed: ${#FAILED_TAGS[@]}"
-                  echo ""
 
                   if [ ${#FAILED_TAGS[@]} -gt 0 ]; then
                     echo "Failed tags:"
                     for tag in "${FAILED_TAGS[@]}"; do
                       echo "  - $tag"
                     done
-                    echo ""
-                    echo "⚠️  WARNING: Some tags failed to sign/verify, but continuing anyway"
+                    echo "⚠️  WARNING: Some tags failed to sign, but continuing anyway"
                   else
-                    echo "✓ All images signed and verified successfully!"
+                    echo "✓ All images signed successfully!"
                   fi
               shell: bash
 

.github/workflows/linting.yml

@@ -24,7 +24,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: Set up Node.js
-              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                 node-version: '24'
 

.github/workflows/mirror.yaml

@@ -23,7 +23,7 @@ jobs:
           skopeo --version
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Input check
         run: |

.github/workflows/restart-runners.yml

@@ -1,39 +0,0 @@
-name: Restart Runners
-
-on:
-  schedule:
-    - cron: '0 0 */7 * *'
-
-permissions:
-    id-token: write
-    contents: read
-
-jobs:
-  ec2-maintenance-prod:
-    runs-on: ubuntu-latest
-    permissions: write-all
-    steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
-        with:
-          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-          role-duration-seconds: 3600
-          aws-region: ${{ secrets.AWS_REGION }}
-
-      - name: Verify AWS identity
-        run: aws sts get-caller-identity
-
-      - name: Start EC2 instance
-        run: |
-          aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-          aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
-          echo "EC2 instances started"
-
-      - name: Wait
-        run: sleep 600
-
-      - name: Stop EC2 instance
-        run: |
-          aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-          aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
-          echo "EC2 instances stopped"

.github/workflows/saas.yml

@@ -1,160 +0,0 @@
-name: SAAS Pipeline
-
-# CI/CD workflow for building, publishing, mirroring, signing container images and building release binaries.
-# Actions are pinned to specific SHAs to reduce supply-chain risk. This workflow triggers on tag push events.
-
-permissions:
-  contents: read
-  packages: write      # for GHCR push
-  id-token: write      # for Cosign Keyless (OIDC) Signing
-
-on:
-    push:
-        tags:
-            - "[0-9]+.[0-9]+.[0-9]+-s.[0-9]+"
-
-concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-    pre-run:
-        runs-on: ubuntu-latest
-        permissions: write-all
-        steps:
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Verify AWS identity
-              run: aws sts get-caller-identity
-
-            - name: Start EC2 instances
-              run: |
-                  aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-                  echo "EC2 instances started"
-
-
-    release-arm:
-        name: Build and Release (ARM64)
-        runs-on: [self-hosted, linux, arm64, us-east-1]
-        needs: [pre-run]
-        if: >-
-            ${{
-                needs.pre-run.result == 'success'
-            }}
-        # Job-level timeout to avoid runaway or stuck runs
-        timeout-minutes: 120
-        env:
-          # Target images
-          AWS_IMAGE: ${{ secrets.aws_account_id }}.dkr.ecr.us-east-1.amazonaws.com/${{ github.event.repository.name }}
-
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-            - name: Download MaxMind GeoLite2 databases
-              env:
-                MAXMIND_LICENSE_KEY: ${{ secrets.MAXMIND_LICENSE_KEY }}
-              run: |
-                echo "Downloading MaxMind GeoLite2 databases..."
-
-                # Download GeoLite2-Country
-                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
-                  -o GeoLite2-Country.tar.gz
-
-                # Download GeoLite2-ASN
-                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-ASN&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
-                  -o GeoLite2-ASN.tar.gz
-
-                # Extract the .mmdb files
-                tar -xzf GeoLite2-Country.tar.gz --strip-components=1 --wildcards '*.mmdb'
-                tar -xzf GeoLite2-ASN.tar.gz --strip-components=1 --wildcards '*.mmdb'
-
-                # Verify files exist
-                if [ ! -f "GeoLite2-Country.mmdb" ]; then
-                  echo "ERROR: Failed to download GeoLite2-Country.mmdb"
-                  exit 1
-                fi
-
-                if [ ! -f "GeoLite2-ASN.mmdb" ]; then
-                  echo "ERROR: Failed to download GeoLite2-ASN.mmdb"
-                  exit 1
-                fi
-
-                # Clean up tar files
-                rm -f GeoLite2-Country.tar.gz GeoLite2-ASN.tar.gz
-
-                echo "MaxMind databases downloaded successfully"
-                ls -lh GeoLite2-*.mmdb
-
-            - name: Monitor storage space
-              run: |
-                  THRESHOLD=75
-                  USED_SPACE=$(df / | grep / | awk '{ print $5 }' | sed 's/%//g')
-                  echo "Used space: $USED_SPACE%"
-                  if [ "$USED_SPACE" -ge "$THRESHOLD" ]; then
-                      echo "Used space is below the threshold of 75% free. Running Docker system prune."
-                      echo y | docker system prune -a
-                  else
-                      echo "Storage space is above the threshold. No action needed."
-                  fi
-
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.aws_account_id }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Login to Amazon ECR
-              id: login-ecr
-              uses: aws-actions/amazon-ecr-login@v2
-
-            - name: Extract tag name
-              id: get-tag
-              run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-              shell: bash
-
-            - name: Update version in package.json
-              run: |
-                  TAG=${{ env.TAG }}
-                  sed -i "s/export const APP_VERSION = \".*\";/export const APP_VERSION = \"$TAG\";/" server/lib/consts.ts
-                  cat server/lib/consts.ts
-              shell: bash
-
-            - name: Build and push Docker images (Docker Hub - ARM64)
-              run: |
-                  TAG=${{ env.TAG }}
-                  make build-saas tag=$TAG
-                  echo "Built & pushed ARM64 images to: ${{ env.AWS_IMAGE }}:${TAG}"
-              shell: bash
-
-    post-run:
-        needs: [pre-run, release-arm]
-        if: >-
-            ${{
-                always() &&
-                needs.pre-run.result == 'success' &&
-                (needs.release-arm.result == 'success' || needs.release-arm.result == 'skipped' || needs.release-arm.result == 'failure')
-            }}
-        runs-on: ubuntu-latest
-        permissions: write-all
-        steps:
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Verify AWS identity
-              run: aws sts get-caller-identity
-
-            - name: Stop EC2 instances
-              run: |
-                  aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-                  echo "EC2 instances stopped"

.github/workflows/stale-bot.yml

@@ -14,7 +14,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           days-before-stale: 14
           days-before-close: 14

.github/workflows/test.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
 

.gitignore

@@ -17,9 +17,9 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 *.db
-*.sqlite
+*.sqlite*
 !Dockerfile.sqlite
-*.sqlite3
+*.sqlite3*
 *.log
 .machinelogs*.json
 *-audit.json
@@ -54,3 +54,4 @@ hydrateSaas.ts
 CLAUDE.md
 drizzle.config.ts
 server/setup/migrations.ts
+solo.yml

README.md

@@ -35,43 +35,53 @@
 
 </div>
 
-<p align="center">
-    <a href="https://docs.pangolin.net/careers/join-us">
-        <img src="https://img.shields.io/badge/🚀_We're_Hiring!-Join_Our_Team-brightgreen?style=for-the-badge" alt="We're Hiring!" />
-    </a>
-</p>
-
 <p align="center">
     <strong>
         Get started with Pangolin at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
     </strong>
 </p>
 
-Pangolin is an open-source, identity-based remote access platform built on WireGuard that enables secure, seamless connectivity to private and public resources. Pangolin combines reverse proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to any private resources, all with zero-trust security and granular access control.
+Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure, seamless connectivity to private and public resources. Pangolin combines reverse proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to any private resources with NAT traversal, all with granular access controls.
 
 ## Installation
 
-- Check out the [quick install guide](https://docs.pangolin.net/self-host/quick-install) for how to install and set up Pangolin.
-- Install from the [DigitalOcean marketplace](https://marketplace.digitalocean.com/apps/pangolin-ce-1?refcode=edf0480eeb81) for a one-click pre-configured installer.
+- Get started for free with [Pangolin Cloud](https://app.pangolin.net/).
+- Or, check out the [quick install guide](https://docs.pangolin.net/self-host/quick-install) for how to self-host Pangolin.
+  - Install from the [DigitalOcean marketplace](https://marketplace.digitalocean.com/apps/pangolin-ce-1?refcode=edf0480eeb81) for a one-click pre-configured installer.
 
-<img src="public/screenshots/hero.png" />
+<img src="public/screenshots/hero.png" alt="Pangolin" width="100%" />
 
 ## Deployment Options
 
-| <img width=500 /> | Description |
-|-----------------|--------------|
-| **Pangolin Cloud** | Fully managed service with instant setup and pay-as-you-go pricing — no infrastructure required. Or, self-host your own [remote node](https://docs.pangolin.net/manage/remote-node/understanding-nodes) and connect to our control plane. |
-| **Self-Host: Community Edition** | Free, open source, and licensed under AGPL-3. |
-| **Self-Host: Enterprise Edition** | Licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses earning under \$100K USD annually. |
+- **Pangolin Cloud** - Fully managed service - no infrastructure required.
+- **Self-Host: Community Edition** - Free, open source, and licensed under AGPL-3.
+- **Self-Host: Enterprise Edition** - Licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses making less than \$100K USD gross annual revenue.
 
 ## Key Features
 
-| <img width=500 />                                                                                                                                                                                                                                                                                                                                                                | <img width=500 />                                                  |
-|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
-| **Connect remote networks with sites**<br /><br />Pangolin's lightweight site connectors create secure tunnels from remote networks without requiring public IP addresses or open ports. Sites make any network anywhere available for authorized access.                                                                                                                                                                                   | <img src="public/screenshots/sites.png" width=500 /><tr></tr>               |
-| **Browser-based reverse proxy access**<br /><br />Expose web applications through identity and context-aware tunneled reverse proxies. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet. Users access applications through any web browser with authentication and granular access control.                                                                                                  | <img src="public/clip.gif" width=500 /><tr></tr>          |
-| **Client-based private resource access**<br /><br />Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites.                                                                                                                                                                                                | <img src="public/screenshots/private-resources.png" width=500 /><tr></tr>               |
-| **Zero-trust granular access**<br /><br />Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications and services you explicitly define, reducing security risk and attack surface.                                                                                                                                                                                    | <img src="public/screenshots/user-devices.png" width=500 /><tr></tr> |
+### Connect remote networks with sites and NAT traversal
+
+Pangolin's site connectors provide gateways into networks so you can access any networked resources. Sites use outbound tunnels and intelligent NAT traversal to make networks behind restrictive firewalls available for authorized access without public IPs or open ports. Easily deploy a site as a binary or container on any platform.
+
+<img src="public/screenshots/sites.png" alt="Sites" width="100%" />
+
+### Browser-based reverse proxy access
+
+Expose web applications through identity and context-aware tunneled reverse proxies. Users access applications through any web browser with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+
+<img src="public/clip.gif" alt="Reverse proxy access" width="100%" />
+
+### Client-based private resource access
+
+Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. Add redundancy by routing traffic through multiple connectors in your network.
+
+<img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />
+
+### Give users and roles access to resources
+
+Use Pangolin's built in users or bring your own identity provider and set up role based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+
+<img src="public/screenshots/users.png" alt="Users from identity provider with roles" width="100%" />
 
 ## Download Clients
 
@@ -87,7 +97,7 @@ Download the Pangolin client for your platform:
 
 ### Sign up now
 
-Create an account at [app.pangolin.net](https://app.pangolin.net) to get started with Pangolin Cloud. A generous free tier is available.
+Create a free account at [app.pangolin.net](https://app.pangolin.net) to get started with Pangolin Cloud.
 
 ### Check out the docs
 
@@ -102,7 +112,3 @@ Pangolin is dual licensed under the AGPL-3 and the [Fossorial Commercial License
 ## Contributions
 
 Please see [CONTRIBUTING](./CONTRIBUTING.md) in the repository for guidelines and best practices.
-
----
-
-WireGuard® is a registered trademark of Jason A. Donenfeld.

bruno/API Keys/Create API Key.bru

@@ -1,17 +0,0 @@
-meta {
-  name: Create API Key
-  type: http
-  seq: 1
-}
-
-put {
-  url: http://localhost:3000/api/v1/api-key
-  body: json
-  auth: inherit
-}
-
-body:json {
-  {
-    "isRoot": true
-  }
-}

bruno/API Keys/Delete API Key.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Delete API Key
-  type: http
-  seq: 2
-}
-
-delete {
-  url: http://localhost:3000/api/v1/api-key/dm47aacqxxn3ubj
-  body: none
-  auth: inherit
-}

bruno/API Keys/List API Key Actions.bru

@@ -1,11 +0,0 @@
-meta {
-  name: List API Key Actions
-  type: http
-  seq: 6
-}
-
-get {
-  url: http://localhost:3000/api/v1/api-key/ex0izu2c37fjz9x/actions
-  body: none
-  auth: inherit
-}

bruno/API Keys/List Org API Keys.bru

@@ -1,11 +0,0 @@
-meta {
-  name: List Org API Keys
-  type: http
-  seq: 4
-}
-
-get {
-  url: http://localhost:3000/api/v1/org/home-lab/api-keys
-  body: none
-  auth: inherit
-}

bruno/API Keys/List Root API Keys.bru

@@ -1,11 +0,0 @@
-meta {
-  name: List Root API Keys
-  type: http
-  seq: 3
-}
-
-get {
-  url: http://localhost:3000/api/v1/root/api-keys
-  body: none
-  auth: inherit
-}

bruno/API Keys/Set API Key Actions.bru

@@ -1,17 +0,0 @@
-meta {
-  name: Set API Key Actions
-  type: http
-  seq: 5
-}
-
-post {
-  url: http://localhost:3000/api/v1/api-key/ex0izu2c37fjz9x/actions
-  body: json
-  auth: inherit
-}
-
-body:json {
-  {
-    "actionIds": ["listSites"]
-  }
-}

bruno/API Keys/Set API Key Orgs.bru

@@ -1,17 +0,0 @@
-meta {
-  name: Set API Key Orgs
-  type: http
-  seq: 7
-}
-
-post {
-  url: http://localhost:3000/api/v1/api-key/ex0izu2c37fjz9x/orgs
-  body: json
-  auth: inherit
-}
-
-body:json {
-  {
-    "orgIds": ["home-lab"]
-  }
-}

bruno/API Keys/folder.bru

@@ -1,3 +0,0 @@
-meta {
-  name: API Keys
-}

bruno/Auth/2fa-disable.bru

@@ -1,18 +0,0 @@
-meta {
-  name: 2fa-disable
-  type: http
-  seq: 6
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/2fa/disable
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-      "password": "aaaaa-1A",
-      "code": "377289"
-  }
-}

bruno/Auth/2fa-enable.bru

@@ -1,17 +0,0 @@
-meta {
-  name: 2fa-enable
-  type: http
-  seq: 4
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/2fa/enable
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-      "code": "374138"
-  }
-}

bruno/Auth/2fa-request.bru

@@ -1,17 +0,0 @@
-meta {
-  name: 2fa-request
-  type: http
-  seq: 5
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/2fa/request
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-      "password": "aaaaa-1A"
-  }
-}

bruno/Auth/change-password.bru

@@ -1,18 +0,0 @@
-meta {
-  name: change-password
-  type: http
-  seq: 9
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/change-password
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-      "oldPassword": "",
-      "newPassword": ""
-  }
-}

bruno/Auth/login.bru

@@ -1,18 +0,0 @@
-meta {
-  name: login
-  type: http
-  seq: 1
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/login
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-    "email": "admin@fosrl.io",
-    "password": "Password123!"
-  }
-}

bruno/Auth/logout.bru

@@ -1,11 +0,0 @@
-meta {
-  name: logout
-  type: http
-  seq: 3
-}
-
-post {
-  url: http://localhost:4000/api/v1/auth/logout
-  body: none
-  auth: none
-}

bruno/Auth/reset-password-request.bru

@@ -1,17 +0,0 @@
-meta {
-  name: reset-password-request
-  type: http
-  seq: 10
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/reset-password/request
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-      "email": "milo@pangolin.net"
-  }
-}

bruno/Auth/reset-password.bru

@@ -1,19 +0,0 @@
-meta {
-  name: reset-password
-  type: http
-  seq: 11
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/reset-password
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-      "token": "3uhsbom72dwdhboctwrtntyd6jrlg4jtf5oaxy4k",
-      "newPassword": "aaaaa-1A",
-      "code": "6irqCGR3"
-  }
-}

bruno/Auth/signup.bru

@@ -1,18 +0,0 @@
-meta {
-  name: signup
-  type: http
-  seq: 2
-}
-
-put {
-  url: http://localhost:3000/api/v1/auth/signup
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-    "email": "numbat@pangolin.net",
-    "password": "Password123!"
-  }
-}

bruno/Auth/verify-email-request.bru

@@ -1,11 +0,0 @@
-meta {
-  name: verify-email-request
-  type: http
-  seq: 8
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/verify-email/request
-  body: none
-  auth: none
-}

bruno/Auth/verify-email.bru

@@ -1,17 +0,0 @@
-meta {
-  name: verify-email
-  type: http
-  seq: 7
-}
-
-post {
-  url: http://localhost:3000/api/v1/auth/verify-email
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-      "code": "50317187"
-  }
-}

bruno/Auth/verify-user.bru

@@ -1,15 +0,0 @@
-meta {
-  name: verify-user
-  type: http
-  seq: 4
-}
-
-get {
-  url: http://localhost:3001/api/v1/badger/verify-user?sessionId=mb52273jkb6t3oys2bx6ur5x7rcrkl26c7warg3e
-  body: none
-  auth: none
-}
-
-params:query {
-  sessionId: mb52273jkb6t3oys2bx6ur5x7rcrkl26c7warg3e
-}

bruno/Clients/createClient.bru

@@ -1,22 +0,0 @@
-meta {
-  name: createClient
-  type: http
-  seq: 1
-}
-
-put {
-  url: http://localhost:3000/api/v1/site/1/client
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-      "siteId": 1,
-      "name": "test",
-      "type": "olm",
-      "subnet": "100.90.129.4/30",
-      "olmId": "029yzunhx6nh3y5",
-      "secret": "l0ymp075y3d4rccb25l6sqpgar52k09etunui970qq5gj7x6"
-  }
-}

bruno/Clients/pickClientDefaults.bru

@@ -1,11 +0,0 @@
-meta {
-  name: pickClientDefaults
-  type: http
-  seq: 2
-}
-
-get {
-  url: http://localhost:3000/api/v1/site/1/pick-client-defaults
-  body: none
-  auth: none
-}

bruno/IDP/Create OIDC Provider.bru

@@ -1,22 +0,0 @@
-meta {
-  name: Create OIDC Provider
-  type: http
-  seq: 1
-}
-
-put {
-  url: http://localhost:3000/api/v1/org/home-lab/idp/oidc
-  body: json
-  auth: inherit
-}
-
-body:json {
-  {
-    "clientId": "JJoSvHCZcxnXT2sn6CObj6a21MuKNRXs3kN5wbys",
-    "clientSecret": "2SlGL2wOGgMEWLI9yUuMAeFxre7qSNJVnXMzyepdNzH1qlxYnC4lKhhQ6a157YQEkYH3vm40KK4RCqbYiF8QIweuPGagPX3oGxEj2exwutoXFfOhtq4hHybQKoFq01Z3",
-    "authUrl": "http://localhost:9000/application/o/authorize/",
-    "tokenUrl": "http://localhost:9000/application/o/token/",
-    "scopes": ["email", "openid", "profile"],
-    "userIdentifier": "email"
-  }
-}

bruno/IDP/Generate OIDC URL.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Generate OIDC URL
-  type: http
-  seq: 2
-}
-
-get {
-  url: http://localhost:3000/api/v1
-  body: none
-  auth: inherit
-}

bruno/IDP/folder.bru

@@ -1,3 +0,0 @@
-meta {
-  name: IDP
-}

bruno/Internal/Traefik Config.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Traefik Config
-  type: http
-  seq: 1
-}
-
-get {
-  url: http://localhost:3001/api/v1/traefik-config
-  body: none
-  auth: inherit
-}

bruno/Internal/folder.bru

@@ -1,3 +0,0 @@
-meta {
-  name: Internal
-}

bruno/Newt/Create Newt.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Create Newt
-  type: http
-  seq: 2
-}
-
-get {
-  url: http://localhost:3000/api/v1/newt
-  body: none
-  auth: none
-}

bruno/Newt/Get Token.bru

@@ -1,18 +0,0 @@
-meta {
-  name: Get Token
-  type: http
-  seq: 1
-}
-
-get {
-  url: http://localhost:3000/api/v1/auth/newt/get-token
-  body: json
-  auth: none
-}
-
-body:json {
-  {
-   "newtId": "o0d4rdxq3stnz7b",
-    "secret": "sy7l09fnaesd03iwrfp9m3qf0ryn19g0zf3dqieaazb4k7vk"
-  }
-}

bruno/Olm/createOlm.bru

@@ -1,15 +0,0 @@
-meta {
-  name: createOlm
-  type: http
-  seq: 1
-}
-
-put {
-  url: http://localhost:3000/api/v1/olm
-  body: none
-  auth: inherit
-}
-
-settings {
-  encodeUrl: true
-}

bruno/Olm/folder.bru

@@ -1,8 +0,0 @@
-meta {
-  name: Olm
-  seq: 15
-}
-
-auth {
-  mode: inherit
-}

bruno/Orgs/Check Id.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Check Id
-  type: http
-  seq: 2
-}
-
-get {
-  url: http://localhost:3000/api/v1/org/checkId
-  body: none
-  auth: none
-}

bruno/Orgs/listOrgs.bru

@@ -1,11 +0,0 @@
-meta {
-  name: listOrgs
-  type: http
-  seq: 1
-}
-
-get {
-  url: 
-  body: none
-  auth: none
-}

bruno/Remote Exit Node/createRemoteExitNode.bru

@@ -1,11 +0,0 @@
-meta {
-  name: createRemoteExitNode
-  type: http
-  seq: 1
-}
-
-put {
-  url: http://localhost:4000/api/v1/org/org_i21aifypnlyxur2/remote-exit-node
-  body: none
-  auth: none
-}

bruno/Resources/listResourcesByOrg.bru

@@ -1,11 +0,0 @@
-meta {
-  name: listResourcesByOrg
-  type: http
-  seq: 1
-}
-
-get {
-  url: 
-  body: none
-  auth: none
-}

bruno/Resources/listResourcesBySite.bru

@@ -1,16 +0,0 @@
-meta {
-  name: listResourcesBySite
-  type: http
-  seq: 2
-}
-
-get {
-  url: http://localhost:3000/api/v1/site/1/resources?limit=10&offset=0
-  body: none
-  auth: none
-}
-
-params:query {
-  limit: 10
-  offset: 0
-}

bruno/Sites/Get Site.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Get Site
-  type: http
-  seq: 2
-}
-
-get {
-  url: http://localhost:3000/api/v1/org/test/sites/mexican-mole-lizard-windy
-  body: none
-  auth: none
-}

bruno/Sites/listSites.bru

@@ -1,11 +0,0 @@
-meta {
-  name: listSites
-  type: http
-  seq: 1
-}
-
-get {
-  url: 
-  body: none
-  auth: none
-}

bruno/Targets/listTargets.bru

@@ -1,16 +0,0 @@
-meta {
-  name: listTargets
-  type: http
-  seq: 1
-}
-
-get {
-  url: http://localhost:3000/api/v1/resource/web.main.localhost/targets?limit=10&offset=0
-  body: none
-  auth: none
-}
-
-params:query {
-  limit: 10
-  offset: 0
-}

bruno/Test.bru

@@ -1,11 +0,0 @@
-meta {
-  name: Test
-  type: http
-  seq: 2
-}
-
-get {
-  url: http://localhost:3000/api/v1
-  body: none
-  auth: inherit
-}

bruno/Traefik/traefik-config.bru

@@ -1,11 +0,0 @@
-meta {
-  name: traefik-config
-  type: http
-  seq: 1
-}
-
-get {
-  url: http://localhost:3001/api/v1/traefik-config
-  body: none
-  auth: none
-}

bruno/Users/adminListUsers.bru

@@ -1,11 +0,0 @@
-meta {
-  name: adminListUsers
-  type: http
-  seq: 2
-}
-
-get {
-  url: http://localhost:3000/api/v1/users
-  body: none
-  auth: none
-}

bruno/Users/adminRemoveUser.bru

@@ -1,11 +0,0 @@
-meta {
-  name: adminRemoveUser
-  type: http
-  seq: 3
-}
-
-delete {
-  url: http://localhost:3000/api/v1/user/ky5r7ivqs8wc7u4
-  body: none
-  auth: none
-}

bruno/Users/getUser.bru

@@ -1,11 +0,0 @@
-meta {
-  name: getUser
-  type: http
-  seq: 1
-}
-
-get {
-  url: 
-  body: none
-  auth: none
-}

bruno/bruno.json

@@ -1,13 +0,0 @@
-{
-  "version": "1",
-  "name": "Pangolin",
-  "type": "collection",
-  "ignore": [
-    "node_modules",
-    ".git"
-  ],
-  "presets": {
-    "requestType": "http",
-    "requestUrl": "http://localhost:3000/api/v1"
-  }
-}

cli/commands/clearCertificates.ts

@@ -0,0 +1,28 @@
+import { CommandModule } from "yargs";
+import { db, certificates } from "@server/db";
+
+type ClearCertificatesArgs = {};
+
+export const clearCertificates: CommandModule<{}, ClearCertificatesArgs> = {
+    command: "clear-certificates",
+    describe: "Delete all entries from the certificates table",
+    builder: (yargs) => {
+        return yargs;
+    },
+    handler: async (argv: {}) => {
+        try {
+            console.log("Clearing all certificates from the database...");
+
+            const deleted = await db.delete(certificates).returning();
+
+            console.log(
+                `Deleted ${deleted.length} certificate(s) from the database`
+            );
+
+            process.exit(0);
+        } catch (error) {
+            console.error("Error:", error);
+            process.exit(1);
+        }
+    }
+};

cli/commands/disableUser2fa.ts

@@ -0,0 +1,60 @@
+import { CommandModule } from "yargs";
+import { db, users } from "@server/db";
+import { eq } from "drizzle-orm";
+
+/**
+ * Disable 2FA for a user by email address.
+ */
+type DisableUser2faArgs = {
+    email: string;
+};
+
+export const disableUser2fa: CommandModule<{}, DisableUser2faArgs> = {
+    command: "disable-user-2fa",
+    describe: "Disable 2FA for a user (sets twoFactorEnabled=false, clears secret)",
+    builder: (yargs) => {
+        return yargs.option("email", {
+            type: "string",
+            demandOption: true,
+            describe: "User email address"
+        });
+    },
+    handler: async (argv: { email: string }) => {
+        try {
+            const { email } = argv;
+            console.log(`Looking for user with email: ${email}`);
+
+            // Find the user by email
+            const [user] = await db
+                .select()
+                .from(users)
+                .where(eq(users.email, email))
+                .limit(1);
+
+            if (!user) {
+                console.error(`User with email '${email}' not found`);
+                process.exit(1);
+            }
+
+            if (!user.twoFactorEnabled) {
+                console.log(`2FA is already disabled for user '${email}'.`);
+                process.exit(0);
+            }
+
+            // Update user: disable 2FA and clear secret
+            await db.update(users)
+                .set({
+                    twoFactorEnabled: false,
+                    twoFactorSecret: null,
+                    twoFactorSetupRequested: false
+                })
+                .where(eq(users.userId, user.userId));
+
+            console.log(`2FA disabled for user '${email}'.`);
+            process.exit(0);
+        } catch (error) {
+            console.error("Error disabling 2FA:", error);
+            process.exit(1);
+        }
+    }
+};

cli/commands/rotateServerSecret.ts

@@ -1,5 +1,5 @@
 import { CommandModule } from "yargs";
-import { db, idpOidcConfig, licenseKey } from "@server/db";
+import { db, idpOidcConfig, licenseKey, certificates, eventStreamingDestinations, alertWebhookActions } from "@server/db";
 import { encrypt, decrypt } from "@server/lib/crypto";
 import { configFilePath1, configFilePath2 } from "@server/lib/consts";
 import { eq } from "drizzle-orm";
@@ -129,9 +129,15 @@ export const rotateServerSecret: CommandModule<
             console.log("\nReading encrypted data from database...");
             const idpConfigs = await db.select().from(idpOidcConfig);
             const licenseKeys = await db.select().from(licenseKey);
+            const certs = await db.select().from(certificates);
+            const streamingDestinations = await db.select().from(eventStreamingDestinations);
+            const webhookActions = await db.select().from(alertWebhookActions);
 
             console.log(`Found ${idpConfigs.length} OIDC IdP configuration(s)`);
             console.log(`Found ${licenseKeys.length} license key(s)`);
+            console.log(`Found ${certs.length} certificate(s)`);
+            console.log(`Found ${streamingDestinations.length} event streaming destination(s)`);
+            console.log(`Found ${webhookActions.length} alert webhook action(s)`);
 
             // Prepare all decrypted and re-encrypted values
             console.log("\nDecrypting and re-encrypting values...");
@@ -149,8 +155,27 @@ export const rotateServerSecret: CommandModule<
                 encryptedInstanceId: string;
             };
 
+            type CertUpdate = {
+                certId: number;
+                encryptedCertFile: string | null;
+                encryptedKeyFile: string | null;
+            };
+
+            type StreamingDestinationUpdate = {
+                destinationId: number;
+                encryptedConfig: string;
+            };
+
+            type WebhookActionUpdate = {
+                webhookActionId: number;
+                encryptedConfig: string;
+            };
+
             const idpUpdates: IdpUpdate[] = [];
             const licenseKeyUpdates: LicenseKeyUpdate[] = [];
+            const certUpdates: CertUpdate[] = [];
+            const streamingDestinationUpdates: StreamingDestinationUpdate[] = [];
+            const webhookActionUpdates: WebhookActionUpdate[] = [];
 
             // Process idpOidcConfig entries
             for (const idpConfig of idpConfigs) {
@@ -217,6 +242,70 @@ export const rotateServerSecret: CommandModule<
                 }
             }
 
+            // Process certificate entries
+            for (const cert of certs) {
+                try {
+                    const encryptedCertFile = cert.certFile
+                        ? encrypt(decrypt(cert.certFile, oldSecret), newSecret)
+                        : null;
+                    const encryptedKeyFile = cert.keyFile
+                        ? encrypt(decrypt(cert.keyFile, oldSecret), newSecret)
+                        : null;
+
+                    certUpdates.push({
+                        certId: cert.certId,
+                        encryptedCertFile,
+                        encryptedKeyFile
+                    });
+                } catch (error) {
+                    console.error(
+                        `Error processing certificate ${cert.certId} (${cert.domain}):`,
+                        error
+                    );
+                    throw error;
+                }
+            }
+
+            // Process eventStreamingDestinations entries
+            for (const dest of streamingDestinations) {
+                try {
+                    const decryptedConfig = decrypt(dest.config, oldSecret);
+                    const encryptedConfig = encrypt(decryptedConfig, newSecret);
+
+                    streamingDestinationUpdates.push({
+                        destinationId: dest.destinationId,
+                        encryptedConfig
+                    });
+                } catch (error) {
+                    console.error(
+                        `Error processing event streaming destination ${dest.destinationId}:`,
+                        error
+                    );
+                    throw error;
+                }
+            }
+
+            // Process alertWebhookActions entries
+            for (const webhook of webhookActions) {
+                try {
+                    if (webhook.config == null) continue;
+
+                    const decryptedConfig = decrypt(webhook.config, oldSecret);
+                    const encryptedConfig = encrypt(decryptedConfig, newSecret);
+
+                    webhookActionUpdates.push({
+                        webhookActionId: webhook.webhookActionId,
+                        encryptedConfig
+                    });
+                } catch (error) {
+                    console.error(
+                        `Error processing alert webhook action ${webhook.webhookActionId}:`,
+                        error
+                    );
+                    throw error;
+                }
+            }
+
             // Perform all database updates in a single transaction
             console.log("\nUpdating database in transaction...");
             await db.transaction(async (trx) => {
@@ -250,10 +339,50 @@ export const rotateServerSecret: CommandModule<
                         instanceId: update.encryptedInstanceId
                     });
                 }
+
+                // Update certificate entries
+                for (const update of certUpdates) {
+                    await trx
+                        .update(certificates)
+                        .set({
+                            certFile: update.encryptedCertFile,
+                            keyFile: update.encryptedKeyFile
+                        })
+                        .where(eq(certificates.certId, update.certId));
+                }
+
+                // Update event streaming destination entries
+                for (const update of streamingDestinationUpdates) {
+                    await trx
+                        .update(eventStreamingDestinations)
+                        .set({ config: update.encryptedConfig })
+                        .where(
+                            eq(
+                                eventStreamingDestinations.destinationId,
+                                update.destinationId
+                            )
+                        );
+                }
+
+                // Update alert webhook action entries
+                for (const update of webhookActionUpdates) {
+                    await trx
+                        .update(alertWebhookActions)
+                        .set({ config: update.encryptedConfig })
+                        .where(
+                            eq(
+                                alertWebhookActions.webhookActionId,
+                                update.webhookActionId
+                            )
+                        );
+                }
             });
 
             console.log(`Rotated ${idpUpdates.length} OIDC IdP configuration(s)`);
             console.log(`Rotated ${licenseKeyUpdates.length} license key(s)`);
+            console.log(`Rotated ${certUpdates.length} certificate(s)`);
+            console.log(`Rotated ${streamingDestinationUpdates.length} event streaming destination(s)`);
+            console.log(`Rotated ${webhookActionUpdates.length} alert webhook action(s)`);
 
             // Update config file with new secret
             console.log("\nUpdating config file...");
@@ -270,6 +399,9 @@ export const rotateServerSecret: CommandModule<
             console.log(`\nSummary:`);
             console.log(`  - OIDC IdP configurations: ${idpUpdates.length}`);
             console.log(`  - License keys: ${licenseKeyUpdates.length}`);
+            console.log(`  - Certificates: ${certUpdates.length}`);
+            console.log(`  - Event streaming destinations: ${streamingDestinationUpdates.length}`);
+            console.log(`  - Alert webhook actions: ${webhookActionUpdates.length}`);
             console.log(
                 `\n  IMPORTANT: Restart the server for the new secret to take effect.`
             );

cli/index.ts

@@ -9,6 +9,8 @@ import { rotateServerSecret } from "./commands/rotateServerSecret";
 import { clearLicenseKeys } from "./commands/clearLicenseKeys";
 import { deleteClient } from "./commands/deleteClient";
 import { generateOrgCaKeys } from "./commands/generateOrgCaKeys";
+import { clearCertificates } from "./commands/clearCertificates";
+import { disableUser2fa } from "./commands/disableUser2fa";
 
 yargs(hideBin(process.argv))
     .scriptName("pangctl")
@@ -19,5 +21,7 @@ yargs(hideBin(process.argv))
     .command(clearLicenseKeys)
     .command(deleteClient)
     .command(generateOrgCaKeys)
+    .command(clearCertificates)
+    .command(disableUser2fa)
     .demandCommand()
     .help().argv;

cloud

@@ -0,0 +1,110 @@
+git push origin -d 1.11.0-s.0
+git push origin -d 1.11.0-s.1
+git push origin -d 1.11.0-s.2
+git push origin -d 1.11.0-s.3
+git push origin -d 1.11.0-s.4
+git push origin -d 1.11.0-s.5
+git push origin -d 1.11.1-s.0
+git push origin -d 1.12.0-s.0
+git push origin -d 1.12.2-s.0
+git push origin -d 1.12.2-s.1
+git push origin -d 1.12.2-s.2
+git push origin -d 1.12.2-s.3
+git push origin -d 1.12.2-s.4
+git push origin -d 1.12.2-s.5
+git push origin -d 1.13.0.s.0
+git push origin -d 1.13.1-s.0
+git push origin -d 1.14.0-s.2
+git push origin -d 1.14.1-s.0
+git push origin -d 1.14.1-s.1
+git push origin -d 1.14.1-s.2
+git push origin -d 1.14.1-s.3
+git push origin -d 1.15.0-s.0
+git push origin -d 1.15.0-s.1
+git push origin -d 1.15.0-s.2
+git push origin -d 1.15.0-s.3
+git push origin -d 1.15.0-s.4
+git push origin -d 1.15.0-s.5
+git push origin -d 1.15.1-s.0
+git push origin -d 1.15.1-s.1
+git push origin -d 1.15.3-s.0
+git push origin -d 1.15.3-s.1
+git push origin -d 1.15.4-s.0
+git push origin -d 1.15.4-s.1
+git push origin -d 1.15.4-s.10
+git push origin -d 1.15.4-s.2
+git push origin -d 1.15.4-s.3
+git push origin -d 1.15.4-s.4
+git push origin -d 1.15.4-s.5
+git push origin -d 1.15.4-s.6
+git push origin -d 1.15.4-s.7
+git push origin -d 1.15.4-s.8
+git push origin -d 1.15.4-s.9
+git push origin -d 1.16.0-s.0
+git push origin -d 1.16.0-s.1
+git push origin -d 1.16.1-s.0
+git push origin -d 1.16.1-s.1
+git push origin -d 1.16.2-s.0
+git push origin -d 1.16.2-s.1
+git push origin -d 1.16.2-s.10
+git push origin -d 1.16.2-s.11
+git push origin -d 1.16.2-s.12
+git push origin -d 1.16.2-s.13
+git push origin -d 1.16.2-s.14
+git push origin -d 1.16.2-s.15
+git push origin -d 1.16.2-s.16
+git push origin -d 1.16.2-s.17
+git push origin -d 1.16.2-s.18
+git push origin -d 1.16.2-s.19
+git push origin -d 1.16.2-s.2
+git push origin -d 1.16.2-s.20
+git push origin -d 1.16.2-s.21
+git push origin -d 1.16.2-s.22
+git push origin -d 1.16.2-s.3
+git push origin -d 1.16.2-s.4
+git push origin -d 1.16.2-s.5
+git push origin -d 1.16.2-s.6
+git push origin -d 1.16.2-s.7
+git push origin -d 1.16.2-s.8
+git push origin -d 1.16.2-s.9
+git push origin -d 1.17.0-s.0
+git push origin -d 1.17.0-s.1
+git push origin -d 1.17.0-s.2
+git push origin -d 1.17.0-s.3
+git push origin -d 1.17.0-s.4
+git push origin -d 1.17.1-s.0
+git push origin -d 1.17.1-s.1
+git push origin -d 1.17.1-s.2
+git push origin -d 1.17.1-s.3
+git push origin -d 1.17.1-s.4
+git push origin -d 1.17.1-s.5
+git push origin -d 1.17.1-s.6
+git push origin -d 1.17.1-s.7
+git push origin -d 1.18.0-s.0
+git push origin -d 1.18.0-s.1
+git push origin -d 1.18.0-s.2
+git push origin -d 1.18.1-s.0
+git push origin -d 1.18.1-s.1
+git push origin -d 1.18.1-s.2
+git push origin -d 1.18.1-s.3
+git push origin -d 1.18.1-s.4
+git push origin -d 1.18.1-s.5
+git push origin -d 1.18.1-s.6
+git push origin -d 1.18.1-s.7
+git push origin -d 1.18.2-s.0
+git push origin -d 1.18.2-s.1
+git push origin -d 1.18.2-s.2
+git push origin -d 1.18.2-s.3
+git push origin -d 1.18.2-s.4
+git push origin -d 1.18.2-s.5
+git push origin -d 1.18.3-s.0
+git push origin -d 1.18.3-s.1
+git push origin -d 1.18.3-s.2
+git push origin -d 1.18.3-s.3
+git push origin -d 1.18.4-s.0
+git push origin -d 1.18.4-s.1
+git push origin -d 1.18.4-s.2
+git push origin -d 1.18.4-s.3
+git push origin -d 1.18.4-s.4
+git push origin -d 1.18.4-s.5
+git push origin -d 1.18.4-s.6

config/db/.gitignore

@@ -0,0 +1 @@
+*-journal

docker-compose.mailpit.yml

@@ -0,0 +1,12 @@
+services:
+  mailer:
+    image: axllent/mailpit
+    ports:
+      - 8025:8025
+      - 1025:1025
+    volumes:
+      - mailpit-storage:/data
+    environment:
+      - MP_DATABASE=/data/mailpit.db
+volumes:
+  mailpit-storage:

docker-compose.pgr.yml

@@ -7,8 +7,8 @@ services:
       POSTGRES_DB: postgres # Default database name
       POSTGRES_USER: postgres # Default user
       POSTGRES_PASSWORD: password # Default password (change for production!)
-    # volumes:
-    #   - ./config/postgres:/var/lib/postgresql/data
+    volumes:
+      - ./config/postgres:/var/lib/postgresql/data
     ports:
       - "5432:5432" # Map host port 5432 to container port 5432
     restart: no

drizzle.sqlite.config.ts

@@ -1,4 +1,4 @@
-import { APP_PATH } from "@server/lib/consts";
+import { APP_PATH } from "./server/lib/consts";
 import { defineConfig } from "drizzle-kit";
 import path from "path";
 

install/config/config.yml

@@ -22,7 +22,8 @@ server:
         methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
         allowed_headers: ["X-CSRF-Token", "Content-Type"]
         credentials: false
-    {{if .EnableGeoblocking}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
+    {{if .EnableMaxMind}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
+    {{if .EnableMaxMind}}maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"{{end}}
 {{if .EnableEmail}}
 email:
     smtp_host: "{{.EmailSMTPHost}}"

install/config/crowdsec/traefik_config.yml

@@ -86,6 +86,8 @@ entryPoints:
     http:
       tls:
         certResolver: "letsencrypt"
+      middlewares:
+        - crowdsec@file
       encodedCharacters:
         allowEncodedSlash: true
         allowEncodedQuestionMark: true

install/crowdsec.go

@@ -6,12 +6,13 @@ import (
 	"log"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 
 	"gopkg.in/yaml.v3"
 )
 
-func installCrowdsec(config Config) error {
+func installCrowdsec(config Config, installDir string) error {
 
 	if err := stopContainers(config.InstallationContainerType); err != nil {
 		return fmt.Errorf("failed to stop containers: %v", err)
@@ -40,6 +41,8 @@ func installCrowdsec(config Config) error {
 		os.Exit(1)
 	}
 
+	setupTraefikLogRotate(installDir)
+
 	if err := copyDockerService("config/crowdsec/docker-compose.yml", "docker-compose.yml", "crowdsec"); err != nil {
 		fmt.Printf("Error copying docker service: %v\n", err)
 		os.Exit(1)
@@ -208,3 +211,69 @@ func CheckAndAddCrowdsecDependency(composePath string) error {
 	fmt.Println("Added dependency of crowdsec to traefik")
 	return nil
 }
+
+// setupTraefikLogRotate writes a logrotate config for the Traefik access log
+// that CrowdSec depends on. This is only needed when CrowdSec is installed
+// because the default Pangolin install does not enable Traefik access logs.
+//
+// copytruncate is used so Traefik does not need to be restarted or sent a
+// signal after rotation — it keeps writing to the same file descriptor while
+// the rotated copy is made and the original is truncated in place.
+func setupTraefikLogRotate(installDir string) {
+	const logrotateDir = "/etc/logrotate.d"
+	const logrotateFile = "/etc/logrotate.d/pangolin-traefik"
+
+	logPath := filepath.Join(installDir, "config/traefik/logs/access.log")
+
+	if os.Geteuid() != 0 {
+		fmt.Println("\n[logrotate] Skipping automatic logrotate setup: not running as root.")
+		fmt.Println("[logrotate] To prevent unbounded growth of the Traefik access log used by CrowdSec,")
+		fmt.Println("[logrotate] create the file /etc/logrotate.d/pangolin-traefik manually with:")
+		printLogrotateConfig(logPath)
+		return
+	}
+
+	config := fmt.Sprintf(`# Logrotate config for Traefik access logs used by CrowdSec.
+# Generated by the Pangolin installer. Safe to edit.
+%s {
+    daily
+    rotate 7
+    compress
+    delaycompress
+    missingok
+    notifempty
+    copytruncate
+}
+`, logPath)
+
+	if err := os.MkdirAll(logrotateDir, 0755); err != nil {
+		fmt.Printf("[logrotate] Warning: could not create %s: %v\n", logrotateDir, err)
+		return
+	}
+
+	if err := os.WriteFile(logrotateFile, []byte(config), 0644); err != nil {
+		fmt.Printf("[logrotate] Warning: could not write %s: %v\n", logrotateFile, err)
+		fmt.Println("[logrotate] Set it up manually:")
+		printLogrotateConfig(logPath)
+		return
+	}
+
+	fmt.Printf("[logrotate] Wrote logrotate config to %s\n", logrotateFile)
+	fmt.Println("[logrotate] Traefik access logs will be rotated daily, keeping 7 compressed copies.")
+}
+
+// printLogrotateConfig prints a logrotate config block to stdout so users can
+// set it up manually when the installer cannot write to /etc.
+func printLogrotateConfig(logPath string) {
+	fmt.Printf(`
+  %s {
+      daily
+      rotate 7
+      compress
+      delaycompress
+      missingok
+      notifempty
+      copytruncate
+  }
+`, logPath)
+}

install/go.mod

@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.41.0
+	golang.org/x/term v0.43.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/sys v0.44.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )

install/go.sum

@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

install/main.go

@@ -4,6 +4,7 @@ import (
 	"crypto/rand"
 	"embed"
 	"encoding/base64"
+	"flag"
 	"fmt"
 	"io"
 	"io/fs"
@@ -53,7 +54,7 @@ type Config struct {
 	InstallGerbil             bool
 	TraefikBouncerKey         string
 	DoCrowdsecInstall         bool
-	EnableGeoblocking         bool
+	EnableMaxMind             bool
 	Secret                    string
 	IsEnterprise              bool
 }
@@ -68,6 +69,9 @@ const (
 
 func main() {
 
+	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
+	flag.Parse()
+
 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking
 
 	fmt.Println("Welcome to the Pangolin installer!")
@@ -119,11 +123,11 @@ func main() {
 
 		fmt.Println("\nConfiguration files created successfully!")
 
-		// Download MaxMind database if requested
-		if config.EnableGeoblocking {
-			fmt.Println("\n=== Downloading MaxMind Database ===")
+		// Download MaxMind Country / ASN database if requested
+		if config.EnableMaxMind {
+			fmt.Println("\n=== Downloading MaxMind Country and ASN Databases ===")
 			if err := downloadMaxMindDatabase(); err != nil {
-				fmt.Printf("Error downloading MaxMind database: %v\n", err)
+				fmt.Printf("Error downloading MaxMind databases: %v\n", err)
 				fmt.Println("You can download it manually later if needed.")
 			}
 		}
@@ -184,15 +188,15 @@ func main() {
 		fmt.Println("\n=== MaxMind Database Update ===")
 		if _, err := os.Stat("config/GeoLite2-Country.mmdb"); err == nil {
 			fmt.Println("MaxMind GeoLite2 Country database found.")
-			if readBool("Would you like to update the MaxMind database to the latest version?", false) {
+			if readBool("Would you like to update the MaxMind databases (Country and ASN) to the latest version?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error updating MaxMind database: %v\n", err)
 					fmt.Println("You can try updating it manually later if needed.")
 				}
 			}
 		} else {
-			fmt.Println("MaxMind GeoLite2 Country database not found.")
-			if readBool("Would you like to download the MaxMind GeoLite2 database for geoblocking functionality?", false) {
+			fmt.Println("MaxMind GeoLite2 Country and ASN databases not found.")
+			if readBool("Would you like to download the MaxMind GeoLite2 databases for blocking functionality?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error downloading MaxMind database: %v\n", err)
 					fmt.Println("You can try downloading it manually later if needed.")
@@ -200,13 +204,15 @@ func main() {
 				// Now you need to update your config file accordingly to enable geoblocking
 				fmt.Print("Please remember to update your config/config.yml file to enable geoblocking! \n\n")
 				// add   maxmind_db_path: "./config/GeoLite2-Country.mmdb" under server
-				fmt.Println("Add the following line under the 'server' section:")
+				// add   maxmind_asn_path: "./config/GeoLite2-ASN.mmdb" under server
+				fmt.Println("Add the following lines under the 'server' section:")
 				fmt.Println("  maxmind_db_path: \"./config/GeoLite2-Country.mmdb\"")
+				fmt.Println("  maxmind_asn_path: \"./config/GeoLite2-ASN.mmdb\"")
 			}
 		}
 	}
 
-	if !checkIsCrowdsecInstalledInCompose() {
+	if *crowdsecFlag && !checkIsCrowdsecInstalledInCompose() {
 		fmt.Println("\n=== CrowdSec Install ===")
 		// check if crowdsec is installed
 		if readBool("Would you like to install CrowdSec?", false) {
@@ -259,7 +265,7 @@ func main() {
 				}
 
 				config.DoCrowdsecInstall = true
-				err := installCrowdsec(config)
+				err := installCrowdsec(config, installDir)
 				if err != nil {
 					fmt.Printf("Error installing CrowdSec: %v\n", err)
 					return
@@ -523,7 +529,7 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Advanced Configuration ===")
 
 	config.EnableIPv6 = readBool("Is your server IPv6 capable?", true)
-	config.EnableGeoblocking = readBool("Do you want to download the MaxMind GeoLite2 database for geoblocking functionality?", true)
+	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ADN databases for blocking functionality?", true)
 
 	if config.DashboardDomain == "" {
 		fmt.Println("Error: Dashboard Domain name is required")
@@ -776,29 +782,42 @@ func checkPortsAvailable(port int) error {
 }
 
 func downloadMaxMindDatabase() error {
-	fmt.Println("Downloading MaxMind GeoLite2 Country database...")
+	fmt.Println("Downloading MaxMind GeoLite2 Country and ASN databases...")
 
-	// Download the GeoLite2 Country database
+	// Download the GeoLite2 Country databases
 	if err := run("curl", "-L", "-o", "GeoLite2-Country.tar.gz",
 		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to download GeoLite2 database: %v", err)
+		return fmt.Errorf("failed to download GeoLite2 Country database: %v", err)
+	}
+	if err := run("curl", "-L", "-o", "GeoLite2-ASN.tar.gz",
+		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-ASN.tar.gz"); err != nil {
+		return fmt.Errorf("failed to download GeoLite2 ASN database: %v", err)
 	}
 
-	// Extract the database
+	// Extract the Country database
 	if err := run("tar", "-xzf", "GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to extract GeoLite2 database: %v", err)
+		return fmt.Errorf("failed to extract GeoLite2 Country database: %v", err)
+	}
+	if err := run("tar", "-xzf", "GeoLite2-ASN.tar.gz"); err != nil {
+		return fmt.Errorf("failed to extract GeoLite2 ASN database: %v", err)
 	}
 
 	// Find the .mmdb file and move it to the config directory
 	if err := run("bash", "-c", "mv GeoLite2-Country_*/GeoLite2-Country.mmdb config/"); err != nil {
-		return fmt.Errorf("failed to move GeoLite2 database to config directory: %v", err)
+		return fmt.Errorf("failed to move GeoLite2 Country database to config directory: %v", err)
+	}
+	if err := run("bash", "-c", "mv GeoLite2-ASN_*/GeoLite2-ASN.mmdb config/"); err != nil {
+		return fmt.Errorf("failed to move GeoLite2 ASN database to config directory: %v", err)
 	}
 
 	// Clean up the downloaded files
-	if err := run("rm", "-rf", "GeoLite2-Country.tar.gz", "GeoLite2-Country_*"); err != nil {
-		fmt.Printf("Warning: failed to clean up temporary files: %v\n", err)
+	if err := run("sh", "-c", "rm -rf GeoLite2-Country.tar.gz GeoLite2-Country_*"); err != nil {
+		fmt.Printf("Warning: failed to clean up temporary country files: %v\n", err)
+	}
+	if err := run("sh", "-c", "rm -rf GeoLite2-ASN.tar.gz GeoLite2-ASN_*"); err != nil {
+		fmt.Printf("Warning: failed to clean up temporary ASN files: %v\n", err)
 	}
 
-	fmt.Println("MaxMind GeoLite2 Country database downloaded successfully!")
+	fmt.Println("MaxMind GeoLite2 Country and ASN database downloaded successfully!")
 	return nil
 }

license.py

@@ -1,115 +0,0 @@
-import os
-import sys
-
-# --- Configuration ---
-# The header text to be added to the files.
-HEADER_TEXT = """/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-"""
-
-def should_add_header(file_path):
-    """
-    Checks if a file should receive the commercial license header.
-    Returns True if 'private' is in the path or file content.
-    """
-    # Check if 'private' is in the file path (case-insensitive)
-    if 'server/private' in file_path.lower():
-        return True
-
-    # Check if 'private' is in the file content (case-insensitive)
-    # try:
-    #     with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
-    #         content = f.read()
-    #         if 'private' in content.lower():
-    #             return True
-    # except Exception as e:
-    #     print(f"Could not read file {file_path}: {e}")
-
-    return False
-
-def process_directory(root_dir):
-    """
-    Recursively scans a directory and adds headers to qualifying .ts or .tsx files,
-    skipping any 'node_modules' directories.
-    """
-    print(f"Scanning directory: {root_dir}")
-    files_processed = 0
-    headers_added = 0
-
-    for root, dirs, files in os.walk(root_dir):
-        # --- MODIFICATION ---
-        # Exclude 'node_modules' directories from the scan to improve performance.
-        if 'node_modules' in dirs:
-            dirs.remove('node_modules')
-
-        for file in files:
-            if file.endswith('.ts') or file.endswith('.tsx'):
-                file_path = os.path.join(root, file)
-                files_processed += 1
-
-                try:
-                    with open(file_path, 'r+', encoding='utf-8') as f:
-                        original_content = f.read()
-                        has_header = original_content.startswith(HEADER_TEXT.strip())
-                        
-                        if should_add_header(file_path):
-                            # Add header only if it's not already there
-                            if not has_header:
-                                f.seek(0, 0) # Go to the beginning of the file
-                                f.write(HEADER_TEXT.strip() + '\n\n' + original_content)
-                                print(f"Added header to: {file_path}")
-                                headers_added += 1
-                            else:
-                                print(f"Header already exists in: {file_path}")
-                        else:
-                            # Remove header if it exists but shouldn't be there
-                            if has_header:
-                                # Find the end of the header and remove it (including following newlines)
-                                header_with_newlines = HEADER_TEXT.strip() + '\n\n'
-                                if original_content.startswith(header_with_newlines):
-                                    content_without_header = original_content[len(header_with_newlines):]
-                                else:
-                                    # Handle case where there might be different newline patterns
-                                    header_end = len(HEADER_TEXT.strip())
-                                    # Skip any newlines after the header
-                                    while header_end < len(original_content) and original_content[header_end] in '\n\r':
-                                        header_end += 1
-                                    content_without_header = original_content[header_end:]
-                                
-                                f.seek(0)
-                                f.write(content_without_header)
-                                f.truncate()
-                                print(f"Removed header from: {file_path}")
-                                headers_added += 1  # Reusing counter for modifications
-
-                except Exception as e:
-                    print(f"Error processing file {file_path}: {e}")
-
-    print("\n--- Scan Complete ---")
-    print(f"Total .ts or .tsx files found: {files_processed}")
-    print(f"Files modified (headers added/removed): {headers_added}")
-
-
-if __name__ == "__main__":
-    # Get the target directory from the command line arguments.
-    # If no directory is provided, it uses the current directory ('.').
-    if len(sys.argv) > 1:
-        target_directory = sys.argv[1]
-    else:
-        target_directory = '.' # Default to current directory
-
-    if not os.path.isdir(target_directory):
-        print(f"Error: Directory '{target_directory}' not found.")
-        sys.exit(1)
-
-    process_directory(os.path.abspath(target_directory))

license_header_checker.py

@@ -0,0 +1,137 @@
+import os
+import sys
+
+# --- Configuration ---
+# The header text to be added to the files.
+HEADER_TEXT = """/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+"""
+
+HEADER_NORMALIZED = HEADER_TEXT.strip()
+
+
+def extract_leading_block_comment(content):
+    """
+    If the file content begins with a /* ... */ block comment, return the
+    full text of that comment (including the delimiters) and the index at
+    which the rest of the file starts (after any trailing newlines).
+    Returns (None, 0) when no such comment is found.
+    """
+    stripped = content.lstrip()
+    if not stripped.startswith('/*'):
+        return None, 0
+
+    # Account for any leading whitespace before the comment
+    comment_start = content.index('/*')
+    end_marker = content.find('*/', comment_start + 2)
+    if end_marker == -1:
+        return None, 0
+
+    comment_end = end_marker + 2  # position just after '*/'
+    comment_text = content[comment_start:comment_end].strip()
+
+    # Advance past any whitespace / newlines that follow the closing */
+    rest_start = comment_end
+    while rest_start < len(content) and content[rest_start] in '\n\r':
+        rest_start += 1
+
+    return comment_text, rest_start
+
+
+def should_add_header(file_path):
+    """
+    Checks if a file should receive the commercial license header.
+    Returns True if 'server/private' is in the path.
+    """
+    if 'server/private' in file_path.lower():
+        return True
+
+    return False
+
+
+def process_directory(root_dir):
+    """
+    Recursively scans a directory and adds/replaces/removes headers in
+    qualifying .ts or .tsx files, skipping any 'node_modules' directories.
+    """
+    print(f"Scanning directory: {root_dir}")
+    files_processed = 0
+    files_modified = 0
+
+    for root, dirs, files in os.walk(root_dir):
+        # Exclude 'node_modules' directories from the scan.
+        if 'node_modules' in dirs:
+            dirs.remove('node_modules')
+
+        for file in files:
+            if not (file.endswith('.ts') or file.endswith('.tsx')):
+                continue
+
+            file_path = os.path.join(root, file)
+            files_processed += 1
+
+            try:
+                with open(file_path, 'r', encoding='utf-8') as f:
+                    original_content = f.read()
+
+                existing_comment, body_start = extract_leading_block_comment(
+                    original_content
+                )
+                has_any_header = existing_comment is not None
+                has_correct_header = existing_comment == HEADER_NORMALIZED
+
+                body = original_content[body_start:] if has_any_header else original_content
+
+                if should_add_header(file_path):
+                    if has_correct_header:
+                        print(f"Header up-to-date:  {file_path}")
+                    else:
+                        # Either no header exists or the header is outdated - write
+                        # the correct one.
+                        action = "Replaced header in" if has_any_header else "Added header to"
+                        new_content = HEADER_NORMALIZED + '\n\n' + body
+                        with open(file_path, 'w', encoding='utf-8') as f:
+                            f.write(new_content)
+                        print(f"{action}: {file_path}")
+                        files_modified += 1
+                else:
+                    if has_any_header:
+                        # Remove the header - it shouldn't be here.
+                        with open(file_path, 'w', encoding='utf-8') as f:
+                            f.write(body)
+                        print(f"Removed header from: {file_path}")
+                        files_modified += 1
+                    else:
+                        print(f"No header needed:   {file_path}")
+
+            except Exception as e:
+                print(f"Error processing file {file_path}: {e}")
+
+    print("\n--- Scan Complete ---")
+    print(f"Total .ts or .tsx files found:          {files_processed}")
+    print(f"Files modified (added/replaced/removed): {files_modified}")
+
+
+if __name__ == "__main__":
+    # Get the target directory from the command line arguments.
+    # If no directory is provided, it uses the current directory ('.').
+    if len(sys.argv) > 1:
+        target_directory = sys.argv[1]
+    else:
+        target_directory = '.'  # Default to current directory
+
+    if not os.path.isdir(target_directory):
+        print(f"Error: Directory '{target_directory}' not found.")
+        sys.exit(1)
+
+    process_directory(os.path.abspath(target_directory))

messages/cs-CZ.json

@@ -1,4 +1,8 @@
 {
+    "contactSalesEnable": "Obraťte se na prodejce, aby tuto funkci povolil.",
+    "contactSalesBookDemo": "Zarezervovat demo",
+    "contactSalesOr": "nebo",
+    "contactSalesContactUs": "kontaktujte nás",
     "setupCreate": "Vytvořte organizaci, stránku a zdroje",
     "headerAuthCompatibilityInfo": "Povolte toto, aby vyvolalo odpověď 401 Neoprávněné, když chybí autentizační token. Toto je potřeba pro prohlížeče nebo specifické HTTP knihovny, které neposílají přihlašovací údaje bez výzvy serveru.",
     "headerAuthCompatibility": "Rozšířená kompatibilita",
@@ -19,6 +23,18 @@
     "componentsInvalidKey": "Byly nalezeny neplatné nebo propadlé licenční klíče. Pokud chcete nadále používat všechny funkce, postupujte podle licenčních podmínek.",
     "dismiss": "Zavřít",
     "subscriptionViolationMessage": "Jste za hranicemi vašeho aktuálního plánu. Opravte problém odstraněním webů, uživatelů nebo jiných zdrojů, abyste zůstali ve vašem tarifu.",
+    "trialBannerMessage": "Vaše zkušební verze vyprší za {countdown}. Pro udržení přístupu upgraduje.",
+    "trialBannerExpired": "Vaše zkušební verze vypršela. Upgradujte nyní pro obnovu přístupu.",
+    "billingTrialBannerTitle": "Aktivní zkušební verze",
+    "billingTrialBannerDescription": "Právě používáte zkušební verzi na úrovni business. Po skončení zkušební verze se váš účet automaticky vrátí k funkcím a limitům úrovně Basic. Upgradujte kdykoli pro zachování přístupu k funkcím vašeho aktuálního plánu.",
+    "billingTrialBannerUpgrade": "Upgradovat nyní",
+    "billingTrialBadge": "Zkušební verze",
+    "trialActive": "Zkušební verze je aktivní",
+    "trialExpired": "Zkušební verze vypršela",
+    "trialHasEnded": "Vaše zkušební verze skončila.",
+    "trialDaysRemaining": "{count, plural, one {# den zbývá} few {# dny zbývají} many {# dní zbývá} other {# dny zbývají}}",
+    "trialDaysLeftShort": "Zbývá {days} d ve zkušební verzi",
+    "trialGoToBilling": "Přejděte na fakturační stránku",
     "subscriptionViolationViewBilling": "Zobrazit fakturaci",
     "componentsLicenseViolation": "Porušení licenčních podmínek: Tento server používá {usedSites} stránek, což překračuje limit {maxSites} licencovaných stránek. Pokud chcete nadále používat všechny funkce, postupujte podle licenčních podmínek.",
     "componentsSupporterMessage": "Děkujeme, že podporujete Pangolin jako {tier}!",
@@ -81,6 +97,8 @@
     "siteConfirmCopy": "Konfiguraci jsem zkopíroval",
     "searchSitesProgress": "Hledat lokality...",
     "siteAdd": "Přidat lokalitu",
+    "sitesTableViewPublicResources": "Zobrazit veřejné zdroje",
+    "sitesTableViewPrivateResources": "Zobrazit soukromé zdroje",
     "siteInstallNewt": "Nainstalovat Newt",
     "siteInstallNewtDescription": "Spustit Newt na vašem systému",
     "WgConfiguration": "Konfigurace WireGuard",
@@ -98,6 +116,21 @@
     "siteUpdatedDescription": "Lokalita byla upravena.",
     "siteGeneralDescription": "Upravte obecná nastavení pro tuto lokalitu",
     "siteSettingDescription": "Konfigurace nastavení na webu",
+    "siteResourcesTab": "Zdroje",
+    "siteResourcesNoneOnSite": "Tento web zatím nemá veřejné ani soukromé zdroje.",
+    "siteResourcesSectionPublic": "Veřejné zdroje",
+    "siteResourcesSectionPrivate": "Soukromé zdroje",
+    "siteResourcesSectionPublicDescription": "Zdroje zpřístupněné externě prostřednictvím domén nebo portů.",
+    "siteResourcesSectionPrivateDescription": "Zdroje dostupné ve vaší soukromé síti prostřednictvím webu.",
+    "siteResourcesViewAllPublic": "Zobrazit všechny zdroje",
+    "siteResourcesViewAllPrivate": "Zobrazit všechny zdroje",
+    "siteResourcesDialogDescription": "Přehled veřejných a soukromých zdrojů spojených s tímto webem.",
+    "siteResourcesShowMore": "Ukázat více",
+    "siteResourcesPermissionDenied": "Nemáte oprávnění k vypsání těchto zdrojů.",
+    "siteResourcesEmptyPublic": "Žádné veřejné zdroje ještě necílí na tento web.",
+    "siteResourcesEmptyPrivate": "Žádné soukromé zdroje ještě nejsou spojené s tímto webem.",
+    "siteResourcesHowToAccess": "Jak získat přístup",
+    "siteResourcesTargetsOnSite": "Cíle na tomto webu",
     "siteSetting": "Nastavení {siteName}",
     "siteNewtTunnel": "Novinka (doporučeno)",
     "siteNewtTunnelDescription": "Nejjednodušší způsob, jak vytvořit vstupní bod do jakékoli sítě. Žádné další nastavení.",
@@ -123,6 +156,10 @@
     "shareErrorDeleteMessage": "Došlo k chybě při odstraňování odkazu",
     "shareDeleted": "Odkaz odstraněn",
     "shareDeletedDescription": "Odkaz byl odstraněn",
+    "shareDelete": "Smazat odkaz ke sdílení",
+    "shareDeleteConfirm": "Potvrdit smazání odkazu ke sdílení",
+    "shareQuestionRemove": "Jste si jisti, že chcete smazat tento odkaz ke sdílení?",
+    "shareMessageRemove": "Jakmile bude smazán, odkaz přestane fungovat a všichni, kdo jej používají, ztratí přístup k prostředku.",
     "shareTokenDescription": "Přístupový token může být předán dvěma způsoby: jako parametr dotazu nebo v záhlaví požadavku. Tyto údaje musí být předány klientovi na každé žádosti o ověřený přístup.",
     "accessToken": "Přístupový token",
     "usageExamples": "Příklady použití",
@@ -139,6 +176,7 @@
     "shareErrorCreateDescription": "Při vytváření odkazu došlo k chybě",
     "shareCreateDescription": "Kdokoliv s tímto odkazem může přistupovat ke zdroji",
     "shareTitleOptional": "Název (volitelné)",
+    "sharePathOptional": "Path (optional)",
     "expireIn": "Platnost vyprší za",
     "neverExpire": "Nikdy nevyprší",
     "shareExpireDescription": "Doba platnosti určuje, jak dlouho bude odkaz použitelný a bude poskytovat přístup ke zdroji. Po této době odkaz již nebude fungovat a uživatelé kteří tento odkaz používali ztratí přístup ke zdroji.",
@@ -171,11 +209,33 @@
     "resourcesSearch": "Prohledat zdroje...",
     "resourceAdd": "Přidat zdroj",
     "resourceErrorDelte": "Chyba při odstraňování zdroje",
+    "resourcePoliciesTitle": "Manage Resource Policies",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
+    "resourcePoliciesAttachedResources": "{count} resource(s)",
+    "resourcePoliciesAttachedResourcesEmpty": "no resources",
+    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
+    "resourcePoliciesSearch": "Search policies...",
+    "resourcePoliciesAdd": "Add Policy",
+    "resourcePoliciesDefaultBadgeText": "Default policy",
+    "resourcePoliciesCreate": "Create Resource Policy",
+    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
+    "resourcePolicyName": "Policy Name",
+    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
+    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
+    "resourcePoliciesSeeAll": "See All Policies",
+    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
+    "resourcePolicyOtpEmailAdd": "Add OTP emails",
+    "resourcePolicyRulesAdd": "Add Rules",
+    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
+    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
+    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Autentifikace",
     "protected": "Chráněno",
     "notProtected": "Nechráněno",
     "resourceMessageRemove": "Jakmile zdroj odstraníte, nebude dostupný. Všechny související služby a cíle budou také odstraněny.",
     "resourceQuestionRemove": "Jste si jisti, že chcete odstranit zdroj z organizace?",
+    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
+    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "Zdroj HTTPS",
     "resourceHTTPDescription": "Proxy požadavky přes HTTPS pomocí plně kvalifikovaného názvu domény.",
     "resourceRaw": "Surový TCP/UDP zdroj",
@@ -183,8 +243,9 @@
     "resourceRawDescriptionCloud": "Proxy požadavky na syrové TCP/UDP pomocí čísla portu. Vyžaduje připojení stránek ke vzdálenému uzlu.",
     "resourceCreate": "Vytvořit zdroj",
     "resourceCreateDescription": "Postupujte podle níže uvedených kroků, abyste vytvořili a připojili nový zdroj",
+    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Zobrazit všechny zdroje",
-    "resourceInfo": "Informace o zdroji",
+    "resourceCreateGeneral": "General",
     "resourceNameDescription": "Toto je zobrazovaný název zdroje.",
     "siteSelect": "Vybrat lokalitu",
     "siteSearch": "Hledat lokalitu",
@@ -194,12 +255,15 @@
     "noCountryFound": "Nebyla nalezena žádná země.",
     "siteSelectionDescription": "Tato lokalita poskytne připojení k cíli.",
     "resourceType": "Typ zdroje",
-    "resourceTypeDescription": "Určete, jak přistupovat ke zdroji",
+    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
+    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
     "resourceHTTPSSettings": "Nastavení HTTPS",
     "resourceHTTPSSettingsDescription": "Nakonfigurujte, jak bude dokument přístupný přes HTTPS",
+    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Typ domény",
     "subdomain": "Subdoména",
     "baseDomain": "Základní doména",
+    "configure": "Configure",
     "subdomnainDescription": "Subdoména, kde bude zdroj přístupný.",
     "resourceRawSettings": "Nastavení TCP/UDP",
     "resourceRawSettingsDescription": "Nakonfigurujte, jak bude dokument přístupný přes TCP/UDP",
@@ -216,8 +280,27 @@
     "resourceLearnRaw": "Naučte se konfigurovat zdroje TCP/UDP",
     "resourceBack": "Zpět na zdroje",
     "resourceGoTo": "Přejít na dokument",
+    "resourcePolicyDelete": "Delete Resource Policy",
+    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Odstranit dokument",
     "resourceDeleteConfirm": "Potvrdit odstranění dokumentu",
+    "labelDelete": "Delete Label",
+    "labelAdd": "Add Label",
+    "labelCreateSuccessMessage": "Label Created Successfully",
+    "labelEditSuccessMessage": "Label Modified Successfully",
+    "labelNameField": "Label Name",
+    "labelColorField": "Label Color",
+    "labelPlaceholder": "Ex: homelab",
+    "labelCreate": "Create Label",
+    "createLabelDialogTitle": "Create Label",
+    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
+    "labelEdit": "Edit Label",
+    "editLabelDialogTitle": "Update Label",
+    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
+    "labelDeleteConfirm": "Confirm Delete Label",
+    "labelErrorDelete": "Failed to delete label",
+    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
+    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Viditelnost",
     "enabled": "Povoleno",
     "disabled": "Zakázáno",
@@ -228,6 +311,8 @@
     "rules": "Pravidla",
     "resourceSettingDescription": "Konfigurace nastavení na zdroji",
     "resourceSetting": "Nastavení {resourceName}",
+    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
+    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Obejít Auth",
     "alwaysDeny": "Blokovat přístup",
     "passToAuth": "Předat k ověření",
@@ -267,8 +352,11 @@
     "orgMissing": "Chybí ID organizace",
     "orgMissingMessage": "Nelze obnovit pozvánku bez ID organizace.",
     "accessUsersManage": "Spravovat uživatele",
+    "accessUserManage": "Spravovat uživatele",
     "accessUsersDescription": "Pozvat a spravovat uživatele s přístupem k této organizaci",
     "accessUsersSearch": "Hledat uživatele...",
+    "accessUsersRoleFilterCount": "{count, plural, one {# role} few {# role} many {# rolí} other {# roli}}",
+    "accessUsersRoleFilterClear": "Vymazat filtry rolí",
     "accessUserCreate": "Vytvořit uživatele",
     "accessUserRemove": "Odstranit uživatele",
     "username": "Uživatelské jméno",
@@ -371,10 +459,10 @@
     "provisioningKeysUpdated": "Zajišťovací klíč byl aktualizován",
     "provisioningKeysUpdatedDescription": "Vaše změny byly uloženy.",
     "provisioningKeysBannerTitle": "Klíče pro poskytování webu",
-    "provisioningKeysBannerDescription": "Vygenerujte konfigurační klíč a používejte jej pomocí nového konektoru k automatickému vytváření stránek při prvním startu – není třeba nastavovat samostatné přihlašovací údaje pro každý web.",
+    "provisioningKeysBannerDescription": "Vygenerujte klíč pro zřízení a použijte ho s Newt konektorem k automatickému vytvoření stránek při prvním spuštění – není potřeba nastavit samostatné přihlašovací údaje pro každou stránku.",
     "provisioningKeysBannerButtonText": "Zjistit více",
     "pendingSitesBannerTitle": "Nevyřízené weby",
-    "pendingSitesBannerDescription": "Zde se zobrazují stránky, které se připojují pomocí doplňovacího klíče. Schválte každý web předtím, než bude aktivní, a získejte přístup k vašim zdrojům.",
+    "pendingSitesBannerDescription": "Stránky, které se připojují pomocí klíče pro zřízení, se zde objeví ke kontrole.",
     "pendingSitesBannerButtonText": "Zjistit více",
     "apiKeysSettings": "Nastavení {apiKeyName}",
     "userTitle": "Spravovat všechny uživatele",
@@ -405,6 +493,10 @@
     "licenseErrorKeyActivate": "Nepodařilo se aktivovat licenční klíč",
     "licenseErrorKeyActivateDescription": "Došlo k chybě při aktivaci licenčního klíče.",
     "licenseAbout": "O licencích",
+    "licenseBannerTitle": "Aktivovat vaši firemní licenci",
+    "licenseBannerDescription": "Odemkněte firemní funkce pro vaši samohostovanou instanci Pangolin. Zakupte si licenční klíč pro aktivaci prémiových možností a poté jej přidejte níže.",
+    "licenseBannerGetLicense": "Zakoupit licenci",
+    "licenseBannerViewDocs": "Zobrazit dokumentaci",
     "communityEdition": "Komunitní edice",
     "licenseAboutDescription": "To je pro obchodní a podnikové uživatele, kteří používají Pangolin v komerčním prostředí. Pokud používáte Pangolin pro osobní použití, můžete tuto sekci ignorovat.",
     "licenseKeyActivated": "Licenční klíč aktivován",
@@ -483,6 +575,12 @@
     "userMessageOrgRemove": "Po odstranění tohoto uživatele již nebude mít přístup k organizaci. Vždy je můžete znovu pozvat později, ale budou muset pozvání znovu přijmout.",
     "userRemoveOrgConfirm": "Potvrdit odebrání uživatele",
     "userRemoveOrg": "Odebrat uživatele z organizace",
+    "userQuestionOrgRemoveSelf": "Jste si jisti, že se chcete odstranit z této organizace?",
+    "userMessageOrgRemoveSelf": "Okamžitě ztratíte přístup. Administrátor vás může později znovu pozvat, ale budete muset přijmout nové pozvání.",
+    "userRemoveOrgConfirmSelf": "Potvrdit odstranění sebe",
+    "userRemoveOrgSelf": "Odstranit se z organizace",
+    "userRemoveOrgSelfWarning": "Okamžitě ztratíte přístup k této organizaci.",
+    "userRemoveOrgConfirmPhraseSelf": "ODSTRANIT SE Z ORGANIZACE",
     "users": "Uživatelé",
     "accessRoleMember": "Člen",
     "accessRoleOwner": "Vlastník",
@@ -491,6 +589,11 @@
     "emailInvalid": "Neplatná e-mailová adresa",
     "inviteValidityDuration": "Zvolte prosím dobu trvání",
     "accessRoleSelectPlease": "Vyberte prosím roli",
+    "removeOwnAdminRoleConfirmTitle": "Odebrat přístup správce?",
+    "removeOwnAdminRoleConfirmDescription": "Po uložení již nebudete mít oprávnění správce v této organizaci. Další administrátor vám může přístup obnovit, pokud bude potřeba.",
+    "removeOwnAdminRoleConfirmButton": "Odebrat mé administrátorské oprávnění",
+    "removeOwnAdminRoleConfirmPhrase": "ODEBRAT MÉ ADMINISTRÁTORSKÉ OPRÁVNĚNÍ",
+    "ownerMustRetainAdminRole": "Vlastník organizace musí zachovat alespoň jednu roli správce.",
     "usernameRequired": "Uživatelské jméno je povinné",
     "idpSelectPlease": "Vyberte poskytovatele identity",
     "idpGenericOidc": "Generic OAuth2/OIDC provider.",
@@ -575,7 +678,7 @@
     "createdAt": "Vytvořeno v",
     "proxyErrorInvalidHeader": "Neplatná hodnota hlavičky hostitele. Použijte formát názvu domény, nebo uložte prázdné pro zrušení vlastního hlavičky hostitele.",
     "proxyErrorTls": "Neplatné jméno TLS serveru. Použijte formát doménového jména nebo uložte prázdné pro odstranění názvu TLS serveru.",
-    "proxyEnableSSL": "Povolit SSL",
+    "proxyEnableSSL": "Enable TLS",
     "proxyEnableSSLDescription": "Povolit šifrování SSL/TLS pro zabezpečená připojení HTTPS k cílům.",
     "target": "Target",
     "configureTarget": "Konfigurace cílů",
@@ -618,12 +721,15 @@
     "targetNoOneDescription": "Přidáním více než jednoho cíle se umožní vyvážení zatížení.",
     "targetsSubmit": "Uložit cíle",
     "addTarget": "Add Target",
+    "proxyMultiSiteRoundRobinNodeHelp": "Round robin routing nebude fungovat mezi lokalitami, které nejsou připojeny ke stejnému uzlu, ale failover bude fungovat.",
     "targetErrorInvalidIp": "Neplatná IP adresa",
     "targetErrorInvalidIpDescription": "Zadejte prosím platnou IP adresu nebo název hostitele",
     "targetErrorInvalidPort": "Neplatný port",
     "targetErrorInvalidPortDescription": "Zadejte platné číslo portu",
     "targetErrorNoSite": "Není vybrán žádný web",
     "targetErrorNoSiteDescription": "Vyberte prosím web pro cíl",
+    "targetTargetsCleared": "Cíle vymazány",
+    "targetTargetsClearedDescription": "Všechny cíle byly odstraněny z tohoto zdroje",
     "targetCreated": "Cíl byl vytvořen",
     "targetCreatedDescription": "Cíl byl úspěšně vytvořen",
     "targetErrorCreate": "Nepodařilo se vytvořit cíl",
@@ -689,6 +795,16 @@
     "rulesNoOne": "Žádná pravidla. Přidejte pravidlo pomocí formuláře.",
     "rulesOrder": "Pravidla jsou hodnocena podle priority vzestupně.",
     "rulesSubmit": "Uložit pravidla",
+    "policyErrorCreate": "Error creating policy",
+    "policyErrorCreateDescription": "An error occurred when creating the policy",
+    "policyErrorCreateMessageDescription": "An unexpected error occurred",
+    "policyErrorUpdate": "Error updating policy",
+    "policyErrorUpdateDescription": "An error occurred when updating the policy",
+    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
+    "policyCreatedSuccess": "Resource policy succesfully created",
+    "policyUpdatedSuccess": "Resource policy succesfully updated",
+    "authMethodsSave": "Save auth methods",
+    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Chyba při vytváření zdroje",
     "resourceErrorCreateDescription": "Při vytváření zdroje došlo k chybě",
     "resourceErrorCreateMessage": "Chyba při vytváření zdroje:",
@@ -725,6 +841,7 @@
     "newtEndpoint": "Endpoint",
     "newtId": "ID",
     "newtSecretKey": "Tajný klíč",
+    "newtVersion": "Verze",
     "architecture": "Architektura",
     "sites": "Stránky",
     "siteWgAnyClients": "K připojení použijte jakéhokoli klienta WireGuard. Budete muset řešit interní zdroje pomocí klientské IP adresy.",
@@ -751,6 +868,16 @@
     "pincodeAdd": "Přidat PIN kód",
     "pincodeRemove": "Odstranit PIN kód",
     "resourceAuthMethods": "Metody ověřování",
+    "resourcePolicyAuthMethodsEmpty": "No authentication method",
+    "resourcePolicyOtpEmpty": "No one time password",
+    "resourcePolicyReadOnly": "This policy is Read only",
+    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
+    "resourcePolicyTypeSave": "Save Resource type",
+    "resourcePolicySelect": "Select resource policy",
+    "resourcePolicySelectError": "Select a resource policy",
+    "resourcePolicyNotFound": "Policy not found",
+    "resourcePolicySearch": "Search policies",
+    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Povolit přístup ke zdroji pomocí dodatečných metod autorizace",
     "resourceAuthSettingsSave": "Úspěšně uloženo",
     "resourceAuthSettingsSaveDescription": "Nastavení ověřování bylo uloženo",
@@ -786,6 +913,12 @@
     "resourcePincodeSetupTitle": "Nastavit anonymní kód",
     "resourcePincodeSetupTitleDescription": "Nastavit pincode pro ochranu tohoto zdroje",
     "resourceRoleDescription": "Administrátoři mají vždy přístup k tomuto zdroji.",
+    "resourcePolicySelectTitle": "Resource Access Policy",
+    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
+    "resourcePolicyInline": "Inline Resource Policy",
+    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
+    "resourcePolicyShared": "Shared Resource Policy",
+    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Kontrola přístupu",
     "resourceUsersRolesDescription": "Nastavení, kteří uživatelé a role mohou navštívit tento zdroj",
     "resourceUsersRolesSubmit": "Uložit přístupové řízení",
@@ -892,6 +1025,7 @@
     "idpDisplayName": "Zobrazované jméno tohoto poskytovatele identity",
     "idpAutoProvisionUsers": "Automatická úprava uživatelů",
     "idpAutoProvisionUsersDescription": "Pokud je povoleno, uživatelé budou automaticky vytvářeni v systému při prvním přihlášení, s možností namapovat uživatele na role a organizace.",
+    "idpAutoProvisionConfigureAfterCreate": "Nastavení automatického poskytování lze nakonfigurovat, jakmile je vytvořen poskytovatel identity.",
     "licenseBadge": "PE",
     "idpType": "Typ poskytovatele",
     "idpTypeDescription": "Vyberte typ poskytovatele identity, který chcete nakonfigurovat",
@@ -943,7 +1077,7 @@
     "defaultMappingsRole": "Výchozí mapování rolí",
     "defaultMappingsRoleDescription": "Výsledek tohoto výrazu musí vrátit název role definovaný v organizaci jako řetězec.",
     "defaultMappingsOrg": "Výchozí mapování organizace",
-    "defaultMappingsOrgDescription": "Tento výraz musí vrátit org ID nebo pravdu, aby měl uživatel přístup k organizaci.",
+    "defaultMappingsOrgDescription": "Pokud je nastaven, musí tento výraz vracet ID organizace nebo pravda, aby k této organizaci měl uživatel přístup. Pokud není nastaveno, je dostačující definice mapování rolí: uživateli je umožněn přístup, pokud pro něj lze v rámci organizace vyřešit platné mapování rolí.",
     "defaultMappingsSubmit": "Uložit výchozí mapování",
     "orgPoliciesEdit": "Upravit zásady organizace",
     "org": "Organizace",
@@ -1080,6 +1214,18 @@
     "idpErrorConnectingTo": "Při připojování k {name}došlo k chybě. Obraťte se na správce.",
     "idpErrorNotFound": "IdP nenalezen",
     "inviteInvalid": "Neplatná pozvánka",
+    "labels": "Labels",
+    "orgLabelsDescription": "Manage labels in this organization.",
+    "addLabels": "Add labels",
+    "siteLabelsTab": "Labels",
+    "siteLabelsDescription": "Manage labels associated with this site.",
+    "labelsNotFound": "Labels not found",
+    "labelSearch": "Search labels",
+    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
+    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
+    "accessLabelFilterClear": "Clear label filters",
+    "selectColor": "Select color",
+    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Odkaz pro pozvání je neplatný.",
     "inviteErrorWrongUser": "Pozvat není pro tohoto uživatele",
     "inviteErrorUserNotExists": "Uživatel neexistuje. Nejprve si vytvořte účet.",
@@ -1250,6 +1396,7 @@
     "actionViewLogs": "Zobrazit logy",
     "noneSelected": "Není vybráno",
     "orgNotFound2": "Nebyly nalezeny žádné organizace.",
+    "search": "Vyhledávání…",
     "searchPlaceholder": "Hledat...",
     "emptySearchOptions": "Nebyly nalezeny žádné možnosti",
     "create": "Vytvořit",
@@ -1313,6 +1460,8 @@
     "sidebarResources": "Zdroje",
     "sidebarProxyResources": "Veřejnost",
     "sidebarClientResources": "Soukromé",
+    "sidebarPolicies": "Policies",
+    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Kontrola přístupu",
     "sidebarLogsAndAnalytics": "Logy & Analytika",
     "sidebarTeam": "Tým",
@@ -1334,12 +1483,170 @@
     "sidebarGeneral": "Spravovat",
     "sidebarLogAndAnalytics": "Log & Analytics",
     "sidebarBluePrints": "Plány",
+    "sidebarAlerting": "Upozornění",
+    "sidebarHealthChecks": "Kontroly stavu",
     "sidebarOrganization": "Organizace",
     "sidebarManagement": "Správa",
     "sidebarBillingAndLicenses": "Fakturace a licence",
     "sidebarLogsAnalytics": "Analytici",
+    "alertingTitle": "Upozornění",
+    "alertingDescription": "Definujte zdroje, spouštěče a akce pro oznámení",
+    "alertingRules": "Pravidla upozornění",
+    "alertingSearchRules": "Hledat pravidla…",
+    "alertingAddRule": "Vytvořit pravidlo",
+    "alertingColumnSource": "Zdroj",
+    "alertingColumnTrigger": "Spouštěč",
+    "alertingColumnActions": "Akce",
+    "alertingColumnEnabled": "Povoleno",
+    "alertingDeleteQuestion": "Potvrďte, prosím, zda chcete toto pravidlo upozornění smazat.",
+    "alertingDeleteRule": "Smazat pravidlo upozornění",
+    "alertingRuleDeleted": "Pravidlo upozornění bylo smazáno",
+    "alertingRuleSaved": "Pravidlo upozornění bylo uloženo",
+    "alertingRuleSavedCreatedDescription": "Vaše nové pravidlo upozornění bylo vytvořeno. Můžete ho dál upravovat na této stránce.",
+    "alertingRuleSavedUpdatedDescription": "Vaše změny pro toto pravidlo upozornění byly uloženy.",
+    "alertingEditRule": "Upravit pravidlo upozornění",
+    "alertingCreateRule": "Vytvořit pravidlo upozornění",
+    "alertingRuleCredenzaDescription": "Vyberte, co sledovat, kdy ho spustit a jak oznamovat",
+    "alertingRuleNamePlaceholder": "Produkční stránka je dolů",
+    "alertingRuleEnabled": "Pravidlo povoleno",
+    "alertingSectionSource": "Zdroj",
+    "alertingSourceType": "Typ zdroje",
+    "alertingSourceSite": "Lokalita",
+    "alertingSourceHealthCheck": "Kontrola stavu",
+    "alertingPickSites": "Lokality",
+    "alertingPickHealthChecks": "Kontroly stavu",
+    "alertingPickResources": "Zdroje",
+    "alertingAllSites": "Všechny lokality",
+    "alertingAllSitesDescription": "Upozornění pro jakoukoli lokalitu",
+    "alertingSpecificSites": "Specifické lokality",
+    "alertingSpecificSitesDescription": "Vyberte specifické lokality k sledování",
+    "alertingAllHealthChecks": "Všechny kontroly stavu",
+    "alertingAllHealthChecksDescription": "Upozornění pro jakoukoli kontrolu stavu",
+    "alertingSpecificHealthChecks": "Specifické kontroly stavu",
+    "alertingSpecificHealthChecksDescription": "Vyberte specifické kontroly stavu k sledování",
+    "alertingAllResources": "Všechny zdroje",
+    "alertingAllResourcesDescription": "Upozornění pro jakýkoli zdroj",
+    "alertingSpecificResources": "Specifické zdroje",
+    "alertingSpecificResourcesDescription": "Vyberte specifické zdroje k sledování",
+    "alertingSelectResources": "Vyberte zdroje…",
+    "alertingResourcesSelected": "{count} zdrojů vybráno",
+    "alertingResourcesEmpty": "Žádné zdroje s cíly v prvních 10 výsledcích.",
+    "alertingSectionTrigger": "Spouštěč",
+    "alertingTrigger": "Kdy upozornit",
+    "alertingTriggerSiteOnline": "Stránky online",
+    "alertingTriggerSiteOffline": "Stránky offline",
+    "alertingTriggerSiteToggle": "Změny stavu stránek",
+    "alertingTriggerHcHealthy": "Kontrola stavu je zdravá",
+    "alertingTriggerHcUnhealthy": "Kontrola stavu je nezdravá",
+    "alertingTriggerHcToggle": "Změny stavu kontroly stavu",
+    "alertingTriggerResourceHealthy": "Zdroj je zdravý",
+    "alertingTriggerResourceUnhealthy": "Zdroj je nezdravý",
+    "alertingTriggerResourceDegraded": "Zhoršený zdroj",
+    "alertingSearchHealthChecks": "Hledat kontroly stavu…",
+    "alertingHealthChecksEmpty": "Nejsou dostupné kontroly stavu.",
+    "alertingTriggerResourceToggle": "Změny stavu zdroje",
+    "alertingSourceResource": "Zdroj",
+    "alertingSectionActions": "Akce",
+    "alertingAddAction": "Přidat akci",
+    "alertingActionNotify": "Email",
+    "alertingActionNotifyDescription": "Odesílat emailová upozornění uživatelům nebo rolím",
+    "alertingActionWebhook": "Webhook",
+    "alertingActionWebhookDescription": "Odeslání HTTP požadavku na vlastní koncový bod",
+    "alertingExternalIntegration": "Externí integrace",
+    "alertingExternalPagerDutyDescription": "Odesílat upozornění do PagerDuty pro řízení incidentů",
+    "alertingExternalOpsgenieDescription": "Směrujte upozornění do Opsgenie pro řízení, když je někdo na telefonu",
+    "alertingExternalServiceNowDescription": "Vytvářet incidenty ServiceNow z událostí upozornění",
+    "alertingExternalIncidentIoDescription": "Spouštět Incident.io workflowy z událostí upozornění",
+    "alertingActionType": "Typ akce",
+    "alertingNotifyUsers": "Uživatelé",
+    "alertingNotifyRoles": "Role",
+    "alertingNotifyEmails": "Emailové adresy",
+    "alertingEmailPlaceholder": "Přidejte e-mail a stiskněte Enter",
+    "alertingWebhookMethod": "HTTP metoda",
+    "alertingWebhookSecret": "Přihlašovací tajemství (volitelné)",
+    "alertingWebhookSecretPlaceholder": "HMAC tajemství",
+    "alertingWebhookHeaders": "Hlavičky",
+    "alertingAddHeader": "Přidat hlavičku",
+    "alertingSelectSites": "Vybrat lokality…",
+    "alertingSitesSelected": "{count} lokalit vybráno",
+    "alertingSelectHealthChecks": "Vybrat kontroly stavu…",
+    "alertingHealthChecksSelected": "{count} kontrol stavu vybráno",
+    "alertingNoHealthChecks": "Žádné cíle s povolenými kontrolami stavu",
+    "alertingHealthCheckStub": "Výběr zdrojů kontrol stavu ještě není propojen – můžete stále konfigurovat spouštěče a akce.",
+    "alertingSelectUsers": "Vybrat uživatele…",
+    "alertingUsersSelected": "{count} uživatelů vybráno",
+    "alertingSelectRoles": "Vybrat role…",
+    "alertingRolesSelected": "{count} rolí vybráno",
+    "alertingSummarySites": "Lokality ({count})",
+    "alertingSummaryAllSites": "Všechny lokality",
+    "alertingSummaryHealthChecks": "Kontroly stavu ({count})",
+    "alertingSummaryAllHealthChecks": "Všechny kontroly stavu",
+    "alertingSummaryResources": "Zdroje ({count})",
+    "alertingSummaryAllResources": "Všechny zdroje",
+    "alertingErrorNameRequired": "Zadejte jméno",
+    "alertingErrorActionsMin": "Přidat alespoň jednu akci",
+    "alertingErrorPickSites": "Vyberte alespoň jednu lokalitu",
+    "alertingErrorPickHealthChecks": "Vyberte alespoň jednu kontrolu stavu",
+    "alertingErrorPickResources": "Vyberte alespoň jeden zdroj",
+    "alertingErrorTriggerSite": "Vyberte spouštěč lokality",
+    "alertingErrorTriggerHealth": "Vyberte spouštěč kontroly stavu",
+    "alertingErrorTriggerResource": "Vyberte spouštěč zdroje",
+    "alertingErrorNotifyRecipients": "Vyberte uživatele, role nebo alespoň jeden email",
+    "alertingConfigureSource": "Konfigurace zdroje",
+    "alertingConfigureTrigger": "Konfigurace spouštěče",
+    "alertingConfigureActions": "Konfigurace akcí",
+    "alertingBackToRules": "Zpět na pravidla",
+    "alertingRuleCooldown": "Odpočinek (sekundy)",
+    "alertingRuleCooldownDescription": "Minimální doba mezi opakovanými upozorněními pro stejné pravidlo. Nastavte na 0 pro spuštění pokaždé.",
+    "alertingDraftBadge": "Koncept - uložit pro uložení tohoto pravidla",
+    "alertingSidebarHint": "Kliknutím na krok na plátno ho zde upravte.",
+    "alertingGraphCanvasTitle": "Průběh pravidla",
+    "alertingGraphCanvasDescription": "Vizuální přehled o zdroji, spouštěči a akcích. Vyberte uzel k jeho editaci v panelu.",
+    "alertingNodeNotConfigured": "Ještě není nakonfigurováno",
+    "alertingNodeActionsCount": "{count, plural, one {# akce} few {# akce} many {# akcí} other {# akce}}",
+    "alertingNodeRoleSource": "Zdroj",
+    "alertingNodeRoleTrigger": "Spouštěč",
+    "alertingNodeRoleAction": "Akce",
+    "alertingTabRules": "Pravidla upozornění",
+    "alertingTabHealthChecks": "Kontroly stavu",
+    "alertingRulesBannerTitle": "Dostávat upozornění",
+    "alertingRulesBannerDescription": "Každé pravidlo spojuje, co sledovat (lokalita, kontrola stavu nebo zdroj), kdy ho spustit (například offline nebo nezdravé), a jak informovat váš tým emailem, webhookem nebo integracemi. Použijte tento seznam k vytvoření, povolení a správě těchto pravidel.",
+    "alertingHealthChecksBannerTitle": "Monitorujte zdraví a zdroje",
+    "alertingHealthChecksBannerDescription": "Kontroly stavu jsou HTTP nebo TCP monitory, které nastavíte jednou. Poté je můžete použít jako zdroje v pravidlech upozornění, takže budete informováni, když se cíl stane zdravým nebo nezdravým. Kontroly stavu také zde se objeví.",
+    "standaloneHcTableTitle": "Kontroly stavu",
+    "standaloneHcSearchPlaceholder": "Hledat kontroly stavu…",
+    "standaloneHcAddButton": "Vytvořit kontrolu stavu",
+    "standaloneHcCreateTitle": "Vytvořit kontrolu stavu",
+    "standaloneHcEditTitle": "Upravit kontrolu stavu",
+    "standaloneHcDescription": "Nakonfigurujte HTTP nebo TCP kontrolu stavu pro použití v pravidlech upozornění.",
+    "standaloneHcNameLabel": "Jméno",
+    "standaloneHcNamePlaceholder": "Můj HTTP Monitor",
+    "standaloneHcDeleteTitle": "Smazat kontrolu stavu",
+    "standaloneHcDeleteQuestion": "Potvrďte, prosím, zda chcete tuto kontrolu stavu smazat.",
+    "standaloneHcDeleted": "Kontrola stavu byla smazána",
+    "standaloneHcSaved": "Kontrola stavu byla uložena",
+    "standaloneHcColumnHealth": "Zdraví",
+    "standaloneHcColumnMode": "Režim",
+    "standaloneHcColumnTarget": "Cíl",
+    "standaloneHcHealthStateHealthy": "Zdravé",
+    "standaloneHcHealthStateUnhealthy": "Nezdravé",
+    "standaloneHcHealthStateUnknown": "Neznámý",
+    "standaloneHcFilterAnySite": "Všechny lokality",
+    "standaloneHcFilterAnyResource": "Všechny zdroje",
+    "standaloneHcFilterMode": "Režim",
+    "standaloneHcFilterModeHttp": "HTTP",
+    "standaloneHcFilterModeTcp": "TCP",
+    "standaloneHcFilterModeSnmp": "SNMP",
+    "standaloneHcFilterModePing": "Ping",
+    "standaloneHcFilterHealth": "Zdraví",
+    "standaloneHcFilterEnabled": "Povoleno",
+    "standaloneHcFilterEnabledOn": "Povoleno",
+    "standaloneHcFilterEnabledOff": "Zakázáno",
+    "standaloneHcFilterSiteIdFallback": "Stránka {id}",
+    "standaloneHcFilterResourceIdFallback": "Zdroj {id}",
     "blueprints": "Plány",
-    "blueprintsDescription": "Použít deklarativní konfigurace a zobrazit předchozí běhy",
+    "blueprintsLog": "Blueprints Log",
+    "blueprintsDescription": "View past blueprint applications and their results",
     "blueprintAdd": "Přidat plán",
     "blueprintGoBack": "Zobrazit všechny plány",
     "blueprintCreate": "Vytvořit plán",
@@ -1357,7 +1664,17 @@
     "contents": "Obsah",
     "parsedContents": "Parsed content (Pouze pro čtení)",
     "enableDockerSocket": "Povolit Docker plán",
-    "enableDockerSocketDescription": "Povolte seškrábání štítků na Docker Socket pro popisky plánů. Nová cesta musí být k dispozici.",
+    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
+    "newtAutoUpdate": "Enable Site Auto-Update",
+    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
+    "siteAutoUpdate": "Site Auto-Update",
+    "siteAutoUpdateLabel": "Enable Auto-Update",
+    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
+    "siteAutoUpdateOrgDefault": "Organization default: {state}",
+    "siteAutoUpdateOverriding": "Overriding organization setting",
+    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
+    "siteAutoUpdateEnabled": "enabled",
+    "siteAutoUpdateDisabled": "disabled",
     "viewDockerContainers": "Zobrazit kontejnery Dockeru",
     "containersIn": "Kontejnery v {siteName}",
     "selectContainerDescription": "Vyberte jakýkoli kontejner pro použití jako název hostitele pro tento cíl. Klikněte na port pro použití portu.",
@@ -1399,8 +1716,10 @@
     "initialSetupDescription": "Vytvořte účet správce intial serveru. Pouze jeden správce serveru může existovat. Tyto přihlašovací údaje můžete kdykoliv změnit.",
     "createAdminAccount": "Vytvořit účet správce",
     "setupErrorCreateAdmin": "Došlo k chybě při vytváření účtu správce serveru.",
-    "certificateStatus": "Stav certifikátu",
+    "certificateStatus": "Certifikát",
+    "certificateStatusAutoRefreshHint": "Stav se automaticky obnovuje.",
     "loading": "Načítání",
+    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Načítání analytiky",
     "restart": "Restartovat",
     "domains": "Domény",
@@ -1468,6 +1787,7 @@
     "pangolinUpdateAvailableReleaseNotes": "Zobrazit poznámky k vydání",
     "newtUpdateAvailable": "Dostupná aktualizace",
     "newtUpdateAvailableInfo": "Je k dispozici nová verze Newt. Pro nejlepší zážitek prosím aktualizujte na nejnovější verzi.",
+    "pangolinNodeUpdateAvailableInfo": "Je k dispozici nová verze uzlu Pangolin. Pro nejlepší zážitek aktualizujte na nejnovější verzi.",
     "domainPickerEnterDomain": "Doména",
     "domainPickerPlaceholder": "myapp.example.com",
     "domainPickerDescription": "Zadejte úplnou doménu zdroje pro zobrazení dostupných možností.",
@@ -1626,6 +1946,7 @@
     "billingManageLicenseSubscription": "Spravujte své předplatné za placené samohostované licenční klíče",
     "billingCurrentKeys": "Aktuální klíče",
     "billingModifyCurrentPlan": "Upravit aktuální tarif",
+    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Potvrdit aktualizaci",
     "billingConfirmDowngrade": "Potvrdit downgrade",
     "billingConfirmUpgradeDescription": "Chystáte se povýšit svůj tarif. Přečtěte si nové limity a ceny.",
@@ -1707,6 +2028,7 @@
     "configureHealthCheck": "Konfigurace kontroly stavu",
     "configureHealthCheckDescription": "Nastavit sledování zdravotního stavu pro {target}",
     "enableHealthChecks": "Povolit kontrolu stavu",
+    "healthCheckDisabledStateDescription": "Pokud je zakázáno, web nebude provádět zdravotní kontroly a stav bude považován za neznámý.",
     "enableHealthChecksDescription": "Sledujte zdraví tohoto cíle. V případě potřeby můžete sledovat jiný cílový bod, než je cíl.",
     "healthScheme": "Způsob",
     "healthSelectScheme": "Vybrat metodu",
@@ -1722,7 +2044,36 @@
     "timeIsInSeconds": "Čas je v sekundách",
     "requireDeviceApproval": "Vyžadovat schválení zařízení",
     "requireDeviceApprovalDescription": "Uživatelé s touto rolí potřebují nová zařízení schválená správcem, než se mohou připojit a přistupovat ke zdrojům.",
-    "sshAccess": "SSH přístup",
+    "sshSettings": "SSH Settings",
+    "rdpSettings": "RDP Settings",
+    "vncSettings": "VNC Settings",
+    "sshServer": "SSH Server",
+    "rdpServer": "RDP Server",
+    "vncServer": "VNC Server",
+    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
+    "rdpServerDescription": "Configure the destination and port of the RDP server",
+    "vncServerDescription": "Configure the destination and port of the VNC server",
+    "sshServerMode": "Mode",
+    "sshServerModeStandard": "Standard SSH Server",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
+    "sshServerModeNative": "Native SSH Server",
+    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
+    "sshAuthenticationMethod": "Authentication Method",
+    "sshAuthMethodManual": "Manual Authentication",
+    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
+    "sshAuthMethodAutomated": "Automated Provisioning",
+    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
+    "sshAuthDaemonLocation": "Auth Daemon Location",
+    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
+    "sshDaemonLocationRemote": "On Remote Host",
+    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
+    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
+    "sshDaemonPort": "Daemon Port",
+    "sshServerDestination": "Server Destination",
+    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
+    "destination": "Destination",
+    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
     "roleAllowSsh": "Povolit SSH",
     "roleAllowSshAllow": "Povolit",
     "roleAllowSshDisallow": "Zakázat",
@@ -1736,7 +2087,7 @@
     "sshSudoModeCommandsDescription": "Uživatel může spustit pouze zadané příkazy s sudo.",
     "sshSudo": "Povolit sudo",
     "sshSudoCommands": "Sudo příkazy",
-    "sshSudoCommandsDescription": "Čárkami oddělený seznam příkazů, které může uživatel spouštět s sudo.",
+    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
     "sshCreateHomeDir": "Vytvořit domovský adresář",
     "sshUnixGroups": "Unixové skupiny",
     "sshUnixGroupsDescription": "Čárkou oddělené skupiny Unix přidají uživatele do cílového hostitele.",
@@ -1756,9 +2107,20 @@
     "healthCheckIntervalMin": "Interval kontroly musí být nejméně 5 sekund",
     "healthCheckTimeoutMin": "Časový limit musí být nejméně 1 sekunda",
     "healthCheckRetryMin": "Pokusy opakovat musí být alespoň 1",
+    "healthCheckMode": "Režim kontroly",
+    "healthCheckStrategy": "Strategie",
+    "healthCheckModeDescription": "Režim TCP ověřuje pouze připojení. Režim HTTP ověřuje HTTP odezvu.",
+    "healthyThreshold": "Zdravý práh",
+    "healthyThresholdDescription": "Počet po sobě jdoucích úspěchů vyžadovaných před označením jako zdravý.",
+    "unhealthyThreshold": "Nezdravý práh",
+    "unhealthyThresholdDescription": "Počet po sobě jdoucích selhání vyžadovaných před označením jako nezdravý.",
+    "healthCheckHealthyThresholdMin": "Zdravý práh musí být alespoň 1",
+    "healthCheckUnhealthyThresholdMin": "Nezdravý práh musí být alespoň 1",
     "httpMethod": "HTTP metoda",
     "selectHttpMethod": "Vyberte HTTP metodu",
     "domainPickerSubdomainLabel": "Subdoména",
+    "domainPickerWildcard": "Zástupný znak",
+    "domainPickerWildcardPaidOnly": "Zástupné poddomény jsou placenou funkcí. Upgradujte, prosím, pro přístup k této funkci.",
     "domainPickerBaseDomainLabel": "Základní doména",
     "domainPickerSearchDomains": "Hledat domény...",
     "domainPickerNoDomainsFound": "Nebyly nalezeny žádné domény",
@@ -1784,12 +2146,12 @@
     "resourcesTableAliasAddressInfo": "Tato adresa je součástí subsítě veřejných služeb organizace. Používá se k řešení záznamů aliasů pomocí interního rozlišení DNS.",
     "resourcesTableClients": "Klienti",
     "resourcesTableAndOnlyAccessibleInternally": "a jsou interně přístupné pouze v případě, že jsou propojeni s klientem.",
-    "resourcesTableNoTargets": "Žádné cíle",
     "resourcesTableHealthy": "Zdravé",
     "resourcesTableDegraded": "Rozklad",
-    "resourcesTableOffline": "Offline",
+    "resourcesTableUnhealthy": "Nezdravý",
     "resourcesTableUnknown": "Neznámý",
     "resourcesTableNotMonitored": "Není sledováno",
+    "resourcesTableNoTargets": "Žádné cíle",
     "editInternalResourceDialogEditClientResource": "Upravit soukromý dokument",
     "editInternalResourceDialogUpdateResourceProperties": "Aktualizovat konfiguraci zdroje a ovládací prvky přístupu pro {resourceName}",
     "editInternalResourceDialogResourceProperties": "Vlastnosti zdroje",
@@ -1815,6 +2177,12 @@
     "editInternalResourceDialogModePort": "Přístav",
     "editInternalResourceDialogModeHost": "Hostitel",
     "editInternalResourceDialogModeCidr": "CIDR",
+    "editInternalResourceDialogModeHttp": "HTTP",
+    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
+    "editInternalResourceDialogScheme": "Schéma",
+    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
     "editInternalResourceDialogDestination": "Místo určení",
     "editInternalResourceDialogDestinationHostDescription": "IP adresa nebo název hostitele zdroje v síti webu.",
     "editInternalResourceDialogDestinationIPDescription": "IP nebo název hostitele zdroje v síti webu.",
@@ -1830,6 +2198,7 @@
     "createInternalResourceDialogName": "Jméno",
     "createInternalResourceDialogSite": "Lokalita",
     "selectSite": "Vybrat lokalitu...",
+    "multiSitesSelectorSitesCount": "{count, plural, one {# web} few {# weby} many {# webů} other {# weby}}",
     "noSitesFound": "Nebyly nalezeny žádné lokality.",
     "createInternalResourceDialogProtocol": "Protokol",
     "createInternalResourceDialogTcp": "TCP",
@@ -1858,11 +2227,20 @@
     "createInternalResourceDialogModePort": "Přístav",
     "createInternalResourceDialogModeHost": "Hostitel",
     "createInternalResourceDialogModeCidr": "CIDR",
+    "createInternalResourceDialogModeHttp": "HTTP",
+    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
+    "scheme": "Schéma",
+    "createInternalResourceDialogScheme": "Schéma",
+    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
     "createInternalResourceDialogDestination": "Místo určení",
     "createInternalResourceDialogDestinationHostDescription": "IP adresa nebo název hostitele zdroje v síti webu.",
     "createInternalResourceDialogDestinationCidrDescription": "Rozsah zdrojů CIDR v síti webu.",
     "createInternalResourceDialogAlias": "Alias",
     "createInternalResourceDialogAliasDescription": "Volitelný interní DNS alias pro tento dokument.",
+    "internalResourceDownstreamSchemeRequired": "HTTP metoda je vyžadována pro HTTP zdroje",
+    "internalResourceHttpPortRequired": "Přípoječný port je nutný pro HTTP zdroj",
     "siteConfiguration": "Konfigurace",
     "siteAcceptClientConnections": "Přijmout připojení klienta",
     "siteAcceptClientConnectionsDescription": "Povolit uživatelským zařízením a klientům přístup ke zdrojům na tomto webu. To lze později změnit.",
@@ -1987,7 +2365,7 @@
         "description": "Spolehlivější a nízko udržovaný Pangolinův server s dalšími zvony a bičkami",
         "introTitle": "Spravovaný Pangolin",
         "introDescription": "je možnost nasazení určená pro lidi, kteří chtějí jednoduchost a spolehlivost při zachování soukromých a samoobslužných dat.",
-        "introDetail": "Pomocí této volby stále provozujete vlastní uzel Pangolin — tunely, SSL terminály a provoz všech pobytů na vašem serveru. Rozdíl spočívá v tom, že řízení a monitorování se řeší prostřednictvím našeho cloudového panelu, který odemkne řadu výhod:",
+        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
         "benefitSimplerOperations": {
             "title": "Jednoduchý provoz",
             "description": "Není třeba spouštět svůj vlastní poštovní server nebo nastavit komplexní upozornění. Ze schránky dostanete upozornění na zdravotní kontrolu a výpadek."
@@ -2020,7 +2398,7 @@
     },
     "internationaldomaindetected": "Zjištěna mezinárodní doména",
     "willbestoredas": "Bude uloženo jako:",
-    "roleMappingDescription": "Určete, jak jsou role přiřazeny uživatelům, když se přihlásí, když je povoleno automatické poskytnutí služby.",
+    "roleMappingDescription": "Určete, jak jsou role přiřazeny uživatelům, když se přihlásí s tímto poskytovatelem identity.",
     "selectRole": "Vyberte roli",
     "roleMappingExpression": "Výraz",
     "selectRolePlaceholder": "Vyberte roli",
@@ -2112,9 +2490,11 @@
     "selectDomainForOrgAuthPage": "Vyberte doménu pro ověřovací stránku organizace",
     "domainPickerProvidedDomain": "Poskytnutá doména",
     "domainPickerFreeProvidedDomain": "Zdarma poskytnutá doména",
+    "domainPickerFreeDomainsPaidFeature": "Poskytnuté domény jsou placenou funkcí. Předplaťte si plán, abyste získali doménu zahrnutou v plánu – nemusíte si přinést vlastní.",
     "domainPickerVerified": "Ověřeno",
     "domainPickerUnverified": "Neověřeno",
-    "domainPickerInvalidSubdomainStructure": "Tato subdoména obsahuje neplatné znaky nebo strukturu. Bude automaticky sanitována při uložení.",
+    "domainPickerManual": "Ruční nastavení",
+    "domainPickerInvalidSubdomainStructure": "Neplatné znaky budou při ukládání vyčištěny.",
     "domainPickerError": "Chyba",
     "domainPickerErrorLoadDomains": "Nepodařilo se načíst domény organizace",
     "domainPickerErrorCheckAvailability": "Kontrola dostupnosti domény se nezdařila",
@@ -2127,7 +2507,7 @@
     "orgAuthChooseIdpDescription": "Chcete-li pokračovat, vyberte svého poskytovatele identity",
     "orgAuthNoIdpConfigured": "Tato organizace nemá nakonfigurovány žádné poskytovatele identity. Místo toho se můžete přihlásit s vaší Pangolinovou identitou.",
     "orgAuthSignInWithPangolin": "Přihlásit se pomocí Pangolinu",
-    "orgAuthSignInToOrg": "Přihlásit se do organizace",
+    "orgAuthSignInToOrg": "Poskytovatel identity organizace (SSO)",
     "orgAuthSelectOrgTitle": "Přihlášení do organizace",
     "orgAuthSelectOrgDescription": "Zadejte ID vaší organizace pro pokračování",
     "orgAuthOrgIdPlaceholder": "vaše-organizace",
@@ -2343,10 +2723,10 @@
             },
             "scale": {
                 "title": "Měřítko",
-                "description": "Podnikové funkce, 50 uživatelů, 50 míst a prioritní podpory."
+                "description": "Podnikové funkce, 50 uživatelů, 100 stránek a prioritní podpora."
             }
         },
-        "personalUseOnly": "Pouze osobní použití (bezplatná licence – bez platby)",
+        "personalUseOnly": "Pouze pro osobní použití (zdarma licence - bez ověření)",
         "buttons": {
             "continueToCheckout": "Pokračovat do pokladny"
         },
@@ -2420,6 +2800,9 @@
     "validPassword": "Platné heslo",
     "validEmail": "Valid email",
     "validSSO": "Valid SSO",
+    "view": "Zobrazit",
+    "configManaged": "Správa konfigurace",
+    "connectedClient": "Připojený klient",
     "resourceBlocked": "Zablokované zdroje",
     "droppedByRule": "Zrušeno pravidlem",
     "noSessions": "Žádné relace",
@@ -2427,19 +2810,19 @@
     "noMoreAuthMethods": "No Valid Auth",
     "ip": "IP adresa",
     "reason": "Důvod",
-    "requestLogs": "Záznamy požadavků",
+    "requestLogs": "Záznamy HTTP požadavků",
     "requestAnalytics": "Vyžádat analýzu",
     "host": "Hostitel",
     "location": "Poloha",
     "actionLogs": "Záznamy akcí",
-    "sidebarLogsRequest": "Záznamy požadavků",
+    "sidebarLogsRequest": "Záznamy HTTP požadavků",
     "sidebarLogsAccess": "Protokoly přístupu",
     "sidebarLogsAction": "Záznamy akcí",
     "logRetention": "Zaznamenávání záznamu",
     "logRetentionDescription": "Spravovat, jak dlouho jsou různé typy logů uloženy pro tuto organizaci nebo je zakázat",
     "requestLogsDescription": "Zobrazit podrobné protokoly požadavků pro zdroje v této organizaci",
     "requestAnalyticsDescription": "Zobrazit podrobnou analýzu požadavků pro zdroje v této organizaci",
-    "logRetentionRequestLabel": "Zachování logu žádosti",
+    "logRetentionRequestLabel": "Zachování logu HTTP požadavků",
     "logRetentionRequestDescription": "Jak dlouho uchovávat záznamy požadavků",
     "logRetentionAccessLabel": "Zachování záznamu přístupu",
     "logRetentionAccessDescription": "Jak dlouho uchovávat přístupové záznamy",
@@ -2607,6 +2990,9 @@
     "machineClients": "Strojoví klienti",
     "install": "Instalovat",
     "run": "Spustit",
+    "envFile": "Konfigurační soubor prostředí",
+    "serviceFile": "Služební soubor",
+    "enableAndStart": "Povolit a spustit",
     "clientNameDescription": "Zobrazované jméno klienta, které lze později změnit.",
     "clientAddress": "Adresa klienta (Rozšířeno)",
     "setupFailedToFetchSubnet": "Nepodařilo se načíst výchozí podsíť",
@@ -2655,7 +3041,13 @@
     "editInternalResourceDialogAddClients": "Přidat klienty",
     "editInternalResourceDialogDestinationLabel": "Cíl",
     "editInternalResourceDialogDestinationDescription": "Určete cílovou adresu pro interní prostředek. Může se jednat o hostname, IP adresu, nebo rozsah CIDR v závislosti na vybraném režimu. Volitelně nastavte interní DNS alias pro snazší identifikaci.",
+    "internalResourceFormMultiSiteRoutingHelp": "Výběrem více webů se povolí odolné směrování a přepojení pro vysokou dostupnost.",
+    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Zjistit více",
     "editInternalResourceDialogPortRestrictionsDescription": "Omezte přístup na specifické TCP/UDP porty nebo povolte/blokujte všechny porty.",
+    "createInternalResourceDialogHttpConfiguration": "Konfigurace HTTP",
+    "createInternalResourceDialogHttpConfigurationDescription": "Zvolte doménu, kterou klienti použijí k dosažení tohoto zdroje přes HTTP nebo HTTPS.",
+    "editInternalResourceDialogHttpConfiguration": "Konfigurace HTTP",
+    "editInternalResourceDialogHttpConfigurationDescription": "Zvolte doménu, kterou klienti použijí k dosažení tohoto zdroje přes HTTP nebo HTTPS.",
     "editInternalResourceDialogTcp": "TCP",
     "editInternalResourceDialogUdp": "UDP",
     "editInternalResourceDialogIcmp": "ICMP",
@@ -2677,7 +3069,7 @@
     "learnMore": "Zjistit více",
     "backToHome": "Zpět na domovskou stránku",
     "needToSignInToOrg": "Potřebujete použít identitního poskytovatele vaší organizace?",
-    "maintenanceMode": "Režim údržby",
+    "maintenanceMode": "Maintenance Page",
     "maintenanceModeDescription": "Zobrazit stránku údržby návštěvníkům",
     "maintenanceModeType": "Typ režimu údržby",
     "showMaintenancePage": "Zobrazit stránku údržby návštěvníkům",
@@ -2694,6 +3086,9 @@
     "maintenancePageMessagePlaceholder": "Vrátíme se brzy! Naše stránka právě prochází plánovanou údrbou.",
     "maintenancePageMessageDescription": "Podrobná zpráva vysvětlující údržbu",
     "maintenancePageTimeTitle": "Odhadovaný čas dokončení (volitelný)",
+    "privateMaintenanceScreenTitle": "Soukromá obrazovka údržby",
+    "privateMaintenanceScreenMessage": "Tato doména je používána na soukromém zdroji. Prosím, připojte se přes klienta Pangolin pro přístup k tomuto zdroji.",
+    "privateMaintenanceScreenSteps": "Jakmile se připojíte, pokud stále vidíte tuto zprávu, možná je mezipaměť DNS vašeho prohlížeče stále nasměrována na starou adresu. Abyste to opravili: úplně zavřete a znovu otevřete tuto záložku nebo prohlížeč, a poté se vraťte na tuto stránku.",
     "maintenanceTime": "např. 2 hodiny, 1. listopadu v 17:00",
     "maintenanceEstimatedTimeDescription": "Kdy očekáváte, že údržba bude dokončena",
     "editDomain": "Upravit doménu",
@@ -2704,6 +3099,7 @@
     "maintenanceScreenEstimatedCompletion": "Odhadované dokončení:",
     "createInternalResourceDialogDestinationRequired": "Cíl je povinný",
     "available": "Dostupné",
+    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Archivováno",
     "noArchivedDevices": "Nebyla nalezena žádná archivovaná zařízení",
     "deviceArchived": "Zařízení archivováno",
@@ -2817,7 +3213,7 @@
     "streamingDatadogTitle": "Datadog",
     "streamingDatadogDescription": "Přeposlat události přímo do vašeho účtu Datadog účtu. Brzy přijde.",
     "streamingTypePickerDescription": "Vyberte cílový typ pro začátek.",
-    "streamingFailedToLoad": "Nepodařilo se načíst destinace",
+    "streamingLastSyncError": "Došlo k chybě při poslední synchronizaci",
     "streamingUnexpectedError": "Došlo k neočekávané chybě.",
     "streamingFailedToUpdate": "Nepodařilo se aktualizovat cíl",
     "streamingDeletedSuccess": "Cíl byl úspěšně odstraněn",
@@ -2831,6 +3227,41 @@
     "httpDestAddTitle": "Přidat cíl HTTP",
     "httpDestEditDescription": "Aktualizovat konfiguraci pro tuto destinaci HTTP události",
     "httpDestAddDescription": "Konfigurace nového koncového bodu HTTP pro příjem událostí vaší organizace.",
+    "S3DestEditTitle": "Upravit cíl",
+    "S3DestAddTitle": "Přidat S3 cíl",
+    "S3DestEditDescription": "Aktualizujte konfiguraci tohoto S3 cíle pro streamování událostí.",
+    "S3DestAddDescription": "Nakonfigurujte nový Amazon S3 (nebo S3-kompatibilní) bucket, aby přijímal události vaší organizace.",
+    "s3DestTabSettings": "Nastavení",
+    "s3DestTabFormat": "Formát",
+    "s3DestNameLabel": "Jméno",
+    "s3DestNamePlaceholder": "Moje cílové S3",
+    "s3DestAccessKeyIdLabel": "ID přístupového klíče AWS",
+    "s3DestSecretAccessKeyLabel": "Tajný přístupový klíč AWS",
+    "s3DestSecretAccessKeyPlaceholder": "Váš tajný přístupový klíč AWS",
+    "s3DestRegionLabel": "Oblast AWS",
+    "s3DestBucketLabel": "Název bucketu",
+    "s3DestPrefixLabel": "Předpona klíče (volitelné)",
+    "s3DestPrefixDescription": "Volitelná cesta předpony přidaná ke každému objektovému klíči. Objekty jsou uloženy na {prefix}/{logType}/{YYYY}/{MM}/{DD}/{filename}.",
+    "s3DestEndpointLabel": "Vlastní koncový bod (volitelné)",
+    "s3DestEndpointDescription": "Přepište koncový bod S3 pro S3-kompatibilní úložiště, jako je MinIO nebo Cloudflare R2. Nechte prázdné pro standardní AWS S3.",
+    "s3DestGzipLabel": "Komprese Gzip",
+    "s3DestGzipDescription": "Komprimujte každý nahraný objekt pomocí gzip. Snižuje náklady na uložení a velikost nahrávání.",
+    "s3DestFormatTitle": "Formát souboru",
+    "s3DestFormatDescription": "Jak jsou události serializovány v každém nahraném objektu.",
+    "s3DestFormatJsonArrayDescription": "Každý objekt je pole JSON záznamů událostí. Kompatibilní s většinou analytických nástrojů.",
+    "s3DestFormatNdjsonDescription": "Každý objekt obsahuje jeden JSON záznam na řádku (newline-delimited JSON). Kompatibilní s Athena, BigQuery a Spark.",
+    "s3DestFormatCsvTitle": "CSV",
+    "s3DestFormatCsvDescription": "Každý objekt je soubor CSV podle RFC-4180 s řádkem záhlaví. Názvy sloupců jsou odvozeny z polí dat událostí.",
+    "s3DestSaveChanges": "Uložit změny",
+    "s3DestCreateDestination": "Vytvořit destinaci",
+    "s3DestUpdatedSuccess": "Destinace úspěšně aktualizována",
+    "s3DestCreatedSuccess": "Destinace úspěšně vytvořena",
+    "s3DestUpdateFailed": "Aktualizace destinace se nezdařila",
+    "s3DestCreateFailed": "Vytvoření destinace se nezdařilo",
+    "datadogDestEditTitle": "Upravit cíl",
+    "datadogDestAddTitle": "Přidat Datadog cíl",
+    "datadogDestEditDescription": "Aktualizujte konfiguraci tohoto Datadog cíle pro streamování událostí.",
+    "datadogDestAddDescription": "Konfigurujte nový Datadog koncový bod pro přijímání událostí vaší organizace.",
     "httpDestTabSettings": "Nastavení",
     "httpDestTabHeaders": "Záhlaví",
     "httpDestTabBody": "Tělo",
@@ -2845,10 +3276,10 @@
     "httpDestAuthNoneTitle": "Žádné ověření",
     "httpDestAuthNoneDescription": "Odešle žádosti bez záhlaví autorizace.",
     "httpDestAuthBearerTitle": "Token na doručitele",
-    "httpDestAuthBearerDescription": "Přidá autorizaci: Hlavička Bearer <token> ke každému požadavku.",
+    "httpDestAuthBearerDescription": "Přidává hlavičku Authorization: Bearer '<token>' k každému požadavku.",
     "httpDestAuthBearerPlaceholder": "Váš API klíč nebo token",
     "httpDestAuthBasicTitle": "Základní ověření",
-    "httpDestAuthBasicDescription": "Přidá autorizaci: Základní <credentials> hlavička. Poskytněte přihlašovací údaje jako uživatelské jméno:password.",
+    "httpDestAuthBasicDescription": "Přidává hlavičku Authorization: Basic '<credentials>'. Poskytněte přihlašovací údaje ve formátu uživatelské jméno:heslo.",
     "httpDestAuthBasicPlaceholder": "uživatelské jméno:heslo",
     "httpDestAuthCustomTitle": "Vlastní záhlaví",
     "httpDestAuthCustomDescription": "Zadejte název a hodnotu vlastního HTTP hlavičky pro ověření (např. X-API-Key).",
@@ -2881,12 +3312,123 @@
     "httpDestActionLogsDescription": "Správní opatření prováděná uživateli v rámci organizace.",
     "httpDestConnectionLogsTitle": "Protokoly připojení",
     "httpDestConnectionLogsDescription": "Události týkající se připojení lokality a tunelu, včetně připojení a odpojení.",
-    "httpDestRequestLogsTitle": "Záznamy požadavků",
+    "httpDestRequestLogsTitle": "Záznamy HTTP požadavků",
     "httpDestRequestLogsDescription": "HTTP záznamy požadavků pro proxy zdroje, včetně metod, cesty a kódu odpovědi.",
     "httpDestSaveChanges": "Uložit změny",
     "httpDestCreateDestination": "Vytvořit cíl",
     "httpDestUpdatedSuccess": "Cíl byl úspěšně aktualizován",
     "httpDestCreatedSuccess": "Cíl byl úspěšně vytvořen",
     "httpDestUpdateFailed": "Nepodařilo se aktualizovat cíl",
-    "httpDestCreateFailed": "Nepodařilo se vytvořit cíl"
+    "httpDestCreateFailed": "Nepodařilo se vytvořit cíl",
+    "followRedirects": "Následovat přesměrování",
+    "followRedirectsDescription": "Automaticky sledovat přesměrování HTTP pro požadavky.",
+    "alertingErrorWebhookUrl": "Zadejte platnou URL pro webhook.",
+    "healthCheckStrategyHttp": "Ověření připojení a kontrola stavu HTTP odpovědi.",
+    "healthCheckStrategyTcp": "Ověření TCP připojení, bez inspekce odpovědi.",
+    "healthCheckStrategySnmp": "Vytváří SNMP požadavek pro kontrolu stavu síťových zařízení a infrastruktury.",
+    "healthCheckStrategyIcmp": "Používá se ICMP echo požadavky (pingy) ke kontrole, zda je zdroj dosažitelný a reaguje.",
+    "healthCheckTabStrategy": "Strategie",
+    "healthCheckTabConnection": "Připojení",
+    "healthCheckTabAdvanced": "Pokročilé",
+    "healthCheckStrategyNotAvailable": "Tato strategie není dostupná. Kontaktujte prodejce pro povolení této funkce.",
+    "uptime30d": "Doba provozu (30d)",
+    "idpAddActionCreateNew": "Vytvořit nového poskytovatele identity",
+    "idpAddActionImportFromOrg": "Importovat z jiné organizace",
+    "idpImportDialogTitle": "Importovat poskytovatele identity",
+    "idpImportDialogDescription": "Vyberte poskytovatele identity z organizace, v níž jste administrátor. Tento poskytovatel bude propojen s touto organizací.",
+    "idpImportSearchPlaceholder": "Hledat podle názvu organizace nebo poskytovatele...",
+    "idpImportEmpty": "Nebyli nalezeni žádní poskytovatelé identity.",
+    "idpImportedDescription": "Poskytovatel identity byl úspěšně importován.",
+    "idpDeleteGlobalQuestion": "Opravdu chcete trvale smazat tohoto poskytovatele identity?",
+    "idpDeleteGlobalDescription": "Tímto bude poskytovatel identity trvale odstraněn ze všech organizací, se kterými je spojen.",
+    "idpUnassociateTitle": "Odpojit poskytovatele identity",
+    "idpUnassociateQuestion": "Opravdu chcete odpojit tohoto poskytovatele identity od této organizace?",
+    "idpUnassociateDescription": "Všichni uživatelé spojení s tímto poskytovatelem identity budou odstraněni z této organizace, ale poskytovatel identity zůstane nadále existovat pro ostatní přidružené organizace.",
+    "idpUnassociateConfirm": "Potvrdit odpojení poskytovatele identity",
+    "idpUnassociateWarning": "Toto nelze pro tuto organizaci vrátit.",
+    "idpUnassociatedDescription": "Poskytovatel identity byl úspěšně odpojen od této organizace",
+    "idpUnassociateMenu": "Odpojit",
+    "idpDeleteAllOrgsMenu": "Odstranit",
+    "publicIpEndpoint": "Koncový bod",
+    "lastTriggeredAt": "Poslední spouštěč",
+    "reject": "Odmítnout",
+    "uptimeDaysAgo": "Před {count} dny",
+    "uptimeToday": "Dnes",
+    "uptimeNoDataAvailable": "Dostupná žádná data",
+    "uptimeSuffix": "doba dostupnosti",
+    "uptimeDowntimeSuffix": "doba nedostupnosti",
+    "uptimeTooltipUptimeLabel": "Doba dostupnosti",
+    "uptimeTooltipDowntimeLabel": "Doba nedostupnosti",
+    "uptimeOngoing": "probíhá",
+    "uptimeNoMonitoringData": "Žádné monitorovací údaje",
+    "uptimeNoData": "Žádná data",
+    "uptimeMiniBarDown": "Nedostupný",
+    "uptimeSectionTitle": "Doba dostupnosti",
+    "uptimeSectionDescription": "Dostupnost za posledních {days} dní",
+    "uptimeAddAlert": "Přidat upozornění",
+    "uptimeViewAlerts": "Zobrazit upozornění",
+    "uptimeCreateEmailAlert": "Vytvořit e-mailové upozornění",
+    "uptimeAlertDescriptionSite": "Pošleme vám upozornění e-mailem, když bude tento web offline nebo se vrátí online.",
+    "uptimeAlertDescriptionResource": "Pošleme vám upozornění e-mailem, když bude tento zdroj offline nebo se vrátí online.",
+    "uptimeAlertNamePlaceholder": "Název upozornění",
+    "uptimeAdditionalEmails": "Další e-maily",
+    "uptimeCreateAlert": "Vytvořit upozornění",
+    "uptimeAlertNoRecipients": "Žádní příjemci",
+    "uptimeAlertNoRecipientsDescription": "Přidejte prosím alespoň jednoho uživatele, roli nebo e-mailovou adresu pro upozornění.",
+    "uptimeAlertCreated": "Upozornění vytvořeno",
+    "uptimeAlertCreatedDescription": "Budete upozorněni, když se tento stav změní.",
+    "uptimeAlertCreateFailed": "Nepodařilo se vytvořit upozornění",
+    "webhookUrlLabel": "URL",
+    "webhookHeaderKeyPlaceholder": "Klíč",
+    "webhookHeaderValuePlaceholder": "Hodnota",
+    "alertLabel": "Upozornění",
+    "domainPickerWildcardSubdomainNotAllowed": "Zástupné poddomény nejsou povoleny.",
+    "domainPickerWildcardCertWarning": "Zástupné zdroje mohou vyžadovat dodatečnou konfiguraci pro správnou funkci.",
+    "domainPickerWildcardCertWarningLink": "Zjistit více",
+    "health": "Zdraví",
+    "domainPendingErrorTitle": "Problém s ověřením",
+    "memberPortalTitle": "Zdroje",
+    "memberPortalDescription": "Zdroje, ke kterým máte v této organizaci přístup",
+    "memberPortalSortBy": "Řadit podle...",
+    "memberPortalSortNameAsc": "Názvu A-Z",
+    "memberPortalSortNameDesc": "Názvu Z-A",
+    "memberPortalSortDomainAsc": "Domény A-Z",
+    "memberPortalSortDomainDesc": "Domény Z-A",
+    "memberPortalSortEnabledFirst": "Nejprve povoleno",
+    "memberPortalSortDisabledFirst": "Nejprve zakázáno",
+    "memberPortalRefresh": "Aktualizovat",
+    "memberPortalRefreshResources": "Aktualizovat zdroje",
+    "memberPortalFailedToLoad": "Nepodařilo se načíst zdroje",
+    "memberPortalFailedToLoadDescription": "Nepodařilo se načíst zdroje. Zkontrolujte prosím své připojení a zkuste to znovu.",
+    "memberPortalUnableToLoad": "Nelze načíst zdroje",
+    "memberPortalTryAgain": "Zkusit znovu",
+    "memberPortalNoResourcesFound": "Žádné zdroje nebyly nalezeny",
+    "memberPortalNoResourcesAvailable": "Žádné zdroje nejsou k dispozici",
+    "memberPortalNoResourcesMatchSearch": "Žádné zdroje neodpovídají \"{query}\". Zkuste přizpůsobit své vyhledávací termíny nebo vyčistit hledání, abyste viděli všechny zdroje.",
+    "memberPortalNoResourcesAccess": "Zatím nemáte přístup k žádným zdrojům. Kontaktujte svého správce, aby vám poskytl přístup k potřebným zdrojům.",
+    "memberPortalClearSearch": "Vymazat hledání",
+    "memberPortalPublicResources": "Veřejné zdroje",
+    "memberPortalPublicResourcesDescription": "Webové aplikace a služby přístupné přes prohlížeč",
+    "memberPortalCopiedToClipboard": "Zkopírováno do schránky",
+    "memberPortalCopiedUrlDescription": "URL zdroje byla zkopírována do vaší schránky.",
+    "memberPortalOpenResource": "Otevřít zdroj",
+    "memberPortalPrivateResources": "Soukromé zdroje",
+    "memberPortalPrivateResourcesDescription": "Interní síťové zdroje přístupné přes klienta",
+    "memberPortalResourceDetails": "Podrobnosti o zdroji",
+    "memberPortalMode": "Režim",
+    "memberPortalDestination": "Cíl",
+    "memberPortalAlias": "Přezdívka",
+    "memberPortalCopiedAliasDescription": "Alias zdroje byl zkopírován do vaší schránky.",
+    "memberPortalCopiedDestinationDescription": "Cíl zdroje byl zkopírován do vaší schránky.",
+    "memberPortalRequiresClientConnection": "Vyžaduje klientské připojení",
+    "memberPortalAuthMethods": "Metody ověřování",
+    "memberPortalSso": "Jedno přihlášení (SSO)",
+    "memberPortalPasswordProtected": "Heslo chráněno",
+    "memberPortalPinCode": "PIN kód",
+    "memberPortalEmailWhitelist": "Seznam povolených emailů",
+    "memberPortalResourceDisabled": "Zdroj je zakázán",
+    "memberPortalShowingResources": "Zobrazeny {start}-{end} z {total} zdrojů",
+    "memberPortalPrevious": "Předchozí",
+    "memberPortalNext": "Následující",
+    "httpSettings": "HTTP Settings"
 }

messages/nl-NL.json

@@ -1,4 +1,8 @@
 {
+    "contactSalesEnable": "Neem contact op met de verkoopafdeling om deze functie in te schakelen.",
+    "contactSalesBookDemo": "Boek een demo",
+    "contactSalesOr": "of",
+    "contactSalesContactUs": "neem contact met ons op",
     "setupCreate": "Maak de organisatie, site en bronnen aan",
     "headerAuthCompatibilityInfo": "Schakel dit in om een 401 Niet Geautoriseerd antwoord af te dwingen wanneer een authenticatietoken ontbreekt. Dit is vereist voor browsers of specifieke HTTP-bibliotheken die geen referenties verzenden zonder een serveruitdaging.",
     "headerAuthCompatibility": "Uitgebreide compatibiliteit",
@@ -19,6 +23,18 @@
     "componentsInvalidKey": "Ongeldige of verlopen licentiesleutels gedetecteerd. Volg de licentievoorwaarden om alle functies te blijven gebruiken.",
     "dismiss": "Uitschakelen",
     "subscriptionViolationMessage": "U overschrijdt uw huidige abonnement. Corrigeer het probleem door sites, gebruikers of andere bronnen te verwijderen om binnen uw plan te blijven.",
+    "trialBannerMessage": "Uw proefversie verloopt over {countdown}. Upgrade om toegang te behouden.",
+    "trialBannerExpired": "Uw proefperiode is verlopen. Upgrade nu om toegang te herstellen.",
+    "billingTrialBannerTitle": "Proefperiode Actief",
+    "billingTrialBannerDescription": "Je bent momenteel bezig met een gratis proefperiode op het zakelijke niveau. Wanneer de proefperiode eindigt, wordt je account automatisch teruggezet naar de functies en limieten van het Basic-niveau. Upgrade op elk moment om toegang te houden tot de functies van je huidige plan.",
+    "billingTrialBannerUpgrade": "Nu Upgraden",
+    "billingTrialBadge": "Gratis Proefversie",
+    "trialActive": "Gratis proefversie actief",
+    "trialExpired": "Proefversie verlopen",
+    "trialHasEnded": "Uw proefperiode is geëindigd.",
+    "trialDaysRemaining": "{count, plural, one {# dag resterend} other {# dagen resterend}}",
+    "trialDaysLeftShort": "{days}d over in proefversie",
+    "trialGoToBilling": "Ga naar factureringspagina",
     "subscriptionViolationViewBilling": "Facturering bekijken",
     "componentsLicenseViolation": "Licentie overtreding: Deze server gebruikt {usedSites} sites die de gelicentieerde limiet van {maxSites} sites overschrijden. Volg de licentievoorwaarden om door te gaan met het gebruik van alle functies.",
     "componentsSupporterMessage": "Bedankt voor het ondersteunen van Pangolin als {tier}!",
@@ -81,6 +97,8 @@
     "siteConfirmCopy": "Ik heb de configuratie gekopieerd",
     "searchSitesProgress": "Sites zoeken...",
     "siteAdd": "Site toevoegen",
+    "sitesTableViewPublicResources": "Openbare bronnen bekijken",
+    "sitesTableViewPrivateResources": "Privébronnen bekijken",
     "siteInstallNewt": "Installeer Newt",
     "siteInstallNewtDescription": "Laat Newt draaien op uw systeem",
     "WgConfiguration": "WireGuard Configuratie",
@@ -98,6 +116,21 @@
     "siteUpdatedDescription": "De site is bijgewerkt.",
     "siteGeneralDescription": "Algemene instellingen voor deze site configureren",
     "siteSettingDescription": "Configureer de instellingen van de site",
+    "siteResourcesTab": "Bronnen",
+    "siteResourcesNoneOnSite": "Deze site heeft nog geen openbare of privébronnen.",
+    "siteResourcesSectionPublic": "Openbare bronnen",
+    "siteResourcesSectionPrivate": "Privébronnen",
+    "siteResourcesSectionPublicDescription": "Bronnen extern blootgesteld via domeinen of poorten.",
+    "siteResourcesSectionPrivateDescription": "Bronnen beschikbaar op uw privénetwerk via de site.",
+    "siteResourcesViewAllPublic": "Bekijk alle bronnen",
+    "siteResourcesViewAllPrivate": "Bekijk alle bronnen",
+    "siteResourcesDialogDescription": "Overzicht van openbare en privébronnen die geassocieerd zijn met deze site.",
+    "siteResourcesShowMore": "Meer weergeven",
+    "siteResourcesPermissionDenied": "U heeft geen toestemming om deze bronnen te vermelden.",
+    "siteResourcesEmptyPublic": "Geen openbare bronnen richten zich nog op deze site.",
+    "siteResourcesEmptyPrivate": "Er zijn nog geen privébronnen gekoppeld aan deze site.",
+    "siteResourcesHowToAccess": "Hoe te openen",
+    "siteResourcesTargetsOnSite": "Doelen op deze site",
     "siteSetting": "{siteName} instellingen",
     "siteNewtTunnel": "Nieuwste site (Aanbevolen)",
     "siteNewtTunnelDescription": "Makkelijkste manier om een ingangspunt in een netwerk te maken. Geen extra opzet.",
@@ -123,6 +156,10 @@
     "shareErrorDeleteMessage": "Fout opgetreden tijdens het verwijderen link",
     "shareDeleted": "Link verwijderd",
     "shareDeletedDescription": "De link is verwijderd",
+    "shareDelete": "Verwijder Deel Link",
+    "shareDeleteConfirm": "Bevestig verwijdering van Deel Link",
+    "shareQuestionRemove": "Weet u zeker dat u deze deel link wilt verwijderen?",
+    "shareMessageRemove": "Zodra verwijderd, zal de link niet meer werken en zal iedereen die het gebruikt de toegang tot de bron verliezen.",
     "shareTokenDescription": "De toegangstoken kan op twee manieren worden doorgegeven: als queryparameter of in de aanvraagheaders. Deze moeten worden doorgegeven van de client op elk verzoek voor geverifieerde toegang.",
     "accessToken": "Toegangs-token",
     "usageExamples": "Voorbeelden van gebruik",
@@ -139,6 +176,7 @@
     "shareErrorCreateDescription": "Fout opgetreden tijdens het maken van de share link",
     "shareCreateDescription": "Iedereen met deze link heeft toegang tot de pagina",
     "shareTitleOptional": "Titel (optioneel)",
+    "sharePathOptional": "Path (optional)",
     "expireIn": "Vervalt in",
     "neverExpire": "Nooit verlopen",
     "shareExpireDescription": "Vervaltijd is hoe lang de link bruikbaar is en geeft toegang tot de bron. Na deze tijd zal de link niet meer werken en zullen gebruikers die deze link hebben gebruikt de toegang tot de pagina verliezen.",
@@ -171,11 +209,33 @@
     "resourcesSearch": "Zoek bronnen...",
     "resourceAdd": "Bron toevoegen",
     "resourceErrorDelte": "Fout bij verwijderen document",
+    "resourcePoliciesTitle": "Manage Resource Policies",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
+    "resourcePoliciesAttachedResources": "{count} resource(s)",
+    "resourcePoliciesAttachedResourcesEmpty": "no resources",
+    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
+    "resourcePoliciesSearch": "Search policies...",
+    "resourcePoliciesAdd": "Add Policy",
+    "resourcePoliciesDefaultBadgeText": "Default policy",
+    "resourcePoliciesCreate": "Create Resource Policy",
+    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
+    "resourcePolicyName": "Policy Name",
+    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
+    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
+    "resourcePoliciesSeeAll": "See All Policies",
+    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
+    "resourcePolicyOtpEmailAdd": "Add OTP emails",
+    "resourcePolicyRulesAdd": "Add Rules",
+    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
+    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
+    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Authenticatie",
     "protected": "Beschermd",
     "notProtected": "Niet beveiligd",
     "resourceMessageRemove": "Eenmaal verwijderd, zal het bestand niet langer toegankelijk zijn. Alle doelen die gekoppeld zijn aan het hulpbron, zullen ook verwijderd worden.",
     "resourceQuestionRemove": "Weet u zeker dat u het document van de organisatie wilt verwijderen?",
+    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
+    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS bron",
     "resourceHTTPDescription": "Proxyverzoeken via HTTPS met een volledig gekwalificeerde domeinnaam.",
     "resourceRaw": "TCP/UDP bron",
@@ -183,8 +243,9 @@
     "resourceRawDescriptionCloud": "Proxy verzoeken over rauwe TCP/UDP met behulp van een poortnummer. Vereist sites om verbinding te maken met een remote node.",
     "resourceCreate": "Bron maken",
     "resourceCreateDescription": "Volg de onderstaande stappen om een nieuwe bron te maken",
+    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Alle bronnen bekijken",
-    "resourceInfo": "Bron informatie",
+    "resourceCreateGeneral": "General",
     "resourceNameDescription": "Dit is de weergavenaam voor het document.",
     "siteSelect": "Selecteer site",
     "siteSearch": "Zoek site",
@@ -194,12 +255,15 @@
     "noCountryFound": "Geen land gevonden.",
     "siteSelectionDescription": "Deze site zal connectiviteit met het doelwit bieden.",
     "resourceType": "Type bron",
-    "resourceTypeDescription": "Bepaal hoe u toegang wilt tot de bron",
+    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
+    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
     "resourceHTTPSSettings": "HTTPS instellingen",
     "resourceHTTPSSettingsDescription": "Stel in hoe de bron wordt benaderd via HTTPS",
+    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Domein type",
     "subdomain": "Subdomein",
     "baseDomain": "Basis domein",
+    "configure": "Configure",
     "subdomnainDescription": "Het subdomein waar de bron toegankelijk zal zijn.",
     "resourceRawSettings": "TCP/UDP instellingen",
     "resourceRawSettingsDescription": "Stel in hoe de bron wordt benaderd via TCP/UDP",
@@ -216,8 +280,27 @@
     "resourceLearnRaw": "Leer hoe je TCP/UDP bronnen kunt configureren",
     "resourceBack": "Terug naar bronnen",
     "resourceGoTo": "Ga naar Resource",
+    "resourcePolicyDelete": "Delete Resource Policy",
+    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Document verwijderen",
     "resourceDeleteConfirm": "Bevestig Verwijderen Document",
+    "labelDelete": "Delete Label",
+    "labelAdd": "Add Label",
+    "labelCreateSuccessMessage": "Label Created Successfully",
+    "labelEditSuccessMessage": "Label Modified Successfully",
+    "labelNameField": "Label Name",
+    "labelColorField": "Label Color",
+    "labelPlaceholder": "Ex: homelab",
+    "labelCreate": "Create Label",
+    "createLabelDialogTitle": "Create Label",
+    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
+    "labelEdit": "Edit Label",
+    "editLabelDialogTitle": "Update Label",
+    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
+    "labelDeleteConfirm": "Confirm Delete Label",
+    "labelErrorDelete": "Failed to delete label",
+    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
+    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Zichtbaarheid",
     "enabled": "Ingeschakeld",
     "disabled": "Uitgeschakeld",
@@ -228,6 +311,8 @@
     "rules": "Regels",
     "resourceSettingDescription": "Configureer de instellingen in de bron",
     "resourceSetting": "{resourceName} instellingen",
+    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
+    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Authenticatie omzeilen",
     "alwaysDeny": "Blokkeer toegang",
     "passToAuth": "Passeren naar Auth",
@@ -267,8 +352,11 @@
     "orgMissing": "Organisatie-ID ontbreekt",
     "orgMissingMessage": "Niet in staat om de uitnodiging te regenereren zonder organisatie-ID.",
     "accessUsersManage": "Gebruikers beheren",
+    "accessUserManage": "Beheer gebruiker",
     "accessUsersDescription": "Nodig uit en beheer gebruikers met toegang tot deze organisatie",
     "accessUsersSearch": "Gebruikers zoeken...",
+    "accessUsersRoleFilterCount": "{count, plural, one {# rol} other {# rollen}}",
+    "accessUsersRoleFilterClear": "Rolfilters wissen",
     "accessUserCreate": "Gebruiker aanmaken",
     "accessUserRemove": "Gebruiker verwijderen",
     "username": "Gebruikersnaam",
@@ -371,10 +459,10 @@
     "provisioningKeysUpdated": "Provisie sleutel bijgewerkt",
     "provisioningKeysUpdatedDescription": "Uw wijzigingen zijn opgeslagen.",
     "provisioningKeysBannerTitle": "Bewerkingssleutels voor websites",
-    "provisioningKeysBannerDescription": "Genereer een provisioning-sleutel en gebruik deze met de Newt-connector om automatisch sites aan te maken bij het opstarten van de eerste opstart- het is niet nodig om afzonderlijke inloggegevens in te stellen voor elke site.",
+    "provisioningKeysBannerDescription": "Genereer een inrichtingssleutel en gebruik deze met de Newt-connector om automatisch sites te maken bij de eerste opstart - er is geen behoefte om aparte inloggegevens voor elke site in te stellen.",
     "provisioningKeysBannerButtonText": "Meer informatie",
     "pendingSitesBannerTitle": "Openstaande sites",
-    "pendingSitesBannerDescription": "Sites die met elkaar verbinden met behulp van een provisioning-sleutel verschijnen hier voor beoordeling. Accepteer elke site voordat deze actief wordt en krijgt toegang tot uw bronnen.",
+    "pendingSitesBannerDescription": "Sites die verbinding maken met een inrichtingssleutel verschijnen hier voor beoordeling.",
     "pendingSitesBannerButtonText": "Meer informatie",
     "apiKeysSettings": "{apiKeyName} instellingen",
     "userTitle": "Alle gebruikers beheren",
@@ -405,6 +493,10 @@
     "licenseErrorKeyActivate": "Licentiesleutel activeren mislukt",
     "licenseErrorKeyActivateDescription": "Er is een fout opgetreden tijdens het activeren van de licentiesleutel.",
     "licenseAbout": "Over licenties",
+    "licenseBannerTitle": "Activeer Uw Enterprise Licentie",
+    "licenseBannerDescription": "Ontgrendel enterprise-functies voor uw zelf-gehoste Pangolin-instantie. Koop een licentiesleutel om premium mogelijkheden te activeren, voeg deze vervolgens hieronder toe.",
+    "licenseBannerGetLicense": "Koop een Licentie",
+    "licenseBannerViewDocs": "Bekijk Documentatie",
     "communityEdition": "Community editie",
     "licenseAboutDescription": "Dit geldt voor gebruikers van bedrijven en ondernemingen die Pangolin in gebruiken in een commerciële omgeving. Als u Pangolin gebruikt voor persoonlijk gebruik, kunt u dit gedeelte negeren.",
     "licenseKeyActivated": "Licentiesleutel geactiveerd",
@@ -483,6 +575,12 @@
     "userMessageOrgRemove": "Eenmaal verwijderd, heeft deze gebruiker geen toegang meer tot de organisatie. Je kunt ze later altijd opnieuw uitnodigen, maar ze zullen de uitnodiging opnieuw moeten accepteren.",
     "userRemoveOrgConfirm": "Bevestig verwijderen gebruiker",
     "userRemoveOrg": "Gebruiker uit organisatie verwijderen",
+    "userQuestionOrgRemoveSelf": "Weet u zeker dat u zichzelf uit deze organisatie wilt verwijderen?",
+    "userMessageOrgRemoveSelf": "U verliest onmiddellijk toegang. Een beheerder kan u later opnieuw uitnodigen, maar u moet een nieuwe uitnodiging accepteren.",
+    "userRemoveOrgConfirmSelf": "Bevestig Verwijder Mijn Persoon",
+    "userRemoveOrgSelf": "Verwijder uzelf uit de organisatie",
+    "userRemoveOrgSelfWarning": "U verliest onmiddellijk toegang tot deze organisatie.",
+    "userRemoveOrgConfirmPhraseSelf": "VERWIJDER MIJ UIT ORGANISATIE",
     "users": "Gebruikers",
     "accessRoleMember": "Lid",
     "accessRoleOwner": "Eigenaar",
@@ -491,6 +589,11 @@
     "emailInvalid": "Ongeldig e-mailadres",
     "inviteValidityDuration": "Selecteer een tijdsduur",
     "accessRoleSelectPlease": "Selecteer een rol",
+    "removeOwnAdminRoleConfirmTitle": "Uw beheerderstoegang verwijderen?",
+    "removeOwnAdminRoleConfirmDescription": "U zult na het opslaan geen beheerdersrechten meer hebben in deze organisatie. Een andere beheerder kan de toegang indien nodig herstellen.",
+    "removeOwnAdminRoleConfirmButton": "Verwijder Mijn Beheerderstoegang",
+    "removeOwnAdminRoleConfirmPhrase": "VERWIJDER MIJN BEHEERDERSTOEGANG",
+    "ownerMustRetainAdminRole": "De organisatie-eigenaar moet minstens één beheerdersrol behouden.",
     "usernameRequired": "Gebruikersnaam is verplicht",
     "idpSelectPlease": "Selecteer een identiteitsprovider",
     "idpGenericOidc": "Algemene OAuth2/OIDC provider.",
@@ -575,7 +678,7 @@
     "createdAt": "Aangemaakt op",
     "proxyErrorInvalidHeader": "Ongeldige aangepaste Header waarde. Gebruik het domeinnaam formaat, of sla leeg op om de aangepaste Host header ongedaan te maken.",
     "proxyErrorTls": "Ongeldige TLS servernaam. Gebruik de domeinnaam of sla leeg op om de TLS servernaam te verwijderen.",
-    "proxyEnableSSL": "SSL inschakelen",
+    "proxyEnableSSL": "Enable TLS",
     "proxyEnableSSLDescription": "SSL/TLS-versleuteling inschakelen voor beveiligde HTTPS-verbindingen naar de doelen.",
     "target": "Target",
     "configureTarget": "Doelstellingen configureren",
@@ -618,12 +721,15 @@
     "targetNoOneDescription": "Het toevoegen van meer dan één doel hierboven zal de load balancering mogelijk maken.",
     "targetsSubmit": "Doelstellingen opslaan",
     "addTarget": "Doelwit toevoegen",
+    "proxyMultiSiteRoundRobinNodeHelp": "Round-robin routering werkt niet tussen locaties die niet met hetzelfde knooppunt zijn verbonden, maar failover werkt wel.",
     "targetErrorInvalidIp": "Ongeldig IP-adres",
     "targetErrorInvalidIpDescription": "Voer een geldig IP-adres of hostnaam in",
     "targetErrorInvalidPort": "Ongeldige poort",
     "targetErrorInvalidPortDescription": "Voer een geldig poortnummer in",
     "targetErrorNoSite": "Geen site geselecteerd",
     "targetErrorNoSiteDescription": "Selecteer een site voor het doel",
+    "targetTargetsCleared": "Doelen gewist",
+    "targetTargetsClearedDescription": "Alle doelen zijn verwijderd van deze bron",
     "targetCreated": "Doel aangemaakt",
     "targetCreatedDescription": "Doel is succesvol aangemaakt",
     "targetErrorCreate": "Kan doel niet aanmaken",
@@ -689,6 +795,16 @@
     "rulesNoOne": "Geen regels. Voeg een regel toe via het formulier.",
     "rulesOrder": "Regels worden in oplopende volgorde volgens prioriteit beoordeeld.",
     "rulesSubmit": "Regels opslaan",
+    "policyErrorCreate": "Error creating policy",
+    "policyErrorCreateDescription": "An error occurred when creating the policy",
+    "policyErrorCreateMessageDescription": "An unexpected error occurred",
+    "policyErrorUpdate": "Error updating policy",
+    "policyErrorUpdateDescription": "An error occurred when updating the policy",
+    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
+    "policyCreatedSuccess": "Resource policy succesfully created",
+    "policyUpdatedSuccess": "Resource policy succesfully updated",
+    "authMethodsSave": "Save auth methods",
+    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Fout bij maken document",
     "resourceErrorCreateDescription": "Er is een fout opgetreden bij het maken van het document",
     "resourceErrorCreateMessage": "Fout bij maken bron:",
@@ -725,6 +841,7 @@
     "newtEndpoint": "Endpoint",
     "newtId": "ID",
     "newtSecretKey": "Geheim",
+    "newtVersion": "Versie",
     "architecture": "Architectuur",
     "sites": "Sites",
     "siteWgAnyClients": "Gebruik een willekeurige WireGuard client om verbinding te maken. Je zult interne bronnen moeten aanspreken met behulp van de peer IP.",
@@ -751,6 +868,16 @@
     "pincodeAdd": "PIN-code toevoegen",
     "pincodeRemove": "PIN-code verwijderen",
     "resourceAuthMethods": "Authenticatie methoden",
+    "resourcePolicyAuthMethodsEmpty": "No authentication method",
+    "resourcePolicyOtpEmpty": "No one time password",
+    "resourcePolicyReadOnly": "This policy is Read only",
+    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
+    "resourcePolicyTypeSave": "Save Resource type",
+    "resourcePolicySelect": "Select resource policy",
+    "resourcePolicySelectError": "Select a resource policy",
+    "resourcePolicyNotFound": "Policy not found",
+    "resourcePolicySearch": "Search policies",
+    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Sta toegang tot de bron toe via extra autorisatiemethoden",
     "resourceAuthSettingsSave": "Succesvol opgeslagen",
     "resourceAuthSettingsSaveDescription": "Verificatie-instellingen zijn opgeslagen",
@@ -786,6 +913,12 @@
     "resourcePincodeSetupTitle": "Pincode instellen",
     "resourcePincodeSetupTitleDescription": "Stel een pincode in om deze hulpbron te beschermen",
     "resourceRoleDescription": "Beheerders hebben altijd toegang tot deze bron.",
+    "resourcePolicySelectTitle": "Resource Access Policy",
+    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
+    "resourcePolicyInline": "Inline Resource Policy",
+    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
+    "resourcePolicyShared": "Shared Resource Policy",
+    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Toegang Bediening",
     "resourceUsersRolesDescription": "Configureer welke gebruikers en rollen deze pagina kunnen bezoeken",
     "resourceUsersRolesSubmit": "Bewaar Toegangsbesturing",
@@ -892,6 +1025,7 @@
     "idpDisplayName": "Een weergavenaam voor deze identiteitsprovider",
     "idpAutoProvisionUsers": "Auto Provisie Gebruikers",
     "idpAutoProvisionUsersDescription": "Wanneer ingeschakeld, worden gebruikers automatisch in het systeem aangemaakt wanneer ze de eerste keer inloggen met de mogelijkheid om gebruikers toe te wijzen aan rollen en organisaties.",
+    "idpAutoProvisionConfigureAfterCreate": "U kunt automatische voorzieningsinstellingen configureren zodra de identiteitsprovider is aangemaakt.",
     "licenseBadge": "EE",
     "idpType": "Type provider",
     "idpTypeDescription": "Selecteer het type identiteitsprovider dat u wilt configureren",
@@ -943,7 +1077,7 @@
     "defaultMappingsRole": "Standaard Rol Toewijzing",
     "defaultMappingsRoleDescription": "Het resultaat van deze uitdrukking moet de rolnaam zoals gedefinieerd in de organisatie als tekenreeks teruggeven.",
     "defaultMappingsOrg": "Standaard organisatie mapping",
-    "defaultMappingsOrgDescription": "Deze expressie moet de org-ID teruggeven of waar om de gebruiker toegang te geven tot de organisatie.",
+    "defaultMappingsOrgDescription": "Wanneer ingesteld, moet deze expressie de organisatie-ID of waar retourneren voor de gebruiker om toegang te krijgen tot die organisatie. Als het niet is ingesteld, is het definiëren van een roltoewijzing voldoende: de gebruiker is toegestaan zolang een geldige roltoewijzing voor hen binnen de organisatie kan worden opgelost.",
     "defaultMappingsSubmit": "Standaard toewijzingen opslaan",
     "orgPoliciesEdit": "Organisatie beleid bewerken",
     "org": "Organisatie",
@@ -1080,6 +1214,18 @@
     "idpErrorConnectingTo": "Er was een probleem bij het verbinden met {name}. Neem contact op met uw beheerder.",
     "idpErrorNotFound": "IdP niet gevonden",
     "inviteInvalid": "Ongeldige uitnodiging",
+    "labels": "Labels",
+    "orgLabelsDescription": "Manage labels in this organization.",
+    "addLabels": "Add labels",
+    "siteLabelsTab": "Labels",
+    "siteLabelsDescription": "Manage labels associated with this site.",
+    "labelsNotFound": "Labels not found",
+    "labelSearch": "Search labels",
+    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
+    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
+    "accessLabelFilterClear": "Clear label filters",
+    "selectColor": "Select color",
+    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Uitnodigingslink is ongeldig.",
     "inviteErrorWrongUser": "Uitnodiging is niet voor deze gebruiker",
     "inviteErrorUserNotExists": "Gebruiker bestaat niet. Maak eerst een account aan.",
@@ -1250,6 +1396,7 @@
     "actionViewLogs": "Logboeken bekijken",
     "noneSelected": "Niet geselecteerd",
     "orgNotFound2": "Geen organisaties gevonden.",
+    "search": "Zoeken…",
     "searchPlaceholder": "Zoeken...",
     "emptySearchOptions": "Geen opties gevonden",
     "create": "Aanmaken",
@@ -1313,6 +1460,8 @@
     "sidebarResources": "Bronnen",
     "sidebarProxyResources": "Openbaar",
     "sidebarClientResources": "Privé",
+    "sidebarPolicies": "Policies",
+    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Toegangs controle",
     "sidebarLogsAndAnalytics": "Logs & Analytics",
     "sidebarTeam": "Team",
@@ -1334,12 +1483,170 @@
     "sidebarGeneral": "Beheren",
     "sidebarLogAndAnalytics": "Log & Analytics",
     "sidebarBluePrints": "Blauwdrukken",
+    "sidebarAlerting": "Waarschuwingen",
+    "sidebarHealthChecks": "Gezondheidscontroles",
     "sidebarOrganization": "Organisatie",
     "sidebarManagement": "Beheer",
     "sidebarBillingAndLicenses": "Facturatie & Licenties",
     "sidebarLogsAnalytics": "Analyses",
+    "alertingTitle": "Waarschuwingen",
+    "alertingDescription": "Definieer bronnen, triggers en acties voor meldingen",
+    "alertingRules": "Waarschuwingsregels",
+    "alertingSearchRules": "Zoek regels…",
+    "alertingAddRule": "Regel aanmaken",
+    "alertingColumnSource": "Bron",
+    "alertingColumnTrigger": "Trigger",
+    "alertingColumnActions": "Acties",
+    "alertingColumnEnabled": "Ingeschakeld",
+    "alertingDeleteQuestion": "Bevestig alstublieft dat u deze waarschuwingsregel wilt verwijderen.",
+    "alertingDeleteRule": "Verwijder waarschuwingsregel",
+    "alertingRuleDeleted": "Waarschuwingsregel verwijderd",
+    "alertingRuleSaved": "Waarschuwingsregel opgeslagen",
+    "alertingRuleSavedCreatedDescription": "Uw nieuwe waarschuwingsregel is aangemaakt. U kunt deze op deze pagina blijven bewerken.",
+    "alertingRuleSavedUpdatedDescription": "Uw wijzigingen in deze waarschuwingsregel zijn opgeslagen.",
+    "alertingEditRule": "Bewerk waarschuwingsregel",
+    "alertingCreateRule": "Waarschuwingsregel aanmaken",
+    "alertingRuleCredenzaDescription": "Kies wat te bekijken, wanneer het moet gebeuren en hoe te waarschuwen",
+    "alertingRuleNamePlaceholder": "Productiesite offline",
+    "alertingRuleEnabled": "Regel ingeschakeld",
+    "alertingSectionSource": "Bron",
+    "alertingSourceType": "Brontype",
+    "alertingSourceSite": "Site",
+    "alertingSourceHealthCheck": "Gezondheidscontrole",
+    "alertingPickSites": "Sites",
+    "alertingPickHealthChecks": "Gezondheidscontroles",
+    "alertingPickResources": "Bronnen",
+    "alertingAllSites": "Alle sites",
+    "alertingAllSitesDescription": "Waarschuwing voor elke site",
+    "alertingSpecificSites": "Specifieke sites",
+    "alertingSpecificSitesDescription": "Kies specifieke sites om in de gaten te houden",
+    "alertingAllHealthChecks": "Alle Gezondheidscontroles",
+    "alertingAllHealthChecksDescription": "Waarschuwing voor elke gezondheidscontrole",
+    "alertingSpecificHealthChecks": "Specifieke Gezondheidscontroles",
+    "alertingSpecificHealthChecksDescription": "Kies specifieke gezondheidscontroles om in de gaten te houden",
+    "alertingAllResources": "Alle bronnen",
+    "alertingAllResourcesDescription": "Waarschuwing voor elke bron",
+    "alertingSpecificResources": "Specifieke bronnen",
+    "alertingSpecificResourcesDescription": "Kies specifieke bronnen om in de gaten te houden",
+    "alertingSelectResources": "Selecteer bronnen…",
+    "alertingResourcesSelected": "{count} bronnen geselecteerd",
+    "alertingResourcesEmpty": "Geen bronnen met doelen in de eerste 10 resultaten.",
+    "alertingSectionTrigger": "Trigger",
+    "alertingTrigger": "Wanneer te waarschuwen",
+    "alertingTriggerSiteOnline": "Site online",
+    "alertingTriggerSiteOffline": "Site offline",
+    "alertingTriggerSiteToggle": "Site status wijzigt",
+    "alertingTriggerHcHealthy": "Gezondheidscontrole gezond",
+    "alertingTriggerHcUnhealthy": "Gezondheidscontrole ongezond",
+    "alertingTriggerHcToggle": "Gezondheidscontrole status verandert",
+    "alertingTriggerResourceHealthy": "Bron gezond",
+    "alertingTriggerResourceUnhealthy": "Bron ongezond",
+    "alertingTriggerResourceDegraded": "Bron gedegradeerd",
+    "alertingSearchHealthChecks": "Zoek gezondheidscontroles…",
+    "alertingHealthChecksEmpty": "Geen gezondheidscontroles beschikbaar.",
+    "alertingTriggerResourceToggle": "Bronstatus wijzigt",
+    "alertingSourceResource": "Bron",
+    "alertingSectionActions": "Acties",
+    "alertingAddAction": "Actie toevoegen",
+    "alertingActionNotify": "E-mail",
+    "alertingActionNotifyDescription": "Stuur e-mailmeldingen naar gebruikers of rollen",
+    "alertingActionWebhook": "Webhook",
+    "alertingActionWebhookDescription": "Stuur een HTTP-verzoek naar een aangepast eindpunt",
+    "alertingExternalIntegration": "Externe integratie",
+    "alertingExternalPagerDutyDescription": "Stuur waarschuwingen naar PagerDuty voor incidentbeheer",
+    "alertingExternalOpsgenieDescription": "Routeer waarschuwingen naar Opsgenie voor wachtdienstbeheer",
+    "alertingExternalServiceNowDescription": "Maak ServiceNow-incidenten aan vanuit waarschuwingsgebeurtenissen",
+    "alertingExternalIncidentIoDescription": "Trigger Incident.io workflows van waarschuwingsgebeurtenissen",
+    "alertingActionType": "Actietype",
+    "alertingNotifyUsers": "Gebruikers",
+    "alertingNotifyRoles": "Rollen",
+    "alertingNotifyEmails": "E-mailadressen",
+    "alertingEmailPlaceholder": "Voeg e-mail toe en druk op Enter",
+    "alertingWebhookMethod": "HTTP-methode",
+    "alertingWebhookSecret": "Ondertekengeheim (optioneel)",
+    "alertingWebhookSecretPlaceholder": "HMAC-geheim",
+    "alertingWebhookHeaders": "Headers",
+    "alertingAddHeader": "Header toevoegen",
+    "alertingSelectSites": "Selecteer sites…",
+    "alertingSitesSelected": "{count} sites geselecteerd",
+    "alertingSelectHealthChecks": "Selecteer gezondheidscontroles…",
+    "alertingHealthChecksSelected": "{count} gezondheidscontroles geselecteerd",
+    "alertingNoHealthChecks": "Geen doelen met ingeschakelde gezondheidscontroles",
+    "alertingHealthCheckStub": "Gezondheidscontrole brondeselectie is nog niet gekoppeld - u kunt nog steeds triggers en acties configureren.",
+    "alertingSelectUsers": "Selecteer gebruikers…",
+    "alertingUsersSelected": "{count} gebruikers geselecteerd",
+    "alertingSelectRoles": "Selecteer rollen…",
+    "alertingRolesSelected": "{count} rollen geselecteerd",
+    "alertingSummarySites": "Sites ({count})",
+    "alertingSummaryAllSites": "Alle sites",
+    "alertingSummaryHealthChecks": "Gezondheidscontroles ({count})",
+    "alertingSummaryAllHealthChecks": "Alle gezondheidscontroles",
+    "alertingSummaryResources": "Bronnen ({count})",
+    "alertingSummaryAllResources": "Alle bronnen",
+    "alertingErrorNameRequired": "Voer een naam in",
+    "alertingErrorActionsMin": "Voeg minimaal één actie toe",
+    "alertingErrorPickSites": "Selecteer minimaal één site",
+    "alertingErrorPickHealthChecks": "Selecteer minimaal één gezondheidscontrole",
+    "alertingErrorPickResources": "Selecteer minimaal één bron",
+    "alertingErrorTriggerSite": "Kies een site-trigger",
+    "alertingErrorTriggerHealth": "Kies een gezondheidscontrole-trigger",
+    "alertingErrorTriggerResource": "Kies een bron-trigger",
+    "alertingErrorNotifyRecipients": "Kies gebruikers, rollen of ten minste één e-mail",
+    "alertingConfigureSource": "Bron configureren",
+    "alertingConfigureTrigger": "Trigger configureren",
+    "alertingConfigureActions": "Acties configureren",
+    "alertingBackToRules": "Terug naar regels",
+    "alertingRuleCooldown": "Aflkoelperiode (seconden)",
+    "alertingRuleCooldownDescription": "Minimale tijd tussen herhaalwaarschuwingen voor dezelfde regel. Zet op 0 om elke keer te laten vuren.",
+    "alertingDraftBadge": "Concept - opslaan om deze regel op te slaan",
+    "alertingSidebarHint": "Klik op een stap in het canvas om deze hier te bewerken.",
+    "alertingGraphCanvasTitle": "Regelstroom",
+    "alertingGraphCanvasDescription": "Visueel overzicht van bron, trigger en acties. Selecteer een node om deze in het paneel te bewerken.",
+    "alertingNodeNotConfigured": "Nog niet geconfigureerd",
+    "alertingNodeActionsCount": "{count, plural, one {# actie} other {# acties}}",
+    "alertingNodeRoleSource": "Bron",
+    "alertingNodeRoleTrigger": "Trigger",
+    "alertingNodeRoleAction": "Actie",
+    "alertingTabRules": "Waarschuwingsregels",
+    "alertingTabHealthChecks": "Gezondheidscontroles",
+    "alertingRulesBannerTitle": "Meldingen ontvangen",
+    "alertingRulesBannerDescription": "Elke regel koppelt wat te bekijken (een site, gezondheidscontrole of bron), wanneer te vuren (bijvoorbeeld offline of ongezond), en hoe uw team te waarschuwen via e-mail, webhooks of integraties. Gebruik deze lijst om die regels te maken, in te schakelen en te beheren.",
+    "alertingHealthChecksBannerTitle": "Gezondheid & bronnen bewaken",
+    "alertingHealthChecksBannerDescription": "Gezondheidscontroles zijn HTTP- of TCP-monitoren die u één keer definieert. U kunt ze vervolgens als bronnen in waarschuwingsregels gebruiken, zodat u meldingen krijgt wanneer een doelwit gezond of ongezond wordt. Gezondheidscontroles van bronnen verschijnen ook hier.",
+    "standaloneHcTableTitle": "Gezondheidscontroles",
+    "standaloneHcSearchPlaceholder": "Zoek gezondheidscontroles…",
+    "standaloneHcAddButton": "Gezondheidscontrole aanmaken",
+    "standaloneHcCreateTitle": "Gezondheidscontrole aanmaken",
+    "standaloneHcEditTitle": "Gezondheidscontrole bewerken",
+    "standaloneHcDescription": "Configureer een HTTP- of TCP-gezondheidscontrole voor gebruik in waarschuwingsregels.",
+    "standaloneHcNameLabel": "Naam",
+    "standaloneHcNamePlaceholder": "Mijn HTTP-monitor",
+    "standaloneHcDeleteTitle": "Gezondheidscontrole verwijderen",
+    "standaloneHcDeleteQuestion": "Bevestig alstublieft dat u deze gezondheidscontrole wilt verwijderen.",
+    "standaloneHcDeleted": "Gezondheidscontrole verwijderd",
+    "standaloneHcSaved": "Gezondheidscontrole opgeslagen",
+    "standaloneHcColumnHealth": "Gezondheid",
+    "standaloneHcColumnMode": "Modus",
+    "standaloneHcColumnTarget": "Doelwit",
+    "standaloneHcHealthStateHealthy": "Gezond",
+    "standaloneHcHealthStateUnhealthy": "Ongezond",
+    "standaloneHcHealthStateUnknown": "Onbekend",
+    "standaloneHcFilterAnySite": "Alle sites",
+    "standaloneHcFilterAnyResource": "Alle bronnen",
+    "standaloneHcFilterMode": "Modus",
+    "standaloneHcFilterModeHttp": "HTTP",
+    "standaloneHcFilterModeTcp": "TCP",
+    "standaloneHcFilterModeSnmp": "SNMP",
+    "standaloneHcFilterModePing": "Ping",
+    "standaloneHcFilterHealth": "Gezondheid",
+    "standaloneHcFilterEnabled": "Ingeschakeld",
+    "standaloneHcFilterEnabledOn": "Ingeschakeld",
+    "standaloneHcFilterEnabledOff": "Uitgeschakeld",
+    "standaloneHcFilterSiteIdFallback": "Site {id}",
+    "standaloneHcFilterResourceIdFallback": "Bron {id}",
     "blueprints": "Blauwdrukken",
-    "blueprintsDescription": "Gebruik declaratieve configuraties en bekijk vorige uitvoeringen.",
+    "blueprintsLog": "Blueprints Log",
+    "blueprintsDescription": "View past blueprint applications and their results",
     "blueprintAdd": "Blauwdruk toevoegen",
     "blueprintGoBack": "Bekijk alle Blauwdrukken",
     "blueprintCreate": "Creëer blauwdruk",
@@ -1357,7 +1664,17 @@
     "contents": "Inhoud",
     "parsedContents": "Geparseerde inhoud (alleen lezen)",
     "enableDockerSocket": "Schakel Docker Blauwdruk in",
-    "enableDockerSocketDescription": "Schakel Docker Socket label in voor blauwdruk labels. Pad naar Nieuw.",
+    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
+    "newtAutoUpdate": "Enable Site Auto-Update",
+    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
+    "siteAutoUpdate": "Site Auto-Update",
+    "siteAutoUpdateLabel": "Enable Auto-Update",
+    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
+    "siteAutoUpdateOrgDefault": "Organization default: {state}",
+    "siteAutoUpdateOverriding": "Overriding organization setting",
+    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
+    "siteAutoUpdateEnabled": "enabled",
+    "siteAutoUpdateDisabled": "disabled",
     "viewDockerContainers": "Bekijk Docker containers",
     "containersIn": "Containers in {siteName}",
     "selectContainerDescription": "Selecteer een container om als hostnaam voor dit doel te gebruiken. Klik op een poort om een poort te gebruiken.",
@@ -1399,8 +1716,10 @@
     "initialSetupDescription": "Maak het eerste serverbeheeraccount aan. Er kan slechts één serverbeheerder bestaan. U kunt deze inloggegevens later altijd wijzigen.",
     "createAdminAccount": "Maak een beheeraccount aan",
     "setupErrorCreateAdmin": "Er is een fout opgetreden bij het maken van het serverbeheerdersaccount.",
-    "certificateStatus": "Certificaatstatus",
+    "certificateStatus": "Certificaat",
+    "certificateStatusAutoRefreshHint": "Status ververst automatisch.",
     "loading": "Bezig met laden",
+    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Laden van Analytics",
     "restart": "Herstarten",
     "domains": "Domeinen",
@@ -1468,6 +1787,7 @@
     "pangolinUpdateAvailableReleaseNotes": "Uitgaveopmerkingen bekijken",
     "newtUpdateAvailable": "Update beschikbaar",
     "newtUpdateAvailableInfo": "Er is een nieuwe versie van Newt beschikbaar. Update naar de nieuwste versie voor de beste ervaring.",
+    "pangolinNodeUpdateAvailableInfo": "Er is een nieuwe versie van Pangolin Node beschikbaar. Update naar de nieuwste versie voor de beste ervaring.",
     "domainPickerEnterDomain": "Domein",
     "domainPickerPlaceholder": "mijnapp.voorbeeld.nl",
     "domainPickerDescription": "Voer de volledige domein van de bron in om beschikbare opties te zien.",
@@ -1626,6 +1946,7 @@
     "billingManageLicenseSubscription": "Beheer je abonnement voor betaalde zelf gehoste licentiesleutels",
     "billingCurrentKeys": "Huidige toetsen",
     "billingModifyCurrentPlan": "Huidig plan wijzigen",
+    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Bevestig Upgrade",
     "billingConfirmDowngrade": "Downgraden bevestigen",
     "billingConfirmUpgradeDescription": "U staat op het punt uw abonnement te upgraden. Controleer de nieuwe limieten en prijzen hieronder.",
@@ -1707,6 +2028,7 @@
     "configureHealthCheck": "Configureer Gezondheidscontrole",
     "configureHealthCheckDescription": "Stel gezondheid monitor voor {target} in",
     "enableHealthChecks": "Inschakelen Gezondheidscontroles",
+    "healthCheckDisabledStateDescription": "Wanneer uitgeschakeld, zal de site geen gezondheidscontroles uitvoeren en wordt de staat als onbekend beschouwd.",
     "enableHealthChecksDescription": "Controleer de gezondheid van dit doel. U kunt een ander eindpunt monitoren dan het doel indien vereist.",
     "healthScheme": "Methode",
     "healthSelectScheme": "Selecteer methode",
@@ -1722,7 +2044,36 @@
     "timeIsInSeconds": "Tijd is in seconden",
     "requireDeviceApproval": "Vereist goedkeuring van apparaat",
     "requireDeviceApprovalDescription": "Gebruikers met deze rol hebben nieuwe apparaten nodig die door een beheerder zijn goedgekeurd voordat ze verbinding kunnen maken met bronnen en deze kunnen gebruiken.",
-    "sshAccess": "SSH toegang",
+    "sshSettings": "SSH Settings",
+    "rdpSettings": "RDP Settings",
+    "vncSettings": "VNC Settings",
+    "sshServer": "SSH Server",
+    "rdpServer": "RDP Server",
+    "vncServer": "VNC Server",
+    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
+    "rdpServerDescription": "Configure the destination and port of the RDP server",
+    "vncServerDescription": "Configure the destination and port of the VNC server",
+    "sshServerMode": "Mode",
+    "sshServerModeStandard": "Standard SSH Server",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
+    "sshServerModeNative": "Native SSH Server",
+    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
+    "sshAuthenticationMethod": "Authentication Method",
+    "sshAuthMethodManual": "Manual Authentication",
+    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
+    "sshAuthMethodAutomated": "Automated Provisioning",
+    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
+    "sshAuthDaemonLocation": "Auth Daemon Location",
+    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
+    "sshDaemonLocationRemote": "On Remote Host",
+    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
+    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
+    "sshDaemonPort": "Daemon Port",
+    "sshServerDestination": "Server Destination",
+    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
+    "destination": "Destination",
+    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
     "roleAllowSsh": "SSH toestaan",
     "roleAllowSshAllow": "Toestaan",
     "roleAllowSshDisallow": "Weigeren",
@@ -1736,7 +2087,7 @@
     "sshSudoModeCommandsDescription": "Gebruiker kan alleen de opgegeven commando's uitvoeren met de sudo.",
     "sshSudo": "sudo toestaan",
     "sshSudoCommands": "Sudo Commando's",
-    "sshSudoCommandsDescription": "Komma's gescheiden lijst van commando's waar de gebruiker een sudo mee mag uitvoeren.",
+    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
     "sshCreateHomeDir": "Maak Home Directory",
     "sshUnixGroups": "Unix groepen",
     "sshUnixGroupsDescription": "Door komma's gescheiden Unix-groepen om de gebruiker toe te voegen aan de doelhost.",
@@ -1756,9 +2107,20 @@
     "healthCheckIntervalMin": "Controle interval moet minimaal 5 seconden zijn",
     "healthCheckTimeoutMin": "Timeout moet minimaal 1 seconde zijn",
     "healthCheckRetryMin": "Herhaal pogingen moet minimaal 1 zijn",
+    "healthCheckMode": "Controlemodus",
+    "healthCheckStrategy": "Strategie",
+    "healthCheckModeDescription": "TCP-modus verifieert alleen connectiviteit. HTTP-modus valideert de HTTP-respons.",
+    "healthyThreshold": "Gezonde drempel",
+    "healthyThresholdDescription": "Opeenvolgende successen vereist voordat gemarkeerd wordt als gezond.",
+    "unhealthyThreshold": "Ongezonde drempel",
+    "unhealthyThresholdDescription": "Opeenvolgende fouten vereist voordat gemarkeerd wordt als ongezond.",
+    "healthCheckHealthyThresholdMin": "Gezonde drempel moet minimaal 1 zijn",
+    "healthCheckUnhealthyThresholdMin": "Ongezonde drempel moet minimaal 1 zijn",
     "httpMethod": "HTTP-methode",
     "selectHttpMethod": "Selecteer HTTP-methode",
     "domainPickerSubdomainLabel": "Subdomein",
+    "domainPickerWildcard": "Wildcard",
+    "domainPickerWildcardPaidOnly": "Wildcard-subdomeinen zijn een betaalde functie. Upgrade om deze functie te gebruiken.",
     "domainPickerBaseDomainLabel": "Basisdomein",
     "domainPickerSearchDomains": "Zoek domeinen...",
     "domainPickerNoDomainsFound": "Geen domeinen gevonden",
@@ -1784,12 +2146,12 @@
     "resourcesTableAliasAddressInfo": "Dit adres is onderdeel van het hulpprogramma subnet van de organisatie. Het wordt gebruikt om aliasrecords op te lossen met behulp van interne DNS-resolutie.",
     "resourcesTableClients": "Clienten",
     "resourcesTableAndOnlyAccessibleInternally": "en zijn alleen intern toegankelijk wanneer verbonden met een client.",
-    "resourcesTableNoTargets": "Geen doelen",
     "resourcesTableHealthy": "Gezond",
     "resourcesTableDegraded": "Verminderde",
-    "resourcesTableOffline": "Offline",
+    "resourcesTableUnhealthy": "Ongezond",
     "resourcesTableUnknown": "onbekend",
     "resourcesTableNotMonitored": "Niet gecontroleerd",
+    "resourcesTableNoTargets": "Geen doelen",
     "editInternalResourceDialogEditClientResource": "Privépagina bewerken",
     "editInternalResourceDialogUpdateResourceProperties": "Update de resource configuratie en access control voor {resourceName}",
     "editInternalResourceDialogResourceProperties": "Bron eigenschappen",
@@ -1815,6 +2177,12 @@
     "editInternalResourceDialogModePort": "Poort",
     "editInternalResourceDialogModeHost": "Hostnaam",
     "editInternalResourceDialogModeCidr": "CIDR",
+    "editInternalResourceDialogModeHttp": "HTTP",
+    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
+    "editInternalResourceDialogScheme": "Schema",
+    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
     "editInternalResourceDialogDestination": "Bestemming",
     "editInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
     "editInternalResourceDialogDestinationIPDescription": "Het IP of hostnaam adres van de bron op het netwerk van de site.",
@@ -1830,6 +2198,7 @@
     "createInternalResourceDialogName": "Naam",
     "createInternalResourceDialogSite": "Site",
     "selectSite": "Selecteer site...",
+    "multiSitesSelectorSitesCount": "{count, plural, one {# site} other {# sites}}",
     "noSitesFound": "Geen sites gevonden.",
     "createInternalResourceDialogProtocol": "Protocol",
     "createInternalResourceDialogTcp": "TCP",
@@ -1858,11 +2227,20 @@
     "createInternalResourceDialogModePort": "Poort",
     "createInternalResourceDialogModeHost": "Hostnaam",
     "createInternalResourceDialogModeCidr": "CIDR",
+    "createInternalResourceDialogModeHttp": "HTTP",
+    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
+    "scheme": "Schema",
+    "createInternalResourceDialogScheme": "Schema",
+    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
     "createInternalResourceDialogDestination": "Bestemming",
     "createInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
     "createInternalResourceDialogDestinationCidrDescription": "Het CIDR-bereik van het document op het netwerk van de site.",
     "createInternalResourceDialogAlias": "Alias",
     "createInternalResourceDialogAliasDescription": "Een optionele interne DNS-alias voor dit document.",
+    "internalResourceDownstreamSchemeRequired": "Schema is vereist voor HTTP-bronnen",
+    "internalResourceHttpPortRequired": "Bestemmingspoort is vereist voor HTTP-bronnen",
     "siteConfiguration": "Configuratie",
     "siteAcceptClientConnections": "Accepteer clientverbindingen",
     "siteAcceptClientConnectionsDescription": "Sta gebruikersapparaten en clients toegang toe tot bronnen op deze site. Dit kan later worden gewijzigd.",
@@ -1987,7 +2365,7 @@
         "description": "betrouwbaardere en slecht onderhouden Pangolin server met extra klokken en klokkenluiders",
         "introTitle": "Beheerde zelfgehoste pangolin",
         "introDescription": "is een implementatieoptie ontworpen voor mensen die eenvoud en extra betrouwbaarheid willen, terwijl hun gegevens privé en zelf georganiseerd blijven.",
-        "introDetail": "Met deze optie beheert u nog steeds uw eigen Pangolin node - uw tunnels, SSL-verbinding en verkeer alles op uw server. Het verschil is dat beheer en monitoring worden behandeld via onze cloud dashboard, wat een aantal voordelen oplevert:",
+        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
         "benefitSimplerOperations": {
             "title": "Simpler operaties",
             "description": "Je hoeft geen eigen mailserver te draaien of complexe waarschuwingen in te stellen. Je krijgt gezondheidscontroles en downtime meldingen uit de box."
@@ -2020,7 +2398,7 @@
     },
     "internationaldomaindetected": "Internationaal Domein Gedetecteerd",
     "willbestoredas": "Zal worden opgeslagen als:",
-    "roleMappingDescription": "Bepaal hoe rollen worden toegewezen aan gebruikers wanneer ze inloggen wanneer Auto Provision is ingeschakeld.",
+    "roleMappingDescription": "Bepaal hoe rollen aan gebruikers worden toegewezen wanneer ze zich aanmelden met deze identiteitsprovider.",
     "selectRole": "Selecteer een rol",
     "roleMappingExpression": "Expressie",
     "selectRolePlaceholder": "Kies een rol",
@@ -2112,9 +2490,11 @@
     "selectDomainForOrgAuthPage": "Selecteer een domein voor de authenticatiepagina van de organisatie",
     "domainPickerProvidedDomain": "Opgegeven domein",
     "domainPickerFreeProvidedDomain": "Gratis verstrekt domein",
+    "domainPickerFreeDomainsPaidFeature": "Geleverde domeinen zijn een betaalde functie. Abonneer je om een domein bij je plan te krijgen - je hoeft er zelf geen mee te brengen.",
     "domainPickerVerified": "Geverifieerd",
     "domainPickerUnverified": "Ongeverifieerd",
-    "domainPickerInvalidSubdomainStructure": "Dit subdomein bevat ongeldige tekens of structuur. Het zal automatisch worden gesaneerd wanneer u opslaat.",
+    "domainPickerManual": "Handleiding",
+    "domainPickerInvalidSubdomainStructure": "Ongeldige tekens worden gesaneerd bij het opslaan.",
     "domainPickerError": "Foutmelding",
     "domainPickerErrorLoadDomains": "Fout bij het laden van organisatiedomeinen",
     "domainPickerErrorCheckAvailability": "Kan domein beschikbaarheid niet controleren",
@@ -2127,7 +2507,7 @@
     "orgAuthChooseIdpDescription": "Kies uw identiteitsprovider om door te gaan",
     "orgAuthNoIdpConfigured": "Deze organisatie heeft geen identiteitsproviders geconfigureerd. Je kunt in plaats daarvan inloggen met je Pangolin-identiteit.",
     "orgAuthSignInWithPangolin": "Log in met Pangolin",
-    "orgAuthSignInToOrg": "Log in bij een organisatie",
+    "orgAuthSignInToOrg": "Organisatie Identiteitsprovider (SSO)",
     "orgAuthSelectOrgTitle": "Organisatie Inloggen",
     "orgAuthSelectOrgDescription": "Voer je organisatie-ID in om verder te gaan",
     "orgAuthOrgIdPlaceholder": "jouw-organisatie",
@@ -2343,10 +2723,10 @@
             },
             "scale": {
                 "title": "Schaal",
-                "description": "Enterprise functies, 50 gebruikers, 50 sites en prioriteit ondersteuning."
+                "description": "Enterprise-functies, 50 gebruikers, 100 sites en prioritaire ondersteuning."
             }
         },
-        "personalUseOnly": "Alleen persoonlijk gebruik (gratis licentie - geen afrekenen)",
+        "personalUseOnly": "Alleen voor persoonlijk gebruik (gratis licentie - geen afrekening)",
         "buttons": {
             "continueToCheckout": "Doorgaan naar afrekenen"
         },
@@ -2420,6 +2800,9 @@
     "validPassword": "Geldig wachtwoord",
     "validEmail": "Valid email",
     "validSSO": "Valid SSO",
+    "view": "Bekijk",
+    "configManaged": "Configuratie Beheerd",
+    "connectedClient": "Verbonden Client",
     "resourceBlocked": "Bron geblokkeerd",
     "droppedByRule": "Achtergelaten door regel",
     "noSessions": "Geen sessies",
@@ -2427,19 +2810,19 @@
     "noMoreAuthMethods": "No Valid Auth",
     "ip": "IP-adres",
     "reason": "Reden",
-    "requestLogs": "Logboeken aanvragen",
+    "requestLogs": "HTTP-aanvraaglogboeken",
     "requestAnalytics": "Analytics opvragen",
     "host": "Hostnaam",
     "location": "Locatie",
     "actionLogs": "Actie logs",
-    "sidebarLogsRequest": "Logboeken aanvragen",
+    "sidebarLogsRequest": "HTTP-aanvraaglogboeken",
     "sidebarLogsAccess": "Toegang tot logboek",
     "sidebarLogsAction": "Actie logs",
     "logRetention": "Log bewaring",
     "logRetentionDescription": "Beheren hoe lang verschillende soorten logs bewaard worden voor deze organisatie of schakel ze uit",
     "requestLogsDescription": "Bekijk gedetailleerde verzoeklogboeken voor resources in deze organisatie",
     "requestAnalyticsDescription": "Bekijk gedetailleerde request analytics voor resources in deze organisatie",
-    "logRetentionRequestLabel": "Logboekbewaring aanvragen",
+    "logRetentionRequestLabel": "Bewaring van HTTP-aanvraaglogboeken",
     "logRetentionRequestDescription": "Hoe lang de aanvraaglogboeken te behouden",
     "logRetentionAccessLabel": "Toegang logboek bewaring",
     "logRetentionAccessDescription": "Hoe lang de toegangslogboeken behouden blijven",
@@ -2607,6 +2990,9 @@
     "machineClients": "Machine Clienten",
     "install": "Installeren",
     "run": "Uitvoeren",
+    "envFile": "Omgevingsbestand",
+    "serviceFile": "Servicebestand",
+    "enableAndStart": "Inschakelen en Starten",
     "clientNameDescription": "De weergavenaam van de client die later gewijzigd kan worden.",
     "clientAddress": "Klant adres (Geavanceerd)",
     "setupFailedToFetchSubnet": "Kan standaard subnet niet ophalen",
@@ -2655,7 +3041,13 @@
     "editInternalResourceDialogAddClients": "Clienten toevoegen",
     "editInternalResourceDialogDestinationLabel": "Bestemming",
     "editInternalResourceDialogDestinationDescription": "Specificeer het bestemmingsadres voor de interne bron. Dit kan een hostnaam, IP-adres of CIDR-bereik zijn, afhankelijk van de geselecteerde modus. Stel optioneel een interne DNS-alias in voor eenvoudigere identificatie.",
+    "internalResourceFormMultiSiteRoutingHelp": "Selecteren van meerdere sites maakt veerkrachtige routing en failover mogelijk voor hoge beschikbaarheid.",
+    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Meer informatie",
     "editInternalResourceDialogPortRestrictionsDescription": "Beperk toegang tot specifieke TCP/UDP-poorten of sta alle poorten toe/blokkeer.",
+    "createInternalResourceDialogHttpConfiguration": "HTTP-configuratie",
+    "createInternalResourceDialogHttpConfigurationDescription": "Kies het domein dat cliënten zullen gebruiken om deze bron via HTTP of HTTPS te bereiken.",
+    "editInternalResourceDialogHttpConfiguration": "HTTP-configuratie",
+    "editInternalResourceDialogHttpConfigurationDescription": "Kies het domein dat cliënten zullen gebruiken om deze bron via HTTP of HTTPS te bereiken.",
     "editInternalResourceDialogTcp": "TCP",
     "editInternalResourceDialogUdp": "UDP",
     "editInternalResourceDialogIcmp": "ICMP",
@@ -2677,7 +3069,7 @@
     "learnMore": "Meer informatie",
     "backToHome": "Ga terug naar startpagina",
     "needToSignInToOrg": "Moet u de identiteit provider van uw organisatie gebruiken?",
-    "maintenanceMode": "Onderhoudsmodus",
+    "maintenanceMode": "Maintenance Page",
     "maintenanceModeDescription": "Toon een onderhoudspagina aan bezoekers",
     "maintenanceModeType": "Type onderhoudsmodus",
     "showMaintenancePage": "Toon een onderhoudspagina aan bezoekers",
@@ -2694,6 +3086,9 @@
     "maintenancePageMessagePlaceholder": "We keren snel terug! Onze site ondergaat momenteel gepland onderhoud.",
     "maintenancePageMessageDescription": "Gedetailleerd bericht dat het onderhoud uitlegt",
     "maintenancePageTimeTitle": "Geschatte voltooiingstijd (optioneel)",
+    "privateMaintenanceScreenTitle": "Privéscherm maintenance screen",
+    "privateMaintenanceScreenMessage": "Dit domein wordt gebruikt op een privébron. Verbind met de Pangolin client om toegang te krijgen tot deze bron.",
+    "privateMaintenanceScreenSteps": "Eenmaal verbonden, als u dit bericht nog steeds ziet, kan het DNS-cache van uw browser nog steeds naar het oude adres wijzen. Om dit te corrigeren: sluit en heropen dit tabblad, of uw browser, dan navigeer weer naar deze pagina.",
     "maintenanceTime": "bijv. 2 uur, 1 nov om 17:00",
     "maintenanceEstimatedTimeDescription": "Wanneer u verwacht dat het onderhoud voltooid is",
     "editDomain": "Domein bewerken",
@@ -2704,6 +3099,7 @@
     "maintenanceScreenEstimatedCompletion": "Geschatte voltooiing:",
     "createInternalResourceDialogDestinationRequired": "Bestemming is vereist",
     "available": "Beschikbaar",
+    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Gearchiveerd",
     "noArchivedDevices": "Geen gearchiveerde apparaten gevonden",
     "deviceArchived": "Apparaat gearchiveerd",
@@ -2817,7 +3213,7 @@
     "streamingDatadogTitle": "Datadog",
     "streamingDatadogDescription": "Stuur gebeurtenissen rechtstreeks door naar je Datadog account. Binnenkort beschikbaar.",
     "streamingTypePickerDescription": "Kies een bestemmingstype om te beginnen.",
-    "streamingFailedToLoad": "Laden van bestemmingen mislukt",
+    "streamingLastSyncError": "Er is een fout opgetreden bij de laatste synchronisatie",
     "streamingUnexpectedError": "Er is een onverwachte fout opgetreden.",
     "streamingFailedToUpdate": "Bijwerken bestemming mislukt",
     "streamingDeletedSuccess": "Bestemming succesvol verwijderd",
@@ -2831,6 +3227,41 @@
     "httpDestAddTitle": "Voeg HTTP bestemming toe",
     "httpDestEditDescription": "Werk de configuratie voor deze HTTP-event streaming bestemming bij.",
     "httpDestAddDescription": "Configureer een nieuw HTTP-eindpunt om de gebeurtenissen van uw organisatie te ontvangen.",
+    "S3DestEditTitle": "Bestemming bewerken",
+    "S3DestAddTitle": "S3-bestemming toevoegen",
+    "S3DestEditDescription": "Werk de configuratie bij voor deze S3-gebeurtenisstreamingbestemming.",
+    "S3DestAddDescription": "Configureer een nieuwe Amazon S3 (of S3-compatibele) bucket om de gebeurtenissen van uw organisatie te ontvangen.",
+    "s3DestTabSettings": "Instellingen",
+    "s3DestTabFormat": "Formaat",
+    "s3DestNameLabel": "Naam",
+    "s3DestNamePlaceholder": "Mijn S3-bestemming",
+    "s3DestAccessKeyIdLabel": "AWS-toegangssleutel-ID",
+    "s3DestSecretAccessKeyLabel": "AWS Geheime Toegangssleutel",
+    "s3DestSecretAccessKeyPlaceholder": "Uw AWS geheime toegangssleutel",
+    "s3DestRegionLabel": "AWS-regio",
+    "s3DestBucketLabel": "Bucketnaam",
+    "s3DestPrefixLabel": "Sleutelvoorvoegsel (optioneel)",
+    "s3DestPrefixDescription": "Optioneel padvoorvoegsel dat aan elke object sleutel wordt toegevoegd. Objecten worden opgeslagen op {prefix}/{logType}/{YYYY}/{MM}/{DD}/{filename}.",
+    "s3DestEndpointLabel": "Aangepast Eindpunt (optioneel)",
+    "s3DestEndpointDescription": "Overschrijf het S3-eindpunt voor S3-compatibele opslag zoals MinIO of Cloudflare R2. Laat leeg voor standaard AWS S3.",
+    "s3DestGzipLabel": "Gzip-compressie",
+    "s3DestGzipDescription": "Comprimeer elk geüpload object met gzip. Verlaagt opslagkosten en uploadgrootte.",
+    "s3DestFormatTitle": "Bestandsformaat",
+    "s3DestFormatDescription": "Hoe gebeurtenissen binnen elk geüpload object worden geserialiseerd.",
+    "s3DestFormatJsonArrayDescription": "Elk object is een JSON-array van gebeurtenisrecords. Compatibel met de meeste analysetools.",
+    "s3DestFormatNdjsonDescription": "Elk object bevat één JSON-record per regel (nieuwregel-gescheiden JSON). Compatibel met Athena, BigQuery en Spark.",
+    "s3DestFormatCsvTitle": "CSV",
+    "s3DestFormatCsvDescription": "Elk object is een RFC-4180 CSV-bestand met een kopregel. Kolomnamen zijn afgeleid van de gebeurtenis gegevensvelden.",
+    "s3DestSaveChanges": "Wijzigingen opslaan",
+    "s3DestCreateDestination": "Bestemming maken",
+    "s3DestUpdatedSuccess": "Bestemming succesvol bijgewerkt",
+    "s3DestCreatedSuccess": "Bestemming succesvol gecreëerd",
+    "s3DestUpdateFailed": "Bijwerken bestemming mislukt",
+    "s3DestCreateFailed": "Aanmaken bestemming mislukt",
+    "datadogDestEditTitle": "Bestemming bewerken",
+    "datadogDestAddTitle": "Datadog-bestemming toevoegen",
+    "datadogDestEditDescription": "Werk de configuratie bij voor deze Datadog-gebeurtenisstreamingbestemming.",
+    "datadogDestAddDescription": "Configureer een nieuw Datadog-eindpunt om de gebeurtenissen van uw organisatie te ontvangen.",
     "httpDestTabSettings": "Instellingen",
     "httpDestTabHeaders": "Kopteksten",
     "httpDestTabBody": "Lichaam",
@@ -2845,10 +3276,10 @@
     "httpDestAuthNoneTitle": "Geen authenticatie",
     "httpDestAuthNoneDescription": "Stuurt verzoeken zonder toestemmingskop.",
     "httpDestAuthBearerTitle": "Betere Token",
-    "httpDestAuthBearerDescription": "Voegt een machtiging toe: Drager <token> header aan elke aanvraag.",
+    "httpDestAuthBearerDescription": "Voegt een Authorization: Bearer '<token>' header toe aan elk verzoek.",
     "httpDestAuthBearerPlaceholder": "Uw API-sleutel of -token",
     "httpDestAuthBasicTitle": "Basis authenticatie",
-    "httpDestAuthBasicDescription": "Voegt een Authorizatie toe: Basis <credentials> kop. Geef inloggegevens op als gebruikersnaam:wachtwoord.",
+    "httpDestAuthBasicDescription": "Voegt een Authorization: Basic '<credentials>' header toe. Verstrek inloggegevens als gebruikersnaam:wachtwoord.",
     "httpDestAuthBasicPlaceholder": "Gebruikersnaam:wachtwoord",
     "httpDestAuthCustomTitle": "Aangepaste koptekst",
     "httpDestAuthCustomDescription": "Specificeer een aangepaste HTTP header naam en waarde voor authenticatie (bijv. X-API-Key).",
@@ -2881,12 +3312,123 @@
     "httpDestActionLogsDescription": "Administratieve acties uitgevoerd door gebruikers binnen de organisatie.",
     "httpDestConnectionLogsTitle": "Connectie Logs",
     "httpDestConnectionLogsDescription": "Verbinding met de Site en tunnel maken verbroken, inclusief verbindingen en verbindingen.",
-    "httpDestRequestLogsTitle": "Logboeken aanvragen",
+    "httpDestRequestLogsTitle": "HTTP-aanvraaglogboeken",
     "httpDestRequestLogsDescription": "HTTP request logs voor proxied hulpmiddelen, waaronder methode, pad en response code.",
     "httpDestSaveChanges": "Wijzigingen opslaan",
     "httpDestCreateDestination": "Maak bestemming aan",
     "httpDestUpdatedSuccess": "Bestemming succesvol bijgewerkt",
     "httpDestCreatedSuccess": "Bestemming succesvol aangemaakt",
     "httpDestUpdateFailed": "Bijwerken bestemming mislukt",
-    "httpDestCreateFailed": "Aanmaken bestemming mislukt"
+    "httpDestCreateFailed": "Aanmaken bestemming mislukt",
+    "followRedirects": "Volg omleidingen",
+    "followRedirectsDescription": "Volg automatisch HTTP-omleidingen voor verzoeken.",
+    "alertingErrorWebhookUrl": "Voer een geldige URL voor de webhook in.",
+    "healthCheckStrategyHttp": "Valideert connectiviteit en controleert de HTTP-responsstatus.",
+    "healthCheckStrategyTcp": "Verifieert alleen TCP-connectiviteit zonder de respons te inspecteren.",
+    "healthCheckStrategySnmp": "Maakt een SNMP-verzoek om de gezondheid van netwerkapparaten en infrastructuur te controleren.",
+    "healthCheckStrategyIcmp": "Gebruikt ICMP-verzoeken (pings) om te controleren of een bron bereikbaar en responsief is.",
+    "healthCheckTabStrategy": "Strategie",
+    "healthCheckTabConnection": "Verbinding",
+    "healthCheckTabAdvanced": "Geavanceerd",
+    "healthCheckStrategyNotAvailable": "Deze strategie is niet beschikbaar. Neem contact op met sales om deze functie in te schakelen.",
+    "uptime30d": "Beschikbaarheid (30d)",
+    "idpAddActionCreateNew": "Nieuwe identiteitsprovider aanmaken",
+    "idpAddActionImportFromOrg": "Importeer vanuit een andere organisatie",
+    "idpImportDialogTitle": "Importeer Identiteitsprovider",
+    "idpImportDialogDescription": "Kies een identiteitsprovider van een organisatie waar u beheerder bent. Het wordt gekoppeld aan deze organisatie.",
+    "idpImportSearchPlaceholder": "Zoek op organisatie- of providernamen...",
+    "idpImportEmpty": "Geen identiteitsproviders gevonden.",
+    "idpImportedDescription": "Identiteitsprovider succesvol geïmporteerd.",
+    "idpDeleteGlobalQuestion": "Weet u zeker dat u deze identiteitsprovider permanent wilt verwijderen?",
+    "idpDeleteGlobalDescription": "Hiermee wordt de identiteitsprovider permanent verwijderd uit alle organisaties waarmee het is geassocieerd.",
+    "idpUnassociateTitle": "Koppel Identiteitsprovider los",
+    "idpUnassociateQuestion": "Weet u zeker dat u deze identiteitsprovider van deze organisatie wilt loskoppelen?",
+    "idpUnassociateDescription": "Alle gebruikers die aan deze identiteitsprovider zijn gekoppeld, worden uit deze organisatie verwijderd, maar de identiteitsprovider blijft bestaan voor andere gerelateerde organisaties.",
+    "idpUnassociateConfirm": "Bevestig ontkoppelen identiteitsprovider",
+    "idpUnassociateWarning": "Dit kan niet ongedaan worden gemaakt voor deze organisatie.",
+    "idpUnassociatedDescription": "Identiteitsprovider succesvol losgekoppeld van deze organisatie",
+    "idpUnassociateMenu": "Ontkoppelen",
+    "idpDeleteAllOrgsMenu": "Verwijderen",
+    "publicIpEndpoint": "Eindpunt",
+    "lastTriggeredAt": "Laatste Trigger",
+    "reject": "Afwijzen",
+    "uptimeDaysAgo": "{count} dagen geleden",
+    "uptimeToday": "Vandaag",
+    "uptimeNoDataAvailable": "Geen gegevens beschikbaar",
+    "uptimeSuffix": "werktijd",
+    "uptimeDowntimeSuffix": "uitvaltijd",
+    "uptimeTooltipUptimeLabel": "Werktijd",
+    "uptimeTooltipDowntimeLabel": "Uitvaltijd",
+    "uptimeOngoing": "lopend",
+    "uptimeNoMonitoringData": "Geen monitoringgegevens",
+    "uptimeNoData": "Geen gegevens",
+    "uptimeMiniBarDown": "Onder",
+    "uptimeSectionTitle": "Werktijd",
+    "uptimeSectionDescription": "Beschikbaarheid over de laatste {days} dagen",
+    "uptimeAddAlert": "Alarm toevoegen",
+    "uptimeViewAlerts": "Meldingen bekijken",
+    "uptimeCreateEmailAlert": "E-mailalert aanmaken",
+    "uptimeAlertDescriptionSite": "Ontvang een e-mailbericht wanneer deze site offline gaat of weer online komt.",
+    "uptimeAlertDescriptionResource": "Ontvang een e-mailbericht wanneer deze bron offline gaat of weer online komt.",
+    "uptimeAlertNamePlaceholder": "Waarschuwingsnaam",
+    "uptimeAdditionalEmails": "Extra e-mails",
+    "uptimeCreateAlert": "Alarm aanmaken",
+    "uptimeAlertNoRecipients": "Geen ontvangers",
+    "uptimeAlertNoRecipientsDescription": "Voeg ten minste één gebruiker, rol of e-mail toe om te melden.",
+    "uptimeAlertCreated": "Alarm aangemaakt",
+    "uptimeAlertCreatedDescription": "U wordt op de hoogte gebracht wanneer dit van status verandert.",
+    "uptimeAlertCreateFailed": "Kon alarm niet aanmaken",
+    "webhookUrlLabel": "URL",
+    "webhookHeaderKeyPlaceholder": "Sleutel",
+    "webhookHeaderValuePlaceholder": "Waarde",
+    "alertLabel": "Waarschuwing",
+    "domainPickerWildcardSubdomainNotAllowed": "Wildcard-subdomeinen zijn niet toegestaan.",
+    "domainPickerWildcardCertWarning": "Wildcard-bronnen hebben mogelijk extra configuratie nodig om correct te werken.",
+    "domainPickerWildcardCertWarningLink": "Meer informatie",
+    "health": "Gezondheid",
+    "domainPendingErrorTitle": "Verificatieprobleem",
+    "memberPortalTitle": "Bronnen",
+    "memberPortalDescription": "Bronnen waartoe je toegang hebt binnen deze organisatie",
+    "memberPortalSortBy": "Sorteren op...",
+    "memberPortalSortNameAsc": "Naam A-Z",
+    "memberPortalSortNameDesc": "Naam Z-A",
+    "memberPortalSortDomainAsc": "Domein A-Z",
+    "memberPortalSortDomainDesc": "Domein Z-A",
+    "memberPortalSortEnabledFirst": "Ingeschakeld Eerst",
+    "memberPortalSortDisabledFirst": "Uitgeschakeld Eerst",
+    "memberPortalRefresh": "Vernieuwen",
+    "memberPortalRefreshResources": "Bronnen Vernieuwen",
+    "memberPortalFailedToLoad": "Fout bij het laden van bronnen",
+    "memberPortalFailedToLoadDescription": "Fout bij het laden van bronnen. Controleer uw verbinding en probeer het opnieuw.",
+    "memberPortalUnableToLoad": "Niet in staat om bronnen te laden",
+    "memberPortalTryAgain": "Probeer Opnieuw",
+    "memberPortalNoResourcesFound": "Geen Bronnen Gevonden",
+    "memberPortalNoResourcesAvailable": "Geen Bronnen Beschikbaar",
+    "memberPortalNoResourcesMatchSearch": "Geen bronnen komen overeen met \"{query}\". Probeer uw zoektermen aan te passen of wis de zoekopdracht om alle bronnen te zien.",
+    "memberPortalNoResourcesAccess": "Je hebt nog geen toegang tot bronnen. Neem contact op met je beheerder om toegang te krijgen tot de benodigde bronnen.",
+    "memberPortalClearSearch": "Zoekopdracht Wissen",
+    "memberPortalPublicResources": "Publieke Bronnen",
+    "memberPortalPublicResourcesDescription": "Webapplicaties en services toegankelijk via browser",
+    "memberPortalCopiedToClipboard": "Gekopieerd naar klembord",
+    "memberPortalCopiedUrlDescription": "Bron URL is naar uw klembord gekopieerd.",
+    "memberPortalOpenResource": "Bron Openen",
+    "memberPortalPrivateResources": "Privé Bronnen",
+    "memberPortalPrivateResourcesDescription": "Interne netwerkbronnen toegankelijk via client",
+    "memberPortalResourceDetails": "Bron Details",
+    "memberPortalMode": "Modus",
+    "memberPortalDestination": "Bestemming",
+    "memberPortalAlias": "Alias",
+    "memberPortalCopiedAliasDescription": "Bron alias is naar uw klembord gekopieerd.",
+    "memberPortalCopiedDestinationDescription": "Bron bestemming is naar uw klembord gekopieerd.",
+    "memberPortalRequiresClientConnection": "Clientverbinding Vereist",
+    "memberPortalAuthMethods": "Authenticatiemethoden",
+    "memberPortalSso": "Single Sign-On (SSO)",
+    "memberPortalPasswordProtected": "Wachtwoord Beveiligd",
+    "memberPortalPinCode": "Pincode",
+    "memberPortalEmailWhitelist": "E-mail whitelist",
+    "memberPortalResourceDisabled": "Bron Uitgeschakeld",
+    "memberPortalShowingResources": "Toont {start}-{end} van {total} bronnen",
+    "memberPortalPrevious": "Vorige",
+    "memberPortalNext": "Volgende",
+    "httpSettings": "HTTP Settings"
 }

messages/zh-CN.json

@@ -1,4 +1,8 @@
 {
+    "contactSalesEnable": "联系销售以启用此功能。",
+    "contactSalesBookDemo": "预订演示",
+    "contactSalesOr": "或",
+    "contactSalesContactUs": "联系我们",
     "setupCreate": "创建组织、站点和资源",
     "headerAuthCompatibilityInfo": "启用此功能以在身份验证令牌缺失时强制返回401未授权响应。对于不在没有服务器挑战的情况下不发送凭证的浏览器或特定HTTP库，这是必需的。",
     "headerAuthCompatibility": "扩展兼容性",
@@ -19,6 +23,18 @@
     "componentsInvalidKey": "检测到无效或过期的许可证密钥。按照许可证条款操作以继续使用所有功能。",
     "dismiss": "忽略",
     "subscriptionViolationMessage": "您的当前计划超出了您的限制。通过移除站点、用户或其他资源以保持在您的计划范围内来纠正问题。",
+    "trialBannerMessage": "您的试用将在 {countdown} 到期。升级以保持访问。",
+    "trialBannerExpired": "您的试用已到期。立即升级以恢复访问。",
+    "billingTrialBannerTitle": "免费试用激活中",
+    "billingTrialBannerDescription": "您目前正在商用层进行免费试用。试用结束后，您的账户将自动回到基础层功能和限制。可随时升级以保持当前计划的功能访问。",
+    "billingTrialBannerUpgrade": "立即升级",
+    "billingTrialBadge": "免费试用",
+    "trialActive": "免费试用中",
+    "trialExpired": "试用到期",
+    "trialHasEnded": "您的试用已结束。",
+    "trialDaysRemaining": "{count, plural, other {# 天剩余}}",
+    "trialDaysLeftShort": "试用期剩余 {days} 天",
+    "trialGoToBilling": "转到账单页面",
     "subscriptionViolationViewBilling": "查看计费",
     "componentsLicenseViolation": "许可证超限：该服务器使用了 {usedSites} 个站点，已超过授权的 {maxSites} 个。请遵守许可证条款以继续使用全部功能。",
     "componentsSupporterMessage": "感谢您的支持！您现在是 Pangolin 的 {tier} 用户。",
@@ -81,6 +97,8 @@
     "siteConfirmCopy": "我已经复制了配置信息",
     "searchSitesProgress": "搜索站点...",
     "siteAdd": "添加站点",
+    "sitesTableViewPublicResources": "查看公共资源",
+    "sitesTableViewPrivateResources": "查看私有资源",
     "siteInstallNewt": "安装 Newt",
     "siteInstallNewtDescription": "在您的系统中运行 Newt",
     "WgConfiguration": "WireGuard 配置",
@@ -98,6 +116,21 @@
     "siteUpdatedDescription": "网站已更新。",
     "siteGeneralDescription": "配置此站点的常规设置",
     "siteSettingDescription": "配置站点设置",
+    "siteResourcesTab": "资源",
+    "siteResourcesNoneOnSite": "此站点尚无公开或私人资源。",
+    "siteResourcesSectionPublic": "公共资源",
+    "siteResourcesSectionPrivate": "私有资源",
+    "siteResourcesSectionPublicDescription": "通过域名或端口公开的资源。",
+    "siteResourcesSectionPrivateDescription": "通过站点可在您的私有网络上访问的资源。",
+    "siteResourcesViewAllPublic": "查看所有资源",
+    "siteResourcesViewAllPrivate": "查看所有资源",
+    "siteResourcesDialogDescription": "此站点的公开和私有资源概览。",
+    "siteResourcesShowMore": "显示更多",
+    "siteResourcesPermissionDenied": "您无权列出这些资源。",
+    "siteResourcesEmptyPublic": "尚无针对该站点的公共资源。",
+    "siteResourcesEmptyPrivate": "尚无与此站点关联的私有资源。",
+    "siteResourcesHowToAccess": "如何访问",
+    "siteResourcesTargetsOnSite": "此站点上的目标",
     "siteSetting": "{siteName} 设置",
     "siteNewtTunnel": "新站点 (推荐)",
     "siteNewtTunnelDescription": "最简单的方式来创建任何网络的入口。没有额外的设置。",
@@ -123,6 +156,10 @@
     "shareErrorDeleteMessage": "删除链接时出错",
     "shareDeleted": "链接已删除",
     "shareDeletedDescription": "链接已删除",
+    "shareDelete": "删除共享链接",
+    "shareDeleteConfirm": "确认删除共享链接",
+    "shareQuestionRemove": "您确定要删除这个共享链接吗？",
+    "shareMessageRemove": "删除后，该链接将不再可用，使用它的任何人将失去对资源的访问权限。",
     "shareTokenDescription": "访问令牌可以通过两种方式传递：作为查询参数或请求标题。 每次验证访问请求都必须从客户端传递。",
     "accessToken": "访问令牌",
     "usageExamples": "用法示例",
@@ -139,6 +176,7 @@
     "shareErrorCreateDescription": "创建共享链接时出错",
     "shareCreateDescription": "任何具有此链接的人都可以访问资源",
     "shareTitleOptional": "标题 (可选)",
+    "sharePathOptional": "Path (optional)",
     "expireIn": "过期时间",
     "neverExpire": "永不过期",
     "shareExpireDescription": "过期时间是链接可以使用并提供对资源的访问时间。 此时间后，链接将不再工作，使用此链接的用户将失去对资源的访问。",
@@ -171,11 +209,33 @@
     "resourcesSearch": "搜索资源...",
     "resourceAdd": "添加资源",
     "resourceErrorDelte": "删除资源时出错",
+    "resourcePoliciesTitle": "Manage Resource Policies",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
+    "resourcePoliciesAttachedResources": "{count} resource(s)",
+    "resourcePoliciesAttachedResourcesEmpty": "no resources",
+    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
+    "resourcePoliciesSearch": "Search policies...",
+    "resourcePoliciesAdd": "Add Policy",
+    "resourcePoliciesDefaultBadgeText": "Default policy",
+    "resourcePoliciesCreate": "Create Resource Policy",
+    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
+    "resourcePolicyName": "Policy Name",
+    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
+    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
+    "resourcePoliciesSeeAll": "See All Policies",
+    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
+    "resourcePolicyOtpEmailAdd": "Add OTP emails",
+    "resourcePolicyRulesAdd": "Add Rules",
+    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
+    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
+    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "认证",
     "protected": "受到保护",
     "notProtected": "未受到保护",
     "resourceMessageRemove": "一旦删除，资源将不再可访问。与该资源相关的所有目标也将被删除。",
     "resourceQuestionRemove": "您确定要从组织中删除资源吗？",
+    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
+    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS 资源",
     "resourceHTTPDescription": "通过使用完全限定的域名的HTTPS代理请求。",
     "resourceRaw": "TCP/UDP 资源",
@@ -183,8 +243,9 @@
     "resourceRawDescriptionCloud": "正在使用端口号使用 TCP/UDP 代理请求。需要站点连接到远程节点。",
     "resourceCreate": "创建资源",
     "resourceCreateDescription": "按照下面的步骤创建新资源",
+    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "查看所有资源",
-    "resourceInfo": "资源信息",
+    "resourceCreateGeneral": "General",
     "resourceNameDescription": "这是资源的显示名称。",
     "siteSelect": "选择站点",
     "siteSearch": "搜索站点",
@@ -194,12 +255,15 @@
     "noCountryFound": "找不到国家。",
     "siteSelectionDescription": "此站点将为目标提供连接。",
     "resourceType": "资源类型",
-    "resourceTypeDescription": "确定如何访问资源",
+    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
+    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
     "resourceHTTPSSettings": "HTTPS 设置",
     "resourceHTTPSSettingsDescription": "配置如何通过 HTTPS 访问资源",
+    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "域类型",
     "subdomain": "子域名",
     "baseDomain": "根域名",
+    "configure": "Configure",
     "subdomnainDescription": "可访问资源的子域。",
     "resourceRawSettings": "TCP/UDP 设置",
     "resourceRawSettingsDescription": "配置如何通过 TCP/UDP 访问资源",
@@ -216,8 +280,27 @@
     "resourceLearnRaw": "学习如何配置 TCP/UDP 资源",
     "resourceBack": "返回资源",
     "resourceGoTo": "转到资源",
+    "resourcePolicyDelete": "Delete Resource Policy",
+    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "删除资源",
     "resourceDeleteConfirm": "确认删除资源",
+    "labelDelete": "Delete Label",
+    "labelAdd": "Add Label",
+    "labelCreateSuccessMessage": "Label Created Successfully",
+    "labelEditSuccessMessage": "Label Modified Successfully",
+    "labelNameField": "Label Name",
+    "labelColorField": "Label Color",
+    "labelPlaceholder": "Ex: homelab",
+    "labelCreate": "Create Label",
+    "createLabelDialogTitle": "Create Label",
+    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
+    "labelEdit": "Edit Label",
+    "editLabelDialogTitle": "Update Label",
+    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
+    "labelDeleteConfirm": "Confirm Delete Label",
+    "labelErrorDelete": "Failed to delete label",
+    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
+    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "可见性",
     "enabled": "已启用",
     "disabled": "已禁用",
@@ -228,6 +311,8 @@
     "rules": "规则",
     "resourceSettingDescription": "配置资源上的设置",
     "resourceSetting": "{resourceName} 设置",
+    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
+    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "旁路认证",
     "alwaysDeny": "屏蔽访问",
     "passToAuth": "传递至认证",
@@ -267,8 +352,11 @@
     "orgMissing": "缺少组织 ID",
     "orgMissingMessage": "没有组织ID，无法重新生成邀请。",
     "accessUsersManage": "管理用户",
+    "accessUserManage": "管理用户",
     "accessUsersDescription": "邀请和管理访问此组织的用户",
     "accessUsersSearch": "搜索用户...",
+    "accessUsersRoleFilterCount": "{count, plural, other {# 角色}}",
+    "accessUsersRoleFilterClear": "清除角色过滤器",
     "accessUserCreate": "创建用户",
     "accessUserRemove": "删除用户",
     "username": "用户名",
@@ -371,10 +459,10 @@
     "provisioningKeysUpdated": "置备密钥已更新",
     "provisioningKeysUpdatedDescription": "您的更改已保存。",
     "provisioningKeysBannerTitle": "站点置备密钥",
-    "provisioningKeysBannerDescription": "生成一个预配键并使用它来在首次启动时自动创建站点——无需为每个站点设置单独的凭证。",
+    "provisioningKeysBannerDescription": "生成一个供应密钥，并将其与 Newt 连接器一起使用，以在首次启动时自动创建站点 - 无需为每个站点设置单独的凭据。",
     "provisioningKeysBannerButtonText": "了解更多",
     "pendingSitesBannerTitle": "待定站点",
-    "pendingSitesBannerDescription": "使用预配键连接的站点会出现在这里供审核。在站点开始运行之前批准并获取对您资源的访问权限。",
+    "pendingSitesBannerDescription": "使用供应密钥连接的站点将在此显示以供审核。",
     "pendingSitesBannerButtonText": "了解更多",
     "apiKeysSettings": "{apiKeyName} 设置",
     "userTitle": "管理所有用户",
@@ -405,6 +493,10 @@
     "licenseErrorKeyActivate": "激活许可证密钥失败",
     "licenseErrorKeyActivateDescription": "激活许可证密钥时出错。",
     "licenseAbout": "关于许可协议",
+    "licenseBannerTitle": "启用您的企业许可证",
+    "licenseBannerDescription": "为您自行托管的Pangolin实例解锁企业功能。购买许可证密钥以激活高级功能，然后在下方添加。",
+    "licenseBannerGetLicense": "获取许可证",
+    "licenseBannerViewDocs": "查看文档",
     "communityEdition": "社区版",
     "licenseAboutDescription": "这是针对商业环境中使用Pangolin的商业和企业用户。 如果您正在使用 Pangolin 供个人使用，您可以忽略此部分。",
     "licenseKeyActivated": "授权密钥已激活",
@@ -483,6 +575,12 @@
     "userMessageOrgRemove": "一旦删除，这个用户将不再能够访问组织。 你总是可以稍后重新邀请他们，但他们需要再次接受邀请。",
     "userRemoveOrgConfirm": "确认删除用户",
     "userRemoveOrg": "从组织中删除用户",
+    "userQuestionOrgRemoveSelf": "你确定要将自己从这个组织中移除吗？",
+    "userMessageOrgRemoveSelf": "你将立即失去访问权限。管理员稍后可以再次邀请你，但你需要接受新的邀请。",
+    "userRemoveOrgConfirmSelf": "确认删除我自己",
+    "userRemoveOrgSelf": "将自己从组织中移除",
+    "userRemoveOrgSelfWarning": "你将立即失去对此组织的访问权限。",
+    "userRemoveOrgConfirmPhraseSelf": "从组织中移除我自己",
     "users": "用户",
     "accessRoleMember": "成员",
     "accessRoleOwner": "所有者",
@@ -491,6 +589,11 @@
     "emailInvalid": "无效的电子邮件地址",
     "inviteValidityDuration": "请选择持续时间",
     "accessRoleSelectPlease": "请选择一个角色",
+    "removeOwnAdminRoleConfirmTitle": "移除你的管理员权限？",
+    "removeOwnAdminRoleConfirmDescription": "保存后，你将不再拥有该组织的管理员权限。如果需要，其他管理员可以恢复访问。",
+    "removeOwnAdminRoleConfirmButton": "移除我的管理员访问权限",
+    "removeOwnAdminRoleConfirmPhrase": "移除我的管理员访问",
+    "ownerMustRetainAdminRole": "组织所有者必须保留至少一个管理员角色。",
     "usernameRequired": "必须输入用户名",
     "idpSelectPlease": "请选择身份提供商",
     "idpGenericOidc": "通用的 OAuth2/OIDC 提供商。",
@@ -575,7 +678,7 @@
     "createdAt": "创建于",
     "proxyErrorInvalidHeader": "无效的自定义主机头值。使用域名格式，或将空保存为取消自定义主机头。",
     "proxyErrorTls": "无效的 TLS 服务器名称。使用域名格式，或保存空以删除 TLS 服务器名称。",
-    "proxyEnableSSL": "启用 SSL",
+    "proxyEnableSSL": "Enable TLS",
     "proxyEnableSSLDescription": "启用 SSL/TLS 加密以确保目标的 HTTPS 连接。",
     "target": "Target",
     "configureTarget": "配置目标",
@@ -618,12 +721,15 @@
     "targetNoOneDescription": "在上面添加多个目标将启用负载平衡。",
     "targetsSubmit": "保存目标",
     "addTarget": "添加目标",
+    "proxyMultiSiteRoundRobinNodeHelp": "轮询路由在未连接到相同节点的站点之间将不起作用，但故障转移会生效。",
     "targetErrorInvalidIp": "无效的 IP 地址",
     "targetErrorInvalidIpDescription": "请输入有效的IP地址或主机名",
     "targetErrorInvalidPort": "无效的端口",
     "targetErrorInvalidPortDescription": "请输入有效的端口号",
     "targetErrorNoSite": "没有选择站点",
     "targetErrorNoSiteDescription": "请选择目标站点",
+    "targetTargetsCleared": "目标已清除",
+    "targetTargetsClearedDescription": "所有目标已从此资源中移除",
     "targetCreated": "目标已创建",
     "targetCreatedDescription": "目标已成功创建",
     "targetErrorCreate": "创建目标失败",
@@ -689,6 +795,16 @@
     "rulesNoOne": "没有规则。使用表单添加规则。",
     "rulesOrder": "规则按优先顺序评定。",
     "rulesSubmit": "保存规则",
+    "policyErrorCreate": "Error creating policy",
+    "policyErrorCreateDescription": "An error occurred when creating the policy",
+    "policyErrorCreateMessageDescription": "An unexpected error occurred",
+    "policyErrorUpdate": "Error updating policy",
+    "policyErrorUpdateDescription": "An error occurred when updating the policy",
+    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
+    "policyCreatedSuccess": "Resource policy succesfully created",
+    "policyUpdatedSuccess": "Resource policy succesfully updated",
+    "authMethodsSave": "Save auth methods",
+    "rulesSave": "Save Rules",
     "resourceErrorCreate": "创建资源时出错",
     "resourceErrorCreateDescription": "创建资源时出错",
     "resourceErrorCreateMessage": "创建资源时发生错误：",
@@ -725,6 +841,7 @@
     "newtEndpoint": "Endpoint",
     "newtId": "ID",
     "newtSecretKey": "密钥",
+    "newtVersion": "版本",
     "architecture": "架构",
     "sites": "站点",
     "siteWgAnyClients": "使用任何 WireGuard 客户端连接。您必须使用对等IP解决内部资源问题。",
@@ -751,6 +868,16 @@
     "pincodeAdd": "添加 PIN 码",
     "pincodeRemove": "移除 PIN 码",
     "resourceAuthMethods": "身份验证方法",
+    "resourcePolicyAuthMethodsEmpty": "No authentication method",
+    "resourcePolicyOtpEmpty": "No one time password",
+    "resourcePolicyReadOnly": "This policy is Read only",
+    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
+    "resourcePolicyTypeSave": "Save Resource type",
+    "resourcePolicySelect": "Select resource policy",
+    "resourcePolicySelectError": "Select a resource policy",
+    "resourcePolicyNotFound": "Policy not found",
+    "resourcePolicySearch": "Search policies",
+    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "允许通过额外的认证方法访问资源",
     "resourceAuthSettingsSave": "保存成功",
     "resourceAuthSettingsSaveDescription": "已保存身份验证设置",
@@ -786,6 +913,12 @@
     "resourcePincodeSetupTitle": "设置 PIN 码",
     "resourcePincodeSetupTitleDescription": "设置 PIN 码来保护此资源",
     "resourceRoleDescription": "管理员总是可以访问此资源。",
+    "resourcePolicySelectTitle": "Resource Access Policy",
+    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
+    "resourcePolicyInline": "Inline Resource Policy",
+    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
+    "resourcePolicyShared": "Shared Resource Policy",
+    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "访问控制",
     "resourceUsersRolesDescription": "配置用户和角色可以访问此资源",
     "resourceUsersRolesSubmit": "保存访问控制",
@@ -892,6 +1025,7 @@
     "idpDisplayName": "此身份提供商的显示名称",
     "idpAutoProvisionUsers": "自动提供用户",
     "idpAutoProvisionUsersDescription": "如果启用，用户将在首次登录时自动在系统中创建，并且能够映射用户到角色和组织。",
+    "idpAutoProvisionConfigureAfterCreate": "您可以在创建身份提供者后配置自动配置设置。",
     "licenseBadge": "EE",
     "idpType": "提供者类型",
     "idpTypeDescription": "选择您想要配置的身份提供者类型",
@@ -943,7 +1077,7 @@
     "defaultMappingsRole": "默认角色映射",
     "defaultMappingsRoleDescription": "此表达式的结果必须返回组织中定义的角色名称作为字符串。",
     "defaultMappingsOrg": "默认组织映射",
-    "defaultMappingsOrgDescription": "此表达式必须返回 组织ID 或 true 才能允许用户访问组织。",
+    "defaultMappingsOrgDescription": "设置时，此表达式必须返回组织ID或true才能让用户访问该组织。如果未设置，定义角色映射就足够了：只要在组织内可以为用户找出有效角色映射，用户就被允许进入。",
     "defaultMappingsSubmit": "保存默认映射",
     "orgPoliciesEdit": "编辑组织策略",
     "org": "组织",
@@ -1080,6 +1214,18 @@
     "idpErrorConnectingTo": "无法连接到 {name}，请联系管理员协助处理。",
     "idpErrorNotFound": "找不到 IdP",
     "inviteInvalid": "无效邀请",
+    "labels": "Labels",
+    "orgLabelsDescription": "Manage labels in this organization.",
+    "addLabels": "Add labels",
+    "siteLabelsTab": "Labels",
+    "siteLabelsDescription": "Manage labels associated with this site.",
+    "labelsNotFound": "Labels not found",
+    "labelSearch": "Search labels",
+    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
+    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
+    "accessLabelFilterClear": "Clear label filters",
+    "selectColor": "Select color",
+    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "邀请链接无效。",
     "inviteErrorWrongUser": "邀请不是该用户的",
     "inviteErrorUserNotExists": "用户不存在。请先创建帐户。",
@@ -1250,6 +1396,7 @@
     "actionViewLogs": "查看日志",
     "noneSelected": "未选择",
     "orgNotFound2": "未找到组织。",
+    "search": "搜索…",
     "searchPlaceholder": "搜索...",
     "emptySearchOptions": "未找到选项",
     "create": "创建",
@@ -1313,6 +1460,8 @@
     "sidebarResources": "资源",
     "sidebarProxyResources": "公开的",
     "sidebarClientResources": "非公开的",
+    "sidebarPolicies": "Policies",
+    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "访问控制",
     "sidebarLogsAndAnalytics": "日志与分析",
     "sidebarTeam": "团队",
@@ -1334,12 +1483,170 @@
     "sidebarGeneral": "管理",
     "sidebarLogAndAnalytics": "日志与分析",
     "sidebarBluePrints": "蓝图",
+    "sidebarAlerting": "告警",
+    "sidebarHealthChecks": "健康检查",
     "sidebarOrganization": "组织",
     "sidebarManagement": "管理",
     "sidebarBillingAndLicenses": "帐单和许可证",
     "sidebarLogsAnalytics": "分析",
+    "alertingTitle": "告警",
+    "alertingDescription": "定义通知的来源、触发器和操作",
+    "alertingRules": "告警规则",
+    "alertingSearchRules": "搜索规则…",
+    "alertingAddRule": "创建规则",
+    "alertingColumnSource": "来源",
+    "alertingColumnTrigger": "触发",
+    "alertingColumnActions": "操作",
+    "alertingColumnEnabled": "已启用",
+    "alertingDeleteQuestion": "请确认您要删除此告警规则。",
+    "alertingDeleteRule": "删除告警规则",
+    "alertingRuleDeleted": "告警规则已删除",
+    "alertingRuleSaved": "告警规则已保存",
+    "alertingRuleSavedCreatedDescription": "您的新告警规则已创建。您可以在此页面继续编辑它。",
+    "alertingRuleSavedUpdatedDescription": "对此告警规则的更改已保存。",
+    "alertingEditRule": "编辑告警规则",
+    "alertingCreateRule": "创建告警规则",
+    "alertingRuleCredenzaDescription": "选择要监视的内容、何时触发以及如何通知",
+    "alertingRuleNamePlaceholder": "生产站点故障",
+    "alertingRuleEnabled": "规则已启用",
+    "alertingSectionSource": "来源",
+    "alertingSourceType": "来源类型",
+    "alertingSourceSite": "站点",
+    "alertingSourceHealthCheck": "健康检查",
+    "alertingPickSites": "站点",
+    "alertingPickHealthChecks": "健康检查",
+    "alertingPickResources": "资源",
+    "alertingAllSites": "所有站点",
+    "alertingAllSitesDescription": "任何站点的告警触发",
+    "alertingSpecificSites": "特定站点",
+    "alertingSpecificSitesDescription": "选择要监视的特定站点",
+    "alertingAllHealthChecks": "所有健康检查",
+    "alertingAllHealthChecksDescription": "任何健康检查的告警触发",
+    "alertingSpecificHealthChecks": "特定健康检查",
+    "alertingSpecificHealthChecksDescription": "选择要监视的特定健康检查",
+    "alertingAllResources": "所有资源",
+    "alertingAllResourcesDescription": "任何资源的告警触发",
+    "alertingSpecificResources": "特定资源",
+    "alertingSpecificResourcesDescription": "选择要监视的特定资源",
+    "alertingSelectResources": "选择资源…",
+    "alertingResourcesSelected": "{count} 个资源已选择",
+    "alertingResourcesEmpty": "在前 10 个结果中没有带目标的资源。",
+    "alertingSectionTrigger": "触发",
+    "alertingTrigger": "何时告警",
+    "alertingTriggerSiteOnline": "站点在线",
+    "alertingTriggerSiteOffline": "站点离线",
+    "alertingTriggerSiteToggle": "站点状态变更",
+    "alertingTriggerHcHealthy": "健康检查正常",
+    "alertingTriggerHcUnhealthy": "健康检查不正常",
+    "alertingTriggerHcToggle": "健康检查状态变更",
+    "alertingTriggerResourceHealthy": "资源正常",
+    "alertingTriggerResourceUnhealthy": "资源不正常",
+    "alertingTriggerResourceDegraded": "资源降级",
+    "alertingSearchHealthChecks": "搜索健康检查…",
+    "alertingHealthChecksEmpty": "无可用健康检查。",
+    "alertingTriggerResourceToggle": "资源状态变更",
+    "alertingSourceResource": "资源",
+    "alertingSectionActions": "操作",
+    "alertingAddAction": "新增操作",
+    "alertingActionNotify": "电子邮件",
+    "alertingActionNotifyDescription": "向用户或角色发送电子邮件通知",
+    "alertingActionWebhook": "Webhook",
+    "alertingActionWebhookDescription": "发送 HTTP 请求到自定义终端",
+    "alertingExternalIntegration": "外部集成",
+    "alertingExternalPagerDutyDescription": "将告警发送给 PagerDuty 以进行事件管理",
+    "alertingExternalOpsgenieDescription": "将告警路由到 Opsgenie 进行电话值班管理",
+    "alertingExternalServiceNowDescription": "从告警事件创建 ServiceNow 事件",
+    "alertingExternalIncidentIoDescription": "从告警事件触发 Incident.io 工作流程",
+    "alertingActionType": "操作类型",
+    "alertingNotifyUsers": "用户",
+    "alertingNotifyRoles": "角色",
+    "alertingNotifyEmails": "电子邮件地址",
+    "alertingEmailPlaceholder": "添加电子邮件并按回车键",
+    "alertingWebhookMethod": "HTTP 方法",
+    "alertingWebhookSecret": "签名密钥（可选）",
+    "alertingWebhookSecretPlaceholder": "HMAC 密钥",
+    "alertingWebhookHeaders": "标头",
+    "alertingAddHeader": "添加标头",
+    "alertingSelectSites": "选择站点…",
+    "alertingSitesSelected": "{count} 个站点已选择",
+    "alertingSelectHealthChecks": "选择健康检查…",
+    "alertingHealthChecksSelected": "{count} 个健康检查已选择",
+    "alertingNoHealthChecks": "没有启用健康检查的目标",
+    "alertingHealthCheckStub": "健康检查来源选择尚未配置 - 你仍然可以配置触发器和操作。",
+    "alertingSelectUsers": "选择用户…",
+    "alertingUsersSelected": "{count} 个用户已选择",
+    "alertingSelectRoles": "选择角色…",
+    "alertingRolesSelected": "{count} 个角色已选择",
+    "alertingSummarySites": "站点 ({count})",
+    "alertingSummaryAllSites": "所有站点",
+    "alertingSummaryHealthChecks": "健康检查 ({count})",
+    "alertingSummaryAllHealthChecks": "所有健康检查",
+    "alertingSummaryResources": "资源 ({count})",
+    "alertingSummaryAllResources": "所有资源",
+    "alertingErrorNameRequired": "输入名称",
+    "alertingErrorActionsMin": "添加至少一个操作",
+    "alertingErrorPickSites": "至少选择一个站点",
+    "alertingErrorPickHealthChecks": "至少选择一个健康检查",
+    "alertingErrorPickResources": "至少选择一个资源",
+    "alertingErrorTriggerSite": "选择站点触发器",
+    "alertingErrorTriggerHealth": "选择健康检查触发器",
+    "alertingErrorTriggerResource": "选择资源触发器",
+    "alertingErrorNotifyRecipients": "选择用户、角色或至少一个电子邮件",
+    "alertingConfigureSource": "配置来源",
+    "alertingConfigureTrigger": "配置触发器",
+    "alertingConfigureActions": "配置操作",
+    "alertingBackToRules": "返回规则",
+    "alertingRuleCooldown": "冷却时间（秒）",
+    "alertingRuleCooldownDescription": "相同规则间隔重复告警的最小时间。设置为 0 固定触发。",
+    "alertingDraftBadge": "草稿 - 保存以存储此规则",
+    "alertingSidebarHint": "点击画布上的步骤在此处编辑。",
+    "alertingGraphCanvasTitle": "规则流程",
+    "alertingGraphCanvasDescription": "源、触发器和操作的视觉概况。选择一个节点，在面板上进行编辑。",
+    "alertingNodeNotConfigured": "尚未配置",
+    "alertingNodeActionsCount": "{count, plural, other {# 操作}}",
+    "alertingNodeRoleSource": "来源",
+    "alertingNodeRoleTrigger": "触发",
+    "alertingNodeRoleAction": "行为",
+    "alertingTabRules": "告警规则",
+    "alertingTabHealthChecks": "健康检查",
+    "alertingRulesBannerTitle": "获取通知",
+    "alertingRulesBannerDescription": "每条规则都连接要监视的对象（站点、健康检查或资源），触发时间（例如离线或不健康），以及如何通过电子邮件、Webhooks 或集成将通知发送给团队。使用此列表创建、启用和管理这些规则。",
+    "alertingHealthChecksBannerTitle": "监视健康和资源",
+    "alertingHealthChecksBannerDescription": "健康检查是您一次定义的 HTTP 或 TCP 监控。然后可以将它们用作告警规则中的来源，以便目标变得正常或不正常时得到通知。资源上的健康检查也会出现在此处。",
+    "standaloneHcTableTitle": "健康检查",
+    "standaloneHcSearchPlaceholder": "搜索健康检查…",
+    "standaloneHcAddButton": "创建健康检查",
+    "standaloneHcCreateTitle": "创建健康检查",
+    "standaloneHcEditTitle": "编辑健康检查",
+    "standaloneHcDescription": "配置 HTTP 或 TCP 健康检查以用于告警规则。",
+    "standaloneHcNameLabel": "名称",
+    "standaloneHcNamePlaceholder": "我的 HTTP 监视器",
+    "standaloneHcDeleteTitle": "删除健康检查",
+    "standaloneHcDeleteQuestion": "请确认您要删除此健康检查。",
+    "standaloneHcDeleted": "健康检查已删除",
+    "standaloneHcSaved": "健康检查已保存",
+    "standaloneHcColumnHealth": "健康",
+    "standaloneHcColumnMode": "模式",
+    "standaloneHcColumnTarget": "目标",
+    "standaloneHcHealthStateHealthy": "健康",
+    "standaloneHcHealthStateUnhealthy": "不健康",
+    "standaloneHcHealthStateUnknown": "未知",
+    "standaloneHcFilterAnySite": "所有站点",
+    "standaloneHcFilterAnyResource": "所有资源",
+    "standaloneHcFilterMode": "模式",
+    "standaloneHcFilterModeHttp": "HTTP",
+    "standaloneHcFilterModeTcp": "TCP",
+    "standaloneHcFilterModeSnmp": "SNMP",
+    "standaloneHcFilterModePing": "Ping",
+    "standaloneHcFilterHealth": "健康",
+    "standaloneHcFilterEnabled": "已启用",
+    "standaloneHcFilterEnabledOn": "已启用",
+    "standaloneHcFilterEnabledOff": "已禁用",
+    "standaloneHcFilterSiteIdFallback": "站点 {id}",
+    "standaloneHcFilterResourceIdFallback": "资源 {id}",
     "blueprints": "蓝图",
-    "blueprintsDescription": "应用声明配置并查看先前运行的",
+    "blueprintsLog": "Blueprints Log",
+    "blueprintsDescription": "View past blueprint applications and their results",
     "blueprintAdd": "添加蓝图",
     "blueprintGoBack": "查看所有蓝图",
     "blueprintCreate": "创建蓝图",
@@ -1357,7 +1664,17 @@
     "contents": "目录",
     "parsedContents": "解析内容 (只读)",
     "enableDockerSocket": "启用 Docker 蓝图",
-    "enableDockerSocketDescription": "启用 Docker Socket 标签擦除蓝图标签。套接字路径必须提供给新的。",
+    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
+    "newtAutoUpdate": "Enable Site Auto-Update",
+    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
+    "siteAutoUpdate": "Site Auto-Update",
+    "siteAutoUpdateLabel": "Enable Auto-Update",
+    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
+    "siteAutoUpdateOrgDefault": "Organization default: {state}",
+    "siteAutoUpdateOverriding": "Overriding organization setting",
+    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
+    "siteAutoUpdateEnabled": "enabled",
+    "siteAutoUpdateDisabled": "disabled",
     "viewDockerContainers": "查看停靠容器",
     "containersIn": "{siteName} 中的容器",
     "selectContainerDescription": "选择任何容器作为目标的主机名。点击端口使用端口。",
@@ -1399,8 +1716,10 @@
     "initialSetupDescription": "创建初始服务器管理员帐户。 只能存在一个服务器管理员。 您可以随时更改这些凭据。",
     "createAdminAccount": "创建管理员帐户",
     "setupErrorCreateAdmin": "创建服务器管理员账户时发生错误。",
-    "certificateStatus": "证书状态",
+    "certificateStatus": "证书",
+    "certificateStatusAutoRefreshHint": "状态自动刷新。",
     "loading": "加载中",
+    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "加载分析",
     "restart": "重启",
     "domains": "域",
@@ -1468,6 +1787,7 @@
     "pangolinUpdateAvailableReleaseNotes": "查看发布说明",
     "newtUpdateAvailable": "更新可用",
     "newtUpdateAvailableInfo": "新版本的 Newt 已可用。请更新到最新版本以获得最佳体验。",
+    "pangolinNodeUpdateAvailableInfo": "新版本的 Pangolin Node 已可用。请更新到最新版本以获得最佳体验。",
     "domainPickerEnterDomain": "域名",
     "domainPickerPlaceholder": "example.com",
     "domainPickerDescription": "输入资源的完整域名以查看可用选项。",
@@ -1626,6 +1946,7 @@
     "billingManageLicenseSubscription": "管理您对付费的自托管许可证密钥的订阅",
     "billingCurrentKeys": "当前密钥",
     "billingModifyCurrentPlan": "修改当前计划",
+    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "确认升级",
     "billingConfirmDowngrade": "确认降级",
     "billingConfirmUpgradeDescription": "您即将升级您的计划。请检查下面的新限额和定价。",
@@ -1707,6 +2028,7 @@
     "configureHealthCheck": "配置健康检查",
     "configureHealthCheckDescription": "为 {target} 设置健康监控",
     "enableHealthChecks": "启用健康检查",
+    "healthCheckDisabledStateDescription": "禁用后，站点不会进行健康检查，状态将被视为未知。",
     "enableHealthChecksDescription": "监视此目标的健康状况。如果需要，您可以监视一个不同的终点。",
     "healthScheme": "方法",
     "healthSelectScheme": "选择方法",
@@ -1722,7 +2044,36 @@
     "timeIsInSeconds": "时间以秒为单位",
     "requireDeviceApproval": "需要设备批准",
     "requireDeviceApprovalDescription": "具有此角色的用户需要管理员批准的新设备才能连接和访问资源。",
-    "sshAccess": "SSH 访问",
+    "sshSettings": "SSH Settings",
+    "rdpSettings": "RDP Settings",
+    "vncSettings": "VNC Settings",
+    "sshServer": "SSH Server",
+    "rdpServer": "RDP Server",
+    "vncServer": "VNC Server",
+    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
+    "rdpServerDescription": "Configure the destination and port of the RDP server",
+    "vncServerDescription": "Configure the destination and port of the VNC server",
+    "sshServerMode": "Mode",
+    "sshServerModeStandard": "Standard SSH Server",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
+    "sshServerModeNative": "Native SSH Server",
+    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
+    "sshAuthenticationMethod": "Authentication Method",
+    "sshAuthMethodManual": "Manual Authentication",
+    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
+    "sshAuthMethodAutomated": "Automated Provisioning",
+    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
+    "sshAuthDaemonLocation": "Auth Daemon Location",
+    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
+    "sshDaemonLocationRemote": "On Remote Host",
+    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
+    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
+    "sshDaemonPort": "Daemon Port",
+    "sshServerDestination": "Server Destination",
+    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
+    "destination": "Destination",
+    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
     "roleAllowSsh": "允许 SSH",
     "roleAllowSshAllow": "允许",
     "roleAllowSshDisallow": "不允许",
@@ -1736,7 +2087,7 @@
     "sshSudoModeCommandsDescription": "用户只能用 sudo 运行指定的命令。",
     "sshSudo": "允许Sudo",
     "sshSudoCommands": "Sudo 命令",
-    "sshSudoCommandsDescription": "逗号分隔的用户允许使用 sudo 运行的命令列表。",
+    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
     "sshCreateHomeDir": "创建主目录",
     "sshUnixGroups": "Unix 组",
     "sshUnixGroupsDescription": "用逗号分隔了Unix组，将用户添加到目标主机上。",
@@ -1756,9 +2107,20 @@
     "healthCheckIntervalMin": "检查间隔必须至少为 5 秒",
     "healthCheckTimeoutMin": "超时必须至少为 1 秒",
     "healthCheckRetryMin": "重试次数必须至少为 1 次",
+    "healthCheckMode": "检查模式",
+    "healthCheckStrategy": "策略",
+    "healthCheckModeDescription": "TCP 模式仅验证连接性。HTTP 模式验证 HTTP 响应。",
+    "healthyThreshold": "正常阈值",
+    "healthyThresholdDescription": "标记为正常之前所需的连续成功次数。",
+    "unhealthyThreshold": "不正常阈值",
+    "unhealthyThresholdDescription": "标记为不正常之前所需的连续失败次数。",
+    "healthCheckHealthyThresholdMin": "健康阈值至少为 1",
+    "healthCheckUnhealthyThresholdMin": "不健康阈值至少为 1",
     "httpMethod": "HTTP 方法",
     "selectHttpMethod": "选择 HTTP 方法",
     "domainPickerSubdomainLabel": "子域名",
+    "domainPickerWildcard": "通配符",
+    "domainPickerWildcardPaidOnly": "通配符子域是付费功能。请升级以使用此功能。",
     "domainPickerBaseDomainLabel": "根域名",
     "domainPickerSearchDomains": "搜索域名...",
     "domainPickerNoDomainsFound": "未找到域名",
@@ -1784,12 +2146,12 @@
     "resourcesTableAliasAddressInfo": "此地址是组织实用子网的一部分。它用来使用内部DNS解析来解析别名记录。",
     "resourcesTableClients": "客户端",
     "resourcesTableAndOnlyAccessibleInternally": "且仅在与客户端连接时可内部访问。",
-    "resourcesTableNoTargets": "没有目标",
     "resourcesTableHealthy": "健康的",
     "resourcesTableDegraded": "降级",
-    "resourcesTableOffline": "离线的",
+    "resourcesTableUnhealthy": "不健康",
     "resourcesTableUnknown": "未知的",
     "resourcesTableNotMonitored": "未监视的",
+    "resourcesTableNoTargets": "无目标",
     "editInternalResourceDialogEditClientResource": "编辑私有资源",
     "editInternalResourceDialogUpdateResourceProperties": "更新{resourceName}的资源配置和访问控制。",
     "editInternalResourceDialogResourceProperties": "资源属性",
@@ -1815,6 +2177,12 @@
     "editInternalResourceDialogModePort": "端口",
     "editInternalResourceDialogModeHost": "主机",
     "editInternalResourceDialogModeCidr": "CIDR",
+    "editInternalResourceDialogModeHttp": "HTTP",
+    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
+    "editInternalResourceDialogScheme": "方案",
+    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
     "editInternalResourceDialogDestination": "目标",
     "editInternalResourceDialogDestinationHostDescription": "站点网络上资源的 IP 地址或主机名。",
     "editInternalResourceDialogDestinationIPDescription": "站点网络上资源的IP或主机名地址。",
@@ -1830,6 +2198,7 @@
     "createInternalResourceDialogName": "名称",
     "createInternalResourceDialogSite": "站点",
     "selectSite": "选择站点...",
+    "multiSitesSelectorSitesCount": "{count, plural, other {# 个网站}}",
     "noSitesFound": "未找到站点。",
     "createInternalResourceDialogProtocol": "协议",
     "createInternalResourceDialogTcp": "TCP",
@@ -1858,11 +2227,20 @@
     "createInternalResourceDialogModePort": "端口",
     "createInternalResourceDialogModeHost": "主机",
     "createInternalResourceDialogModeCidr": "CIDR",
+    "createInternalResourceDialogModeHttp": "HTTP",
+    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
+    "scheme": "方案",
+    "createInternalResourceDialogScheme": "方案",
+    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
     "createInternalResourceDialogDestination": "目标",
     "createInternalResourceDialogDestinationHostDescription": "站点网络上资源的 IP 地址或主机名。",
     "createInternalResourceDialogDestinationCidrDescription": "站点网络上资源的 CIDR 范围。",
     "createInternalResourceDialogAlias": "Alias",
     "createInternalResourceDialogAliasDescription": "此资源可选的内部DNS别名。",
+    "internalResourceDownstreamSchemeRequired": "HTTP 资源需要方案",
+    "internalResourceHttpPortRequired": "HTTP 资源需要目的端口",
     "siteConfiguration": "配置",
     "siteAcceptClientConnections": "接受客户端连接",
     "siteAcceptClientConnectionsDescription": "允许用户设备和客户端访问此站点上的资源。这可以稍后更改。",
@@ -1987,7 +2365,7 @@
         "description": "更可靠和低维护自我托管的 Pangolin 服务器，带有额外的铃声和告密器",
         "introTitle": "托管自托管的潘戈林公司",
         "introDescription": "这是一种部署选择，为那些希望简洁和额外可靠的人设计，同时仍然保持他们的数据的私密性和自我托管性。",
-        "introDetail": "通过此选项，您仍然运行您自己的 Pangolin 节点 — — 您的隧道、SSL 终止，并且流量在您的服务器上保持所有状态。 不同之处在于，管理和监测是通过我们的云层仪表板进行的，该仪表板开启了一些好处：",
+        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
         "benefitSimplerOperations": {
             "title": "简单的操作",
             "description": "无需运行您自己的邮件服务器或设置复杂的警报。您将从方框中获得健康检查和下限提醒。"
@@ -2020,7 +2398,7 @@
     },
     "internationaldomaindetected": "检测到国际域",
     "willbestoredas": "储存为：",
-    "roleMappingDescription": "确定当用户启用自动配送时如何分配他们的角色。",
+    "roleMappingDescription": "确定当用户使用此身份提供者登陆时如何分配角色。",
     "selectRole": "选择角色",
     "roleMappingExpression": "表达式",
     "selectRolePlaceholder": "选择角色",
@@ -2112,9 +2490,11 @@
     "selectDomainForOrgAuthPage": "选择组织认证页面的域",
     "domainPickerProvidedDomain": "提供的域",
     "domainPickerFreeProvidedDomain": "免费提供的域",
+    "domainPickerFreeDomainsPaidFeature": "提供的域名是付费功能。订阅即可将域名包含在您的计划中-无需自带域名。",
     "domainPickerVerified": "已验证",
     "domainPickerUnverified": "未验证",
-    "domainPickerInvalidSubdomainStructure": "此子域包含无效的字符或结构。当您保存时，它将被自动清除。",
+    "domainPickerManual": "手动",
+    "domainPickerInvalidSubdomainStructure": "保存时将清除无效字符。",
     "domainPickerError": "错误",
     "domainPickerErrorLoadDomains": "加载组织域名失败",
     "domainPickerErrorCheckAvailability": "检查域可用性失败",
@@ -2127,7 +2507,7 @@
     "orgAuthChooseIdpDescription": "选择您的身份提供商以继续",
     "orgAuthNoIdpConfigured": "此机构没有配置任何身份提供者。您可以使用您的 Pangolin 身份登录。",
     "orgAuthSignInWithPangolin": "使用 Pangolin 登录",
-    "orgAuthSignInToOrg": "登录到组织",
+    "orgAuthSignInToOrg": "组织身份提供商 (SSO)",
     "orgAuthSelectOrgTitle": "组织登录",
     "orgAuthSelectOrgDescription": "输入您的组织ID以继续",
     "orgAuthOrgIdPlaceholder": "您的组织",
@@ -2288,7 +2668,7 @@
         "alerts": {
             "commercialUseDisclosure": {
                 "title": "使用情况披露",
-                "description": "选择能准确反映您预定用途的许可等级。 个人许可证允许对个人、非商业性或小型商业活动免费使用软件，年收入毛额不到100 000美元。 超出这些限度的任何用途，包括在企业、组织内的用途。 或其他创收环境——需要有效的企业许可证和支付适用的许可证费用。 所有用户，不论是个人还是企业，都必须遵守寄养商业许可证条款。"
+                "description": "选择能准确反映您预定用途的许可等级。 个人许可证允许对个人、非商业性或小型商业活动免费使用软件，年收入毛额不到100 000美元。 超出这些限度的任何用途，包括在企业、组织内的用途。 或其他创收环境--需要有效的企业许可证和支付适用的许可证费用。 所有用户，不论是个人还是企业，都必须遵守寄养商业许可证条款。"
             },
             "trialPeriodInformation": {
                 "title": "试用期信息",
@@ -2343,10 +2723,10 @@
             },
             "scale": {
                 "title": "缩放比例",
-                "description": "企业特征、50个用户、50个站点和优先支持。"
+                "description": "企业功能，50个用户，100个站点，以及优先支持。"
             }
         },
-        "personalUseOnly": "仅供个人使用 (免费许可证-无签出)",
+        "personalUseOnly": "仅限个人使用（免费许可 - 无需结账）",
         "buttons": {
             "continueToCheckout": "继续签出"
         },
@@ -2420,6 +2800,9 @@
     "validPassword": "有效密码",
     "validEmail": "Valid email",
     "validSSO": "Valid SSO",
+    "view": "查看",
+    "configManaged": "配置已管理",
+    "connectedClient": "已连接客户端",
     "resourceBlocked": "资源被阻止",
     "droppedByRule": "被规则删除",
     "noSessions": "无会话",
@@ -2439,7 +2822,7 @@
     "logRetentionDescription": "管理不同类型的日志为这个机构保留多长时间或禁用这些日志",
     "requestLogsDescription": "查看此机构资源的详细请求日志",
     "requestAnalyticsDescription": "查看此机构资源的详细请求分析",
-    "logRetentionRequestLabel": "请求日志保留",
+    "logRetentionRequestLabel": "HTTP 请求日志保留",
     "logRetentionRequestDescription": "保留请求日志的时间",
     "logRetentionAccessLabel": "访问日志保留",
     "logRetentionAccessDescription": "保留访问日志的时间",
@@ -2607,6 +2990,9 @@
     "machineClients": "机器客户端",
     "install": "安装",
     "run": "运行",
+    "envFile": "环境文件",
+    "serviceFile": "服务文件",
+    "enableAndStart": "启用并启动",
     "clientNameDescription": "可以稍后更改的客户端的显示名称。",
     "clientAddress": "客户端地址 (高级)",
     "setupFailedToFetchSubnet": "获取默认子网失败",
@@ -2655,7 +3041,13 @@
     "editInternalResourceDialogAddClients": "添加客户端",
     "editInternalResourceDialogDestinationLabel": "目标",
     "editInternalResourceDialogDestinationDescription": "指定内部资源的目标地址。根据选择的模式，这可以是主机名、IP地址或CIDR范围。可选的，设置一个内部DNS别名以便于识别。",
+    "internalResourceFormMultiSiteRoutingHelp": "选择多个站点可以实现高可用性的弹性路由和故障转移。",
+    "internalResourceFormMultiSiteRoutingHelpLearnMore": "了解更多",
     "editInternalResourceDialogPortRestrictionsDescription": "限制访问特定的TCP/UDP端口或允许/阻止所有端口。",
+    "createInternalResourceDialogHttpConfiguration": "HTTP 配置",
+    "createInternalResourceDialogHttpConfigurationDescription": "选择客户将使用的域名通过 HTTP 或 HTTPS 访问此资源。",
+    "editInternalResourceDialogHttpConfiguration": "HTTP 配置",
+    "editInternalResourceDialogHttpConfigurationDescription": "选择客户将使用的域名通过 HTTP 或 HTTPS 访问此资源。",
     "editInternalResourceDialogTcp": "TCP",
     "editInternalResourceDialogUdp": "UDP",
     "editInternalResourceDialogIcmp": "ICMP",
@@ -2677,7 +3069,7 @@
     "learnMore": "了解更多",
     "backToHome": "返回首页",
     "needToSignInToOrg": "需要使用您组织的身份提供商吗？",
-    "maintenanceMode": "维护模式",
+    "maintenanceMode": "Maintenance Page",
     "maintenanceModeDescription": "向访客显示维护页面",
     "maintenanceModeType": "维护模式类型",
     "showMaintenancePage": "只在所有后端目标都故障或不健康时显示维护页面。只要至少一个目标健康，您的资源将正常工作。",
@@ -2694,6 +3086,9 @@
     "maintenancePageMessagePlaceholder": "我们很快回来！ 我们的网站目前正在进行计划中的维护。",
     "maintenancePageMessageDescription": "详细说明维护的消息",
     "maintenancePageTimeTitle": "预计完成时间（可选）",
+    "privateMaintenanceScreenTitle": "私有占位符界面",
+    "privateMaintenanceScreenMessage": "此域名正在私有资源上使用。请连接 Pangolin 客户端以访问此资源。",
+    "privateMaintenanceScreenSteps": "连接后，如果您仍然看到此消息，说明您的浏览器的DNS缓存可能仍指向旧地址。解决方法：完全关闭并重新打开此标签页或浏览器，然后返回此页面。",
     "maintenanceTime": "例如，2小时，11月1日下午5:00",
     "maintenanceEstimatedTimeDescription": "您期望维护完成的时间",
     "editDomain": "编辑域名",
@@ -2704,6 +3099,7 @@
     "maintenanceScreenEstimatedCompletion": "预计完成时间：",
     "createInternalResourceDialogDestinationRequired": "需要目标地址",
     "available": "可用",
+    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "已存档",
     "noArchivedDevices": "未找到存档设备",
     "deviceArchived": "设备已存档",
@@ -2817,7 +3213,7 @@
     "streamingDatadogTitle": "Datadog",
     "streamingDatadogDescription": "直接转发事件到您的Datadog 帐户。即将推出。",
     "streamingTypePickerDescription": "选择要开始的目标类型。",
-    "streamingFailedToLoad": "加载目的地失败",
+    "streamingLastSyncError": "最后一次同步时发生错误",
     "streamingUnexpectedError": "发生意外错误.",
     "streamingFailedToUpdate": "更新目标失败",
     "streamingDeletedSuccess": "目标删除成功",
@@ -2831,6 +3227,41 @@
     "httpDestAddTitle": "添加 HTTP 目标",
     "httpDestEditDescription": "更新此 HTTP 事件流媒体目的地的配置。",
     "httpDestAddDescription": "配置新的 HTTP 端点来接收您的组织事件。",
+    "S3DestEditTitle": "编辑目的地",
+    "S3DestAddTitle": "添加 S3 目的地",
+    "S3DestEditDescription": "更新此 S3 事件流目的地的配置。",
+    "S3DestAddDescription": "配置一个新的 Amazon S3（或兼容 S3 的）存储桶以接收您的组织事件。",
+    "s3DestTabSettings": "设置",
+    "s3DestTabFormat": "格式",
+    "s3DestNameLabel": "名称",
+    "s3DestNamePlaceholder": "我的 S3 目的地",
+    "s3DestAccessKeyIdLabel": "AWS 访问密钥 ID",
+    "s3DestSecretAccessKeyLabel": "AWS 秘密访问密钥",
+    "s3DestSecretAccessKeyPlaceholder": "您的 AWS 密钥",
+    "s3DestRegionLabel": "AWS 地区",
+    "s3DestBucketLabel": "存储桶名称",
+    "s3DestPrefixLabel": "密钥前缀（可选）",
+    "s3DestPrefixDescription": "每个对象密钥前加的可选路径前缀。对象存储在 {prefix}/{logType}/{YYYY}/{MM}/{DD}/{filename}。",
+    "s3DestEndpointLabel": "自定义端点（可选）",
+    "s3DestEndpointDescription": "替代 S3 端点用于 MinIO 或 Cloudflare R2 等兼容 S3 的存储。标准 AWS S3 留空。",
+    "s3DestGzipLabel": "Gzip 压缩",
+    "s3DestGzipDescription": "使用 gzip 压缩每个上传的对象。减少存储成本和上传大小。",
+    "s3DestFormatTitle": "文件格式",
+    "s3DestFormatDescription": "事件在每个上传对象内的序列化方式。",
+    "s3DestFormatJsonArrayDescription": "每个对象是事件记录的 JSON 数组。兼容大多数分析工具。",
+    "s3DestFormatNdjsonDescription": "每个对象每行包含一个 JSON 记录（换行分隔的 JSON）。兼容 Athena、BigQuery 和 Spark。",
+    "s3DestFormatCsvTitle": "CSV",
+    "s3DestFormatCsvDescription": "每个对象是带有标题行的 RFC-4180 CSV 文件。列名来自事件数据字段。",
+    "s3DestSaveChanges": "保存更改",
+    "s3DestCreateDestination": "创建目的地",
+    "s3DestUpdatedSuccess": "目的地更新成功",
+    "s3DestCreatedSuccess": "目的地创建成功",
+    "s3DestUpdateFailed": "更新目的地失败",
+    "s3DestCreateFailed": "创建目的地失败",
+    "datadogDestEditTitle": "编辑目的地",
+    "datadogDestAddTitle": "添加 Datadog 目的地",
+    "datadogDestEditDescription": "更新此 Datadog 事件流目的地的配置。",
+    "datadogDestAddDescription": "配置新的 Datadog 终端以接收您的组织事件。",
     "httpDestTabSettings": "设置",
     "httpDestTabHeaders": "信头",
     "httpDestTabBody": "正文内容",
@@ -2845,10 +3276,10 @@
     "httpDestAuthNoneTitle": "无身份验证",
     "httpDestAuthNoneDescription": "在没有授权头的情况下发送请求。",
     "httpDestAuthBearerTitle": "持有者令牌",
-    "httpDestAuthBearerDescription": "添加授权：每个请求的标题为 <token>。",
+    "httpDestAuthBearerDescription": "在每个请求中添加授权：Bearer “<token>” 头。",
     "httpDestAuthBearerPlaceholder": "您的 API 密钥或令牌",
     "httpDestAuthBasicTitle": "基本认证",
-    "httpDestAuthBasicDescription": "添加授权：基本 <credentials> 头。提供用户名：密码的凭据。",
+    "httpDestAuthBasicDescription": "添加一个Authorization: Basic \"<凭据>\" 标头。 以用户名：密码形式提供凭据。",
     "httpDestAuthBasicPlaceholder": "用户名:密码",
     "httpDestAuthCustomTitle": "自定义标题",
     "httpDestAuthCustomDescription": "指定自定义 HTTP 头名称和身份验证值 (例如，X-API 键)。",
@@ -2870,7 +3301,7 @@
     "httpDestFormatJsonArrayTitle": "JSON 数组",
     "httpDestFormatJsonArrayDescription": "每批一个请求，实体是一个 JSON 数组。与大多数通用的 Web 钩子和数据兼容。",
     "httpDestFormatNdjsonTitle": "NDJSON",
-    "httpDestFormatNdjsonDescription": "每批有一个请求，物体是换行符限制的 JSON ——每行一个对象，不是外部数组。 Sluk HEC、Elastic / OpenSearch和Grafana Loki所需。",
+    "httpDestFormatNdjsonDescription": "每批有一个请求，物体是换行符限制的 JSON --每行一个对象，不是外部数组。 Sluk HEC、Elastic / OpenSearch和Grafana Loki所需。",
     "httpDestFormatSingleTitle": "每个请求一个事件",
     "httpDestFormatSingleDescription": "为每个事件单独发送一个 HTTP POST。仅用于无法处理批量的端点。",
     "httpDestLogTypesTitle": "日志类型",
@@ -2888,5 +3319,116 @@
     "httpDestUpdatedSuccess": "目标已成功更新",
     "httpDestCreatedSuccess": "目标创建成功",
     "httpDestUpdateFailed": "更新目标失败",
-    "httpDestCreateFailed": "创建目标失败"
+    "httpDestCreateFailed": "创建目标失败",
+    "followRedirects": "遵循重定向",
+    "followRedirectsDescription": "自动跟踪请求的 HTTP 重定向。",
+    "alertingErrorWebhookUrl": "请输入有效的 Webhook URL。",
+    "healthCheckStrategyHttp": "验证连接并检查 HTTP 响应状态。",
+    "healthCheckStrategyTcp": "只验证 TCP 连接性，不检查响应。",
+    "healthCheckStrategySnmp": "进行 SNMP get 请求以检查网络设备和基础架构的健康状况。",
+    "healthCheckStrategyIcmp": "使用 ICMP 回显请求（ping）检查资源是否可达并响应。",
+    "healthCheckTabStrategy": "策略",
+    "healthCheckTabConnection": "连接",
+    "healthCheckTabAdvanced": "高级",
+    "healthCheckStrategyNotAvailable": "此策略不可用。请联系销售以启用此功能。",
+    "uptime30d": "正常运行时间（30天）",
+    "idpAddActionCreateNew": "创建新的身份提供者",
+    "idpAddActionImportFromOrg": "从另一个组织导入",
+    "idpImportDialogTitle": "导入身份提供者",
+    "idpImportDialogDescription": "从您是管理员的组织中选择一个身份提供者。它将关联到本组织。",
+    "idpImportSearchPlaceholder": "按组织或提供者名称搜索……",
+    "idpImportEmpty": "未找到身份提供者。",
+    "idpImportedDescription": "身份提供者已成功导入。",
+    "idpDeleteGlobalQuestion": "您确定要永久删除此身份提供者吗？",
+    "idpDeleteGlobalDescription": "这将永久删除与其关联的所有组织中的身份提供者。",
+    "idpUnassociateTitle": "取消关联身份提供者",
+    "idpUnassociateQuestion": "您确定要将此身份提供者从此组织中取消关联吗？",
+    "idpUnassociateDescription": "与此身份提供者关联的所有用户将从该组织中移除，但身份提供者仍会继续存在于关联的其他组织中。",
+    "idpUnassociateConfirm": "确认取消关联身份提供者",
+    "idpUnassociateWarning": "此操作无法对该组织撤销。",
+    "idpUnassociatedDescription": "身份提供者已成功从该组织中取消关联",
+    "idpUnassociateMenu": "取消关联",
+    "idpDeleteAllOrgsMenu": "删除",
+    "publicIpEndpoint": "终端",
+    "lastTriggeredAt": "最后触发",
+    "reject": "拒绝",
+    "uptimeDaysAgo": "{count} 天前",
+    "uptimeToday": "今天",
+    "uptimeNoDataAvailable": "暂无数据",
+    "uptimeSuffix": "正常运行时间",
+    "uptimeDowntimeSuffix": "停机时间",
+    "uptimeTooltipUptimeLabel": "正常运行",
+    "uptimeTooltipDowntimeLabel": "停机",
+    "uptimeOngoing": "正在进行",
+    "uptimeNoMonitoringData": "无监控数据",
+    "uptimeNoData": "无数据",
+    "uptimeMiniBarDown": "停机",
+    "uptimeSectionTitle": "正常运行时间",
+    "uptimeSectionDescription": "过去 {days} 天的可用性",
+    "uptimeAddAlert": "添加警报",
+    "uptimeViewAlerts": "查看警报",
+    "uptimeCreateEmailAlert": "创建电子邮件警报",
+    "uptimeAlertDescriptionSite": "当此站点下线或恢复上线时，将通过电子邮件通知您。",
+    "uptimeAlertDescriptionResource": "当此资源下线或恢复上线时，将通过电子邮件通知您。",
+    "uptimeAlertNamePlaceholder": "警报名称",
+    "uptimeAdditionalEmails": "附加电子邮件",
+    "uptimeCreateAlert": "创建警报",
+    "uptimeAlertNoRecipients": "无收件人",
+    "uptimeAlertNoRecipientsDescription": "请至少添加一个用户、角色或电子邮件进行通知。",
+    "uptimeAlertCreated": "警报已创建",
+    "uptimeAlertCreatedDescription": "状态变化时将通知您。",
+    "uptimeAlertCreateFailed": "创建警报失败",
+    "webhookUrlLabel": "URL",
+    "webhookHeaderKeyPlaceholder": "关键字",
+    "webhookHeaderValuePlaceholder": "值",
+    "alertLabel": "警报",
+    "domainPickerWildcardSubdomainNotAllowed": "不允许使用通配符子域。",
+    "domainPickerWildcardCertWarning": "通配符资源可能需要额外配置才能正常工作。",
+    "domainPickerWildcardCertWarningLink": "了解更多",
+    "health": "健康",
+    "domainPendingErrorTitle": "验证问题",
+    "memberPortalTitle": "资源",
+    "memberPortalDescription": "您在此组织中可以访问的资源",
+    "memberPortalSortBy": "排序依据……",
+    "memberPortalSortNameAsc": "名称 A-Z",
+    "memberPortalSortNameDesc": "名称 Z-A",
+    "memberPortalSortDomainAsc": "域名 A-Z",
+    "memberPortalSortDomainDesc": "域名 Z-A",
+    "memberPortalSortEnabledFirst": "启用优先",
+    "memberPortalSortDisabledFirst": "禁用优先",
+    "memberPortalRefresh": "刷新",
+    "memberPortalRefreshResources": "刷新资源",
+    "memberPortalFailedToLoad": "加载资源失败",
+    "memberPortalFailedToLoadDescription": "加载资源失败。请检查您的连接并再试一次。",
+    "memberPortalUnableToLoad": "无法加载资源",
+    "memberPortalTryAgain": "再试一次",
+    "memberPortalNoResourcesFound": "找不到资源",
+    "memberPortalNoResourcesAvailable": "无可用资源",
+    "memberPortalNoResourcesMatchSearch": "没有与\"{query}\"匹配的资源。尝试调整您的搜索词或清除搜索以查看所有资源。",
+    "memberPortalNoResourcesAccess": "您尚无访问任何资源的权限。请联系您的管理员获取所需资源的访问权限。",
+    "memberPortalClearSearch": "清除搜索",
+    "memberPortalPublicResources": "公共资源",
+    "memberPortalPublicResourcesDescription": "通过浏览器可访问的网络应用和服务",
+    "memberPortalCopiedToClipboard": "已复制到剪贴板",
+    "memberPortalCopiedUrlDescription": "资源 URL 已复制到您的剪贴板。",
+    "memberPortalOpenResource": "打开资源",
+    "memberPortalPrivateResources": "私有资源",
+    "memberPortalPrivateResourcesDescription": "通过客户端可访问的内部网络资源",
+    "memberPortalResourceDetails": "资源详情",
+    "memberPortalMode": "模式",
+    "memberPortalDestination": "目标",
+    "memberPortalAlias": "别名",
+    "memberPortalCopiedAliasDescription": "资源别名已复制到您的剪贴板。",
+    "memberPortalCopiedDestinationDescription": "资源目的地已复制到您的剪贴板。",
+    "memberPortalRequiresClientConnection": "需要客户端连接",
+    "memberPortalAuthMethods": "身份验证方法",
+    "memberPortalSso": "单一登录 (SSO)",
+    "memberPortalPasswordProtected": "密码保护",
+    "memberPortalPinCode": "PIN 码",
+    "memberPortalEmailWhitelist": "电子邮件白名单",
+    "memberPortalResourceDisabled": "资源已禁用",
+    "memberPortalShowingResources": "显示 {start}-{end} 共 {total} 个资源",
+    "memberPortalPrevious": "上一页",
+    "memberPortalNext": "下一页",
+    "httpSettings": "HTTP Settings"
 }

next.config.ts

@@ -5,12 +5,8 @@ const withNextIntl = createNextIntlPlugin();
 
 const nextConfig: NextConfig = {
     reactStrictMode: false,
-    eslint: {
-        ignoreDuringBuilds: true
-    },
-    experimental: {
-        reactCompiler: true
-    },
+    reactCompiler: true,
+    transpilePackages: ["@novnc/novnc"],
     output: "standalone"
 };
 

package.json

@@ -32,13 +32,15 @@
         "format": "prettier --write ."
     },
     "dependencies": {
-        "@asteasolutions/zod-to-openapi": "8.4.1",
-        "@aws-sdk/client-s3": "3.1011.0",
-        "@faker-js/faker": "10.3.0",
-        "@headlessui/react": "2.2.9",
+        "@asteasolutions/zod-to-openapi": "8.5.0",
+        "@aws-sdk/client-s3": "3.1047.0",
+        "@headlessui/react": "2.2.10",
+        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
         "@hookform/resolvers": "5.2.2",
         "@monaco-editor/react": "4.7.0",
         "@node-rs/argon2": "2.0.2",
+        "@novnc/novnc": "^1.7.0",
         "@oslojs/crypto": "1.0.1",
         "@oslojs/encoding": "1.1.0",
         "@radix-ui/react-avatar": "1.1.11",
@@ -59,16 +61,20 @@
         "@radix-ui/react-tabs": "1.1.13",
         "@radix-ui/react-toast": "1.2.15",
         "@radix-ui/react-tooltip": "1.2.8",
-        "@react-email/components": "1.0.8",
-        "@react-email/render": "2.0.4",
-        "@react-email/tailwind": "2.0.5",
+        "@react-email/body": "0.3.0",
+        "@react-email/components": "1.0.12",
+        "@react-email/render": "2.0.8",
+        "@react-email/tailwind": "2.0.7",
         "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.0",
+        "@simplewebauthn/server": "13.3.1",
         "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.90.21",
+        "@tanstack/react-query": "5.100.14",
         "@tanstack/react-table": "8.21.3",
+        "@xterm/addon-fit": "^0.11.0",
+        "@xterm/addon-web-links": "^0.12.0",
+        "@xterm/xterm": "^6.0.0",
         "arctic": "3.7.0",
-        "axios": "1.13.5",
+        "axios": "1.16.1",
         "better-sqlite3": "11.9.1",
         "canvas-confetti": "1.9.4",
         "class-variance-authority": "0.7.1",
@@ -78,78 +84,77 @@
         "cors": "2.8.6",
         "crypto-js": "4.2.0",
         "d3": "7.9.0",
-        "drizzle-orm": "0.45.1",
+        "drizzle-orm": "0.45.2",
         "express": "5.2.1",
-        "express-rate-limit": "8.3.0",
+        "express-rate-limit": "8.5.2",
         "glob": "13.0.6",
         "helmet": "8.1.0",
         "http-errors": "2.0.1",
         "input-otp": "1.4.2",
-        "ioredis": "5.10.0",
+        "ioredis": "5.10.1",
         "jmespath": "0.16.0",
         "js-yaml": "4.1.1",
         "jsonwebtoken": "9.0.3",
         "lucide-react": "0.577.0",
-        "maxmind": "5.0.5",
+        "maxmind": "5.0.6",
         "moment": "2.30.1",
-        "next": "15.5.14",
-        "next-intl": "4.8.3",
+        "next": "16.2.6",
+        "next-intl": "4.12.0",
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
         "node-cache": "5.1.2",
-        "nodemailer": "8.0.4",
+        "nodemailer": "8.0.9",
         "oslo": "1.2.1",
         "pg": "8.20.0",
-        "posthog-node": "5.28.0",
+        "posthog-node": "5.34.1",
         "qrcode.react": "4.2.0",
-        "react": "19.2.4",
+        "react": "19.2.6",
         "react-day-picker": "9.14.0",
-        "react-dom": "19.2.4",
+        "react-dom": "19.2.6",
         "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.71.2",
+        "react-hook-form": "7.75.0",
         "react-icons": "5.6.0",
-        "recharts": "2.15.4",
+        "recharts": "3.8.1",
         "reodotdev": "1.1.0",
-        "resend": "6.9.2",
-        "semver": "7.7.4",
+        "semver": "7.8.1",
         "sshpk": "1.18.0",
         "stripe": "20.4.1",
         "swagger-ui-express": "5.0.1",
-        "tailwind-merge": "3.5.0",
+        "tailwind-merge": "3.6.0",
         "topojson-client": "3.1.0",
         "tw-animate-css": "1.4.0",
-        "use-debounce": "10.1.0",
-        "uuid": "13.0.0",
+        "use-debounce": "10.1.1",
+        "uuid": "14.0.0",
         "vaul": "1.1.2",
         "visionscarto-world-atlas": "1.0.0",
         "winston": "3.19.0",
         "winston-daily-rotate-file": "5.0.0",
-        "ws": "8.19.0",
-        "yaml": "2.8.3",
+        "ws": "8.20.1",
+        "yaml": "2.9.0",
         "yargs": "18.0.0",
-        "zod": "4.3.6",
+        "zod": "4.4.3",
         "zod-validation-error": "5.0.0"
     },
     "devDependencies": {
-        "@dotenvx/dotenvx": "1.54.1",
+        "@dotenvx/dotenvx": "1.69.1",
         "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/preview-server": "5.2.10",
-        "@tailwindcss/postcss": "4.2.2",
-        "@tanstack/react-query-devtools": "5.91.3",
+        "@react-email/ui": "^6.5.0",
+        "@tailwindcss/postcss": "4.3.0",
+        "@tanstack/react-query-devtools": "5.100.10",
         "@types/better-sqlite3": "7.6.13",
         "@types/cookie-parser": "1.4.10",
         "@types/cors": "2.8.19",
         "@types/crypto-js": "4.2.2",
         "@types/d3": "7.4.3",
         "@types/express": "5.0.6",
-        "@types/express-session": "1.18.2",
+        "@types/express-session": "1.19.0",
         "@types/jmespath": "0.15.2",
         "@types/js-yaml": "4.0.9",
         "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "25.3.5",
-        "@types/nodemailer": "7.0.11",
+        "@types/node": "25.9.1",
+        "@types/nodemailer": "8.0.0",
         "@types/nprogress": "0.2.3",
-        "@types/pg": "8.18.0",
+        "@types/pg": "8.20.0",
         "@types/react": "19.2.14",
         "@types/react-dom": "19.2.3",
         "@types/semver": "7.7.1",
@@ -160,21 +165,22 @@
         "@types/yargs": "17.0.35",
         "babel-plugin-react-compiler": "1.0.0",
         "drizzle-kit": "0.31.10",
-        "esbuild": "0.27.4",
-        "esbuild-node-externals": "1.20.1",
-        "eslint": "10.0.3",
-        "eslint-config-next": "16.1.7",
-        "postcss": "8.5.8",
-        "prettier": "3.8.1",
-        "react-email": "5.2.10",
-        "tailwindcss": "4.2.2",
-        "tsc-alias": "1.8.16",
-        "tsx": "4.21.0",
-        "typescript": "5.9.3",
-        "typescript-eslint": "8.56.1"
+        "esbuild": "0.28.0",
+        "esbuild-node-externals": "1.22.0",
+        "eslint": "10.4.0",
+        "eslint-config-next": "16.2.6",
+        "postcss": "8.5.14",
+        "prettier": "3.8.3",
+        "react-email": "6.5.0",
+        "tailwindcss": "4.3.0",
+        "tsc-alias": "1.8.17",
+        "tsx": "4.22.0",
+        "typescript": "6.0.3",
+        "typescript-eslint": "8.60.0"
     },
     "overrides": {
-        "esbuild": "0.27.4",
-        "dompurify": "3.3.2"
+        "esbuild": "0.28.0",
+        "dompurify": "3.4.0",
+        "postcss": "8.5.14"
     }
 }