Merge pull request #3221 from fosrl/dev

1.19.0-rc.1
Fix http resources not being pulled
2026-06-05 06:59:52 +00:00 · 2026-06-04 15:45:27 -07:00 · 2026-06-04 15:36:25 -07:00 · 2026-06-04 15:20:52 -07:00 · 2026-06-04 11:21:59 -07:00 · 2026-06-04 11:21:40 -07:00
54 changed files with 2878 additions and 1233 deletions
--- a/install/config/config.yml
+++ b/install/config/config.yml
@@ -38,7 +38,5 @@ flags:
    disable_user_create_org: false
    allow_raw_resources: true

-{{if .IsPostgreSQL}}
-postgres:
-  connection_string: postgresql://pangolin:{{.IsPostgreSQLPass}}@postgres:5432/pangolin
-{{end}}
+{{if .IsPostgreSQL}}postgres:
+    connection_string: postgresql://pangolin:{{.IsPostgreSQLPass}}@postgres:5432/pangolin{{end}}
--- a/install/config/docker-compose.yml
+++ b/install/config/docker-compose.yml
@@ -7,23 +7,17 @@ services:
    deploy:
      resources:
        limits:
-          memory: 1g
+          memory: 2g
        reservations:
-          memory: 256m
-{{if or .IsPostgreSQL .IsRedis}}
-    depends_on:
-    {{if .IsPostgreSQL}}
-      postgres:
-        condition: service_healthy
-    {{end}}
-    {{if .IsRedis}}
-      redis:
-        condition: service_healthy
-    {{end}}
+          memory: 512m
+    {{if or .IsPostgreSQL .IsRedis}}depends_on:
+      {{if .IsPostgreSQL}}postgres:
+          condition: service_healthy{{end}}
+      {{if .IsRedis}}redis:
+          condition: service_healthy{{end}}
    networks:
      - default
-      - backend
-{{end}}
+      - backend{{end}}
    volumes:
      - ./config:/app/config
    healthcheck:
@@ -31,8 +25,8 @@ services:
      interval: "10s"
      timeout: "10s"
      retries: 15
-{{if .InstallGerbil}}
-  gerbil:
+
+  {{if .InstallGerbil}}gerbil:
    image: docker.io/fosrl/gerbil:{{.GerbilVersion}}
    container_name: gerbil
    restart: unless-stopped
@@ -53,17 +47,16 @@ services:
      - 21820:21820/udp
      - 443:443
      - 443:443/udp # For http3 QUIC if desired
-      - 80:80
-{{end}}
+      - 80:80{{end}}
+
  traefik:
    image: docker.io/traefik:v3.6
    container_name: traefik
    restart: unless-stopped
-{{if .InstallGerbil}}    network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
+    {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
    ports:
      - 443:443
-      - 80:80
-{{end}}
+      - 80:80{{end}}
    depends_on:
      pangolin:
        condition: service_healthy
@@ -74,8 +67,7 @@ services:
      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs

-{{if .IsPostgreSQL}}
-  postgres:
+  {{if .IsPostgreSQL}}postgres:
    image: postgres:18
    container_name: postgres
    restart: unless-stopped
@@ -91,11 +83,9 @@ services:
      timeout: 5s
      retries: 5
    networks:
-      - backend
-{{end}}
+      - backend{{end}}

-{{if .IsRedis}}
-  redis:
+  {{if .IsRedis}}redis:
    image: redis:8-trixie
    container_name: redis
    restart: unless-stopped
@@ -113,17 +103,14 @@ services:
      retries: 3
      start_period: 10s
    networks:
-      - backend
-{{end}}
+      - backend{{end}}

 networks:
  default:
    driver: bridge
    name: pangolin_frontend
 {{if .EnableIPv6}}    enable_ipv6: true{{end}}
-{{if or .IsPostgreSQL .IsRedis}}
-  backend:
+{{if or .IsPostgreSQL .IsRedis}}  backend:
    driver: bridge
    name: pangolin_backend
-    internal: true
-{{end}}
+    internal: true{{end}}
--- a/install/config/privateConfig.yml
+++ b/install/config/privateConfig.yml
@@ -1,6 +1,4 @@
-{{if .IsRedis}}
-redis:
+{{if .IsRedis}}redis:
  host: "redis"
  port: 6379
-  password: "{{.IsRedisPass}}"
-{{end}}
+  password: "{{.IsRedisPass}}"{{end}}
--- a/install/main.go
+++ b/install/main.go
@@ -71,9 +71,12 @@ const (
 	Undefined SupportedContainer = "undefined"
 )

+var redisFlag *bool
+
 func main() {

 	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
+	redisFlag = flag.Bool("redis", false, "Install Redis as cacheing solution. Required for HA. Not required for the Enterprise version.")
 	flag.Parse()

 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking
@@ -491,13 +494,13 @@ func collectUserInput() Config {

 	config.IsEnterprise = readBoolNoDefault("Do you want to install the Enterprise version of Pangolin? The EE is free for personal use or for businesses making less than 100k USD annually.")
    if config.IsEnterprise {
-        config.IsRedis = readBool("Do you want to run the Redis containers locally? Required for HA.")
-        if config.IsRedis {
+        if *redisFlag {
+			config.IsRedis = true
            config.IsRedisPass = readPassword("Enter a unique password for the Redis service.")
        }
    }

-    config.IsPostgreSQL = readBool("Do you want to run the PostgreSQL containers locally? Otherwise, default to the local SQLite database only.", false)
+    config.IsPostgreSQL = readBool("Do you want to use PostgreSQL (not recommended for most users)?", false)
 	if config.IsPostgreSQL {
 		config.IsPostgreSQLPass = readPassword("Enter a unique password for the PostgreSQL pangolin user.")
 	}
@@ -544,7 +547,7 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Advanced Configuration ===")

 	config.EnableIPv6 = readBool("Is your server IPv6 capable?", true)
-	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ADN databases for blocking functionality?", true)
+	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ASN databases for blocking functionality?", true)

 	if config.DashboardDomain == "" {
 		fmt.Println("Error: Dashboard Domain name is required")
--- a/messages/bg-BG.json
+++ b/messages/bg-BG.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Възникна грешка при създаването на връзката за споделяне",
    "shareCreateDescription": "Всеки с тази връзка може да получи достъп до ресурса",
    "shareTitleOptional": "Заглавие (по избор)",
+    "sharePathOptional": "Път (по избор)",
    "expireIn": "Изтече",
    "neverExpire": "Никога не изтича",
    "shareExpireDescription": "Времето на изтичане е колко дълго връзката ще бъде използваема и ще предоставя достъп до ресурса. След това време, връзката няма да работи и потребителите, които са я използвали, ще загубят достъп до ресурса.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Търсене на ресурси...",
    "resourceAdd": "Добавете ресурс",
    "resourceErrorDelte": "Грешка при изтриване на ресурс",
+    "resourcePoliciesTitle": "Управление на политики за ресурси",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Свързани ресурси",
+    "resourcePoliciesAttachedResources": "{count} ресурс(а)",
+    "resourcePoliciesAttachedResourcesEmpty": "няма ресурси",
+    "resourcePoliciesDescription": "Създавай и управлявай политики за автентикация, за да контролирате достъпа до вашите ресурси",
+    "resourcePoliciesSearch": "Търсене на политики...",
+    "resourcePoliciesAdd": "Добавяне на политика",
+    "resourcePoliciesDefaultBadgeText": "Стандартна политика",
+    "resourcePoliciesCreate": "Създаване на политика за ресурс",
+    "resourcePoliciesCreateDescription": "Следвайте стъпките по-долу, за да създадете нова политика",
+    "resourcePolicyName": "Име на политика",
+    "resourcePolicyNameDescription": "Дайте на тази политика име, за да я идентифицирате в цялото ви ресурси",
+    "resourcePolicyNamePlaceholder": "например Политика за вътрешен достъп",
+    "resourcePoliciesSeeAll": "Вижте всички политики",
+    "resourcePolicyAuthMethodAdd": "Добавяне на метод за идентификация",
+    "resourcePolicyOtpEmailAdd": "Добавяне на имейли за еднократна парола",
+    "resourcePolicyRulesAdd": "Добавяне на правила",
+    "resourcePolicyAuthMethodsDescription": "Позволете достъп до ресурси чрез допълнителни методи за идентификация",
+    "resourcePolicyUsersRolesDescription": "Конфигурирайте потребителите и ролите, които могат да посетят свързаните ресурси",
+    "rulesResourcePolicyDescription": "Конфигурирайте правилата за контрол на достъп до ресурси, свързани с тази политика",
    "authentication": "Удостоверяване",
    "protected": "Защита",
    "notProtected": "Не защитен",
    "resourceMessageRemove": "След като се премахне, ресурсът няма повече да бъде достъпен. Всички цели, свързани с ресурса, също ще бъдат премахнати.",
    "resourceQuestionRemove": "Сигурни ли сте, че искате да премахнете ресурса от организацията?",
+    "resourcePolicyMessageRemove": "След премахването, политиката за ресурс няма да бъде повече достъпна. Всички ресурси, свързани с ресурса, ще бъдат нерешени и оставени без идентификация.",
+    "resourcePolicyQuestionRemove": "Сигурни ли сте, че искате да премахнете политиката за ресурс от организацията?",
    "resourceHTTP": "HTTPS ресурс",
    "resourceHTTPDescription": "Прокси заявки чрез HTTPS, използвайки напълно квалифицирано име на домейн.",
    "resourceRaw": "Суров TCP/UDP ресурс",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Получавайте заявки чрез суров TCP/UDP с използване на портен номер. Изисква се сайтовете да се свързват към отдалечен възел.",
    "resourceCreate": "Създайте ресурс",
    "resourceCreateDescription": "Следвайте стъпките по-долу, за да създадете нов ресурс",
+    "resourceCreateGeneralDescription": "Конфигуриране на основните настройки на ресурса, включително име и тип",
    "resourceSeeAll": "Вижте всички ресурси",
-    "resourceInfo": "Информация за ресурса",
+    "resourceCreateGeneral": "Основни параметри",
    "resourceNameDescription": "Това е дисплейното име на ресурса.",
    "siteSelect": "Изберете сайт",
    "siteSearch": "Търсене на сайт",
@@ -231,12 +255,15 @@
    "noCountryFound": "Не е намерена държава.",
    "siteSelectionDescription": "Този сайт ще осигури свързаност до целта.",
    "resourceType": "Тип ресурс",
-    "resourceTypeDescription": "Определете как да се достъпи ресурсът",
+    "resourceTypeDescription": "Това контролира протокола на ресурса и как той ще се визуализира в браузъра. Това не може да бъде променено по-късно.",
+    "resourceDomainDescription": "Ресурсът ще се обслужва на това напълно квалифицирано име на домейн.",
    "resourceHTTPSSettings": "HTTPS настройки",
    "resourceHTTPSSettingsDescription": "Конфигурирайте как ресурсът ще бъде достъпен по HTTPS",
+    "resourcePortDescription": "Външен порт на инстанцията или възела на Панголиин, където ресурсът ще бъде достъпен.",
    "domainType": "Тип домейн",
    "subdomain": "Субдомейн",
    "baseDomain": "Базов домейн",
+    "configure": "Конфигуриране",
    "subdomnainDescription": "Поддомейнът, където ресурсът ще бъде достъпен.",
    "resourceRawSettings": "TCP/UDP настройки",
    "resourceRawSettingsDescription": "Конфигурирайте как ресурсът ще бъде достъпен чрез TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Научете как да конфигурирате TCP/UDP ресурси",
    "resourceBack": "Назад към ресурсите",
    "resourceGoTo": "Отидете към ресурса",
+    "resourcePolicyDelete": "Изтриване на политика за ресурс",
+    "resourcePolicyDeleteConfirm": "Потвърдете изтриване на политика за ресурс",
    "resourceDelete": "Изтрийте ресурс",
    "resourceDeleteConfirm": "Потвърдете изтриване на ресурс",
+    "labelDelete": "Изтриване на етикета",
+    "labelAdd": "Добавяне на етикет",
+    "labelCreateSuccessMessage": "Етикетът е създаден успешно",
+    "labelEditSuccessMessage": "Етикетът е променен успешно",
+    "labelNameField": "Име на етикет",
+    "labelColorField": "Цвят на етикет",
+    "labelPlaceholder": "Пр.: homelab",
+    "labelCreate": "Създаване на етикет",
+    "createLabelDialogTitle": "Създаване на етикет",
+    "createLabelDialogDescription": "Създайте нов етикет, който може да се прикачи към тази организация",
+    "labelEdit": "Редактиране на етикет",
+    "editLabelDialogTitle": "Актуализиране на етикет",
+    "editLabelDialogDescription": "Редактирайте нов етикет, който може да се прикачи към тази организация",
+    "labelDeleteConfirm": "Потвърдете изтриването на етикета",
+    "labelErrorDelete": "Неуспешно изтриване на етикета",
+    "labelMessageRemove": "Това действие е постоянно. Всички сайтове, ресурси и клиенти, маркирани с този етикет, ще бъдат отмаркирани.",
+    "labelQuestionRemove": "Сигурни ли сте, че искате да премахнете етикета от организацията?",
    "visibility": "Видимост",
    "enabled": "Активиран",
    "disabled": "Деактивиран",
@@ -265,6 +311,8 @@
    "rules": "Правила",
    "resourceSettingDescription": "Конфигурирайте настройките на ресурса",
    "resourceSetting": "Настройки на {resourceName}",
+    "resourcePolicySettingDescription": "Конфигурирайте настройките на политиката за ресурс",
+    "resourcePolicySetting": "Настройки за {policyName}",
    "alwaysAllow": "Заобикаляне на Ауторизацията",
    "alwaysDeny": "Блокиране на Достъпа",
    "passToAuth": "Прехвърляне към удостоверяване",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Няма правила. Добавете правило чрез формуляра.",
    "rulesOrder": "Правилата се оценяват по приоритет в нарастващ ред.",
    "rulesSubmit": "Запазване на правилата",
+    "policyErrorCreate": "Грешка при създаване на политика",
+    "policyErrorCreateDescription": "Възникна грешка при създаването на политиката",
+    "policyErrorCreateMessageDescription": "Възникна неочаквана грешка",
+    "policyErrorUpdate": "Грешка при актуализиране на политика",
+    "policyErrorUpdateDescription": "Възникна грешка при актуализиране на политиката",
+    "policyErrorUpdateMessageDescription": "Възникна неочаквана грешка",
+    "policyCreatedSuccess": "Политиката за ресурс е създадена успешно",
+    "policyUpdatedSuccess": "Политиката за ресурс е актуализирана успешно",
+    "authMethodsSave": "Запазете методите за идентификация",
+    "rulesSave": "Запазете правилата",
    "resourceErrorCreate": "Грешка при създаване на ресурс",
    "resourceErrorCreateDescription": "Възникна грешка при създаването на ресурса",
    "resourceErrorCreateMessage": "Грешка при създаване на ресурс:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Добави ПИН код",
    "pincodeRemove": "Премахни ПИН код",
    "resourceAuthMethods": "Методи за автентикация",
+    "resourcePolicyAuthMethodsEmpty": "Няма метод за идентификация",
+    "resourcePolicyOtpEmpty": "Без еднократна парола",
+    "resourcePolicyReadOnly": "Тази политика е само за четене",
+    "resourcePolicyReadOnlyDescription": "Тази политика за ресурс се споделя между множество ресурси, не можете да я редактирате на тази страница.",
+    "editSharedPolicy": "Редактирай споделена политика",
+    "resourcePolicyTypeSave": "Запазете типа на ресурс",
+    "resourcePolicySelect": "Изберете политика за ресурс",
+    "resourcePolicySelectError": "Изберете политика за ресурс",
+    "resourcePolicyNotFound": "Политиката не е намерена",
+    "resourcePolicySearch": "Търсене на политики",
+    "resourcePolicyRulesEmpty": "Няма правила за идентификация",
    "resourceAuthMethodsDescriptions": "Позволете достъп до ресурса чрез допълнителни методи за автентикация",
    "resourceAuthSettingsSave": "Запазено успешно",
    "resourceAuthSettingsSaveDescription": "Настройките за автентикация са запазени успешно",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Задай ПИН код",
    "resourcePincodeSetupTitleDescription": "Задайте ПИН код, за да защитите този ресурс",
    "resourceRoleDescription": "Администраторите винаги могат да имат достъп до този ресурс.",
+    "resourcePolicySelectTitle": "Политика за достъп до ресурс",
+    "resourcePolicySelectDescription": "Изберете типа на политиката за ресурс за идентификация",
+    "resourcePolicyInline": "Инлайн Политика за Ресурс",
+    "resourcePolicyInlineDescription": "Политика за достъп, ограничена само до този ресурс",
+    "resourcePolicyShared": "Споделена Политика за Ресурс",
+    "resourcePolicySharedDescription": "Този ресурс използва споделена политика. Настройки на ниво политика (методи за идентификация, бял списък на имейли) са заключени. Можете да добавите правила за ресурса, роли и потребители по-долу.",
    "resourceUsersRoles": "Контроли за достъп",
    "resourceUsersRolesDescription": "Конфигурирайте кои потребители и роли могат да посещават този ресурс",
    "resourceUsersRolesSubmit": "Запазване на управлението на достъп.",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Имаше проблем със свързването към {name}. Моля, свържете се с вашия администратор.",
    "idpErrorNotFound": "Не е намерен идентификационен доставчик",
    "inviteInvalid": "Невалидна покана",
+    "labels": "Етикети",
+    "orgLabelsDescription": "Управление на етикети в тази организация.",
+    "addLabels": "Добавяне на етикети",
+    "siteLabelsTab": "Етикети",
+    "siteLabelsDescription": "Управление на етикети, свързани с този сайт.",
+    "labelsNotFound": "Етикети не са намерени",
+    "labelSearch": "Търсене на етикети",
+    "accessLabelFilterCount": "{count, plural, one {# етикет} other {# етикети}}",
+    "labelOverflowCount": "+{count, plural, one {# етикет} other {# етикети}}",
+    "accessLabelFilterClear": "Изчисти филтрите за етикети",
+    "selectColor": "Изберете цвят",
+    "createNewLabel": "Създайте нов организационен етикет \"{label}\"",
    "inviteInvalidDescription": "Линкът към поканата е невалиден.",
    "inviteErrorWrongUser": "Поканата не е за този потребител",
    "inviteErrorUserNotExists": "Потребителят не съществува. Моля, създайте акаунт първо.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Ресурси",
    "sidebarProxyResources": "Публично",
    "sidebarClientResources": "Частно",
+    "sidebarPolicies": "Политики",
+    "sidebarResourcePolicies": "Ресурси",
    "sidebarAccessControl": "Контрол на достъпа",
    "sidebarLogsAndAnalytics": "Дневници и анализи",
    "sidebarTeam": "Екип",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Сайт {id}",
    "standaloneHcFilterResourceIdFallback": "Ресурс {id}",
    "blueprints": "Чертежи",
-    "blueprintsDescription": "Прилагайте декларативни конфигурации и преглеждайте предишни изпълнения",
+    "blueprintsLog": "Регистър на скицописи",
+    "blueprintsDescription": "Вижте предишни приложения и техните резултати",
    "blueprintAdd": "Добави Чертеж",
    "blueprintGoBack": "Виж всички Чертежи",
    "blueprintCreate": "Създай Чертеж",
@@ -1575,7 +1665,17 @@
    "contents": "Съдържание",
    "parsedContents": "Парсирано съдържание (само за четене)",
    "enableDockerSocket": "Активиране на Docker Чернова",
-    "enableDockerSocketDescription": "Активиране на Docker Socket маркировка за изтегляне на етикети на чернова. Пътят на гнездото трябва да бъде предоставен на Newt.",
+    "enableDockerSocketDescription": "Активирайте изтегляне с етикети на Docker Socket за скицописи. Пътят на гнездото трябва да бъде предоставен на конектора на сайта. Прочетете как работи това в <docsLink>документацията</docsLink>.",
+    "newtAutoUpdate": "Активиране на автоматично обновяване на сайта",
+    "newtAutoUpdateDescription": "Когато е активно, конекторите на сайта автоматично ще се актуализират до най-новата версия при наличието на ново издание.",
+    "siteAutoUpdate": "Автоматично обновяване на сайта",
+    "siteAutoUpdateLabel": "Активиране на автоматично обновяване",
+    "siteAutoUpdateDescription": "Управлявайте дали конекторът за този сайт автоматично изтегля последната версия.",
+    "siteAutoUpdateOrgDefault": "По подразбиране за организацията: {state}",
+    "siteAutoUpdateOverriding": "Преодоляване на настройката на организацията",
+    "siteAutoUpdateResetToOrg": "Възстановяване към организацията по подразбиране",
+    "siteAutoUpdateEnabled": "активиран",
+    "siteAutoUpdateDisabled": "деактивиран",
    "viewDockerContainers": "Преглед на Docker контейнери",
    "containersIn": "Контейнери в {siteName}",
    "selectContainerDescription": "Изберете контейнер, който да ползвате като име на хост за целта. Натиснете порт, за да ползвате порт",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Сертификат",
    "certificateStatusAutoRefreshHint": "Състоянието се опреснява автоматично.",
    "loading": "Зареждане",
+    "loadingEllipsis": "Зареждане...",
    "loadingAnalytics": "Зареждане на анализи",
    "restart": "Рестарт",
    "domains": "Домейни",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Управлявайте абонамента си за платени самостоятелно хоствани лицензионни ключове",
    "billingCurrentKeys": "Текущи ключове",
    "billingModifyCurrentPlan": "Промяна на текущия план",
+    "billingManageLicenseSubscriptionDescription": "Управление на вашия абонамент за платени самообслужвани лицензионни ключове и изтегляне на фактури.",
    "billingConfirmUpgrade": "Потвърдете повишаването",
    "billingConfirmDowngrade": "Потвърдете понижението",
    "billingConfirmUpgradeDescription": "Предстои ви да повишите плана си. Прегледайте новите ограничения и цени по-долу.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Времето е в секунди",
    "requireDeviceApproval": "Изискват одобрение на устройства",
    "requireDeviceApprovalDescription": "Потребители с тази роля трябва да имат нови устройства одобрени от администратор преди да могат да се свържат и да имат достъп до ресурси.",
-    "sshAccess": "SSH достъп",
+    "sshSettings": "Настройки за SSH",
+    "rdpSettings": "Настройки за RDP",
+    "vncSettings": "Настройки за VNC",
+    "sshServer": "SSH сървър",
+    "rdpServer": "RDP сървър",
+    "vncServer": "VNC сървър",
+    "sshServerDescription": "Настройте метода на идентификация, местоположението на демона и дестинацията на сървъра",
+    "rdpServerDescription": "Конфигуриране на дестинацията и порта на RDP сървъра",
+    "vncServerDescription": "Конфигуриране на дестинацията и порта на VNC сървъра",
+    "sshServerMode": "Режим",
+    "sshServerModeStandard": "Стандартен SSH сървър",
+    "sshServerModePangolin": "Панголиин SSH",
+    "sshServerModeStandardDescription": "Насочва командите към мрежата до SSH сървър, като например OpenSSH.",
+    "sshServerModeNative": "Нативен SSH сървър",
+    "sshServerModeNativeDescription": "Изпълнява команди директно на хоста чрез конектора на сайта. Не е необходима мрежова конфигурация.",
+    "sshAuthenticationMethod": "Метод на идентификация",
+    "sshAuthMethodManual": "Ръчна идентификация",
+    "sshAuthMethodManualDescription": "Изисква съществуващи идентификационни данни за хоста. Пропуска автоматичното осигуряване.",
+    "sshAuthMethodAutomated": "Автоматично осигуряване",
+    "sshAuthMethodAutomatedDescription": "Създава автоматично потребители, групи и sudo разрешения на хоста.",
+    "sshAuthDaemonLocation": "Местоположение на демона за идентификация",
+    "sshDaemonLocationSiteDescription": "Изпълнява се локално на машината, която хоства конектора на сайта.",
+    "sshDaemonLocationRemote": "На отдалечен хост",
+    "sshDaemonLocationRemoteDescription": "Изпълнява се на отделна целева машина в същата мрежа.",
+    "sshDaemonDisclaimer": "Уверете се, че вашата целева хост машина е правилно конфигурирана за изпълнение на демона за идентификация преди завършване на тази настройка, в противен случай осигуряването ще се провали.",
+    "sshDaemonPort": "Порт на демона",
+    "sshServerDestination": "Дестинация на сървъра",
+    "sshServerDestinationDescription": "Конфигуриране на дестинацията и порта на SSH сървъра",
+    "destination": "Дестинация",
+    "bgTargetMultiSiteDisclaimer": "Избиране на множество сайтове позволява устойчиво маршрутизиране и сокетно превключване за висока наличност.",
    "roleAllowSsh": "Разреши SSH",
    "roleAllowSshAllow": "Разреши",
    "roleAllowSshDisallow": "Забрани",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Потребителят може да изпълнява само определени команди с sudo.",
    "sshSudo": "Разреши sudo",
    "sshSudoCommands": "Sudo команди",
-    "sshSudoCommandsDescription": "Списък, разделен със запетаи, с команди, които потребителят е позволено да изпълнява с sudo.",
+    "sshSudoCommandsDescription": "Списък с командите, разрешени да се изпълняват от потребителя с sudo. Трябва да се използват абсолютни пътища.",
    "sshCreateHomeDir": "Създай начална директория",
    "sshUnixGroups": "Unix групи",
    "sshUnixGroupsDescription": "Списък, разделен със запетаи, с Unix групи, към които да се добави потребителят на целевия хост.",
@@ -2051,7 +2182,7 @@
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Метод",
-    "editInternalResourceDialogEnableSsl": "Активирайте TLS",
+    "editInternalResourceDialogEnableSsl": "Активиране на TLS",
    "editInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
    "editInternalResourceDialogDestination": "Дестинация",
    "editInternalResourceDialogDestinationHostDescription": "IP адресът или името на хоста на ресурса в мрежата на сайта.",
@@ -2102,7 +2233,7 @@
    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Метод",
    "createInternalResourceDialogScheme": "Метод",
-    "createInternalResourceDialogEnableSsl": "Активирайте TLS",
+    "createInternalResourceDialogEnableSsl": "Активиране на TLS",
    "createInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
    "createInternalResourceDialogDestination": "Дестинация",
    "createInternalResourceDialogDestinationHostDescription": "IP адресът или името на хоста на ресурса в мрежата на сайта.",
@@ -2235,7 +2366,7 @@
        "description": "По-надежден и по-нисък поддръжка на Самостоятелно-хостван Панголиин сървър с допълнителни екстри",
        "introTitle": "Управлявано Самостоятелно-хостван Панголиин",
        "introDescription": "е опция за внедряване, предназначена за хора, които искат простота и допълнителна надеждност, като същевременно запазят данните си частни и самостоятелно-хоствани.",
-        "introDetail": "С тази опция все още управлявате свой собствен Панголиин възел - вашите тунели, TLS терминатора и трафик остават на вашия сървър. Разликата е, че управлението и мониторингът се обработват чрез нашия облачен панел за контрол, който отключва редица предимства:",
+        "introDetail": "С тази опция все още управлявате свой собствен възел на Панголиин - вашите тунели, SSL прекратяване и трафик остават на вашия сървър. Разликата е, че управлението и мониторингът се обработват чрез нашия облачен панел, който отключва редица предимства:",
        "benefitSimplerOperations": {
            "title": "По-прости операции",
            "description": "Няма нужда да управлявате свой собствен имейл сървър или да настройвате сложни аларми. Ще получите проверки и предупреждения при прекъсване от самото начало."
@@ -2939,7 +3070,7 @@
    "learnMore": "Научете повече.",
    "backToHome": "Връщане към началната страница.",
    "needToSignInToOrg": "Трябва ли да използвате доставчика на идентичност на организацията си?",
-    "maintenanceMode": "Режим на поддръжка.",
+    "maintenanceMode": "Страница за поддръжка",
    "maintenanceModeDescription": "Показване на страницата за поддръжка на посетители.",
    "maintenanceModeType": "Тип режим на поддръжка.",
    "showMaintenancePage": "Показване на страницата за поддръжка на посетители.",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Прогнозно завършване:",
    "createInternalResourceDialogDestinationRequired": "Дестинацията е задължителна.",
    "available": "Налично",
+    "disabledResourceDescription": "Когато е деактивиран, ресурсът ще бъде недостъпен от всеки.",
    "archived": "Архивирано",
    "noArchivedDevices": "Не са намерени архивирани устройства.",
    "deviceArchived": "Устройството е архивирано.",
@@ -3138,7 +3270,7 @@
    "httpDestNamePlaceholder": "Моята HTTP дестинация",
    "httpDestUrlLabel": "Дестинация URL",
    "httpDestUrlErrorHttpRequired": "URL адресът трябва да използва http или https",
-    "httpDestUrlErrorHttpsRequired": "HTTPS е необходимо за облачни инсталации",
+    "httpDestUrlErrorHttpsRequired": "SSL е необходимо за облачни инсталации",
    "httpDestUrlErrorInvalid": "Въведете валиден URL (напр. https://example.com/webhook)",
    "httpDestAuthTitle": "Удостоверяване",
    "httpDestAuthDescription": "Изберете как заявленията ви се удостоверяват.",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Ресурсът е деактивиран",
    "memberPortalShowingResources": "Показва {start}-{end} от {total} ресурси",
    "memberPortalPrevious": "Предишен",
-    "memberPortalNext": "Следващ"
+    "memberPortalNext": "Следващ",
+    "httpSettings": "HTTP настройки",
+    "tcpSettings": "TCP настройки",
+    "udpSettings": "UDP настройки",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Установяване на защитена връзка…",
+    "sshConnecting": "Свързване…",
+    "sshInitializing": "Инициализиране…",
+    "sshSignInTitle": "Вход в SSH",
+    "sshSignInDescription": "Въведете данните за SSH",
+    "sshPasswordTab": "Парола",
+    "sshPrivateKeyTab": "Частен ключ",
+    "sshPrivateKeyField": "Частен ключ",
+    "sshPrivateKeyDisclaimer": "Частният ви ключ не се съхранява или видима за Панголиин. Като алтернатива, можете да използвате краткотрайни сертификати за безпроблемна автентикация с вашата съществуваща идентичност в Панголиин.",
+    "sshLearnMore": "Научете повече",
+    "sshPrivateKeyFile": "Файл с частен ключ",
+    "sshAuthenticate": "Идентичност",
+    "sshTerminate": "Прекратяване",
+    "sshPoweredBy": "Подпомогнато от",
+    "sshErrorNoTarget": "Няма посочена цел",
+    "sshErrorWebSocket": "Неуспешно създаване на WebSocket връзка",
+    "sshErrorAuthFailed": "Неуспешна идентификация",
+    "sshErrorConnectionClosed": "Връзката е затворена преди завършване на идентификацията"
 }
--- a/messages/cs-CZ.json
+++ b/messages/cs-CZ.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Při vytváření odkazu došlo k chybě",
    "shareCreateDescription": "Kdokoliv s tímto odkazem může přistupovat ke zdroji",
    "shareTitleOptional": "Název (volitelné)",
+    "sharePathOptional": "Cesta (volitelně)",
    "expireIn": "Platnost vyprší za",
    "neverExpire": "Nikdy nevyprší",
    "shareExpireDescription": "Doba platnosti určuje, jak dlouho bude odkaz použitelný a bude poskytovat přístup ke zdroji. Po této době odkaz již nebude fungovat a uživatelé kteří tento odkaz používali ztratí přístup ke zdroji.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Prohledat zdroje...",
    "resourceAdd": "Přidat zdroj",
    "resourceErrorDelte": "Chyba při odstraňování zdroje",
+    "resourcePoliciesTitle": "Spravovat zásady zdrojů",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Připojené zdroje",
+    "resourcePoliciesAttachedResources": "{count} zdroj(e/ů)",
+    "resourcePoliciesAttachedResourcesEmpty": "žádné zdroje",
+    "resourcePoliciesDescription": "Vytvářejte a spravujte zásady ověřování k řízení přístupu ke svým zdrojům",
+    "resourcePoliciesSearch": "Hledat zásady...",
+    "resourcePoliciesAdd": "Přidat zásadu",
+    "resourcePoliciesDefaultBadgeText": "Výchozí zásada",
+    "resourcePoliciesCreate": "Vytvořit zásadu zdroje",
+    "resourcePoliciesCreateDescription": "Postupujte podle následujících kroků k vytvoření nové zásady",
+    "resourcePolicyName": "Název zásady",
+    "resourcePolicyNameDescription": "Pojmenujte tuto zásadu, aby byla rozpoznatelná napříč vašimi zdroji",
+    "resourcePolicyNamePlaceholder": "např. Zásada interního přístupu",
+    "resourcePoliciesSeeAll": "Zobrazit všechny zásady",
+    "resourcePolicyAuthMethodAdd": "Přidat metodu ověřování",
+    "resourcePolicyOtpEmailAdd": "Přidat OTP emaily",
+    "resourcePolicyRulesAdd": "Přidat pravidla",
+    "resourcePolicyAuthMethodsDescription": "Povolit přístup ke zdrojům prostřednictvím dodatečných metod ověřování",
+    "resourcePolicyUsersRolesDescription": "Nakonfigurujte, kteří uživatelé a role mohou navštívit připojené zdroje",
+    "rulesResourcePolicyDescription": "Nakonfigurujte pravidla k řízení přístupu ke zdrojům spojeným s touto zásadou",
    "authentication": "Autentifikace",
    "protected": "Chráněno",
    "notProtected": "Nechráněno",
    "resourceMessageRemove": "Jakmile zdroj odstraníte, nebude dostupný. Všechny související služby a cíle budou také odstraněny.",
    "resourceQuestionRemove": "Jste si jisti, že chcete odstranit zdroj z organizace?",
+    "resourcePolicyMessageRemove": "Jakmile je zásada odstraněna, ke zdroji již nebude možný přístup. Všechny související zdroje budou odpojeny a zůstanou bez ověření.",
+    "resourcePolicyQuestionRemove": "Jste si jisti, že chcete odstranit zásadu zdroje z organizace?",
    "resourceHTTP": "Zdroj HTTPS",
    "resourceHTTPDescription": "Proxy požadavky přes HTTPS pomocí plně kvalifikovaného názvu domény.",
    "resourceRaw": "Surový TCP/UDP zdroj",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Proxy požadavky na syrové TCP/UDP pomocí čísla portu. Vyžaduje připojení stránek ke vzdálenému uzlu.",
    "resourceCreate": "Vytvořit zdroj",
    "resourceCreateDescription": "Postupujte podle níže uvedených kroků, abyste vytvořili a připojili nový zdroj",
+    "resourceCreateGeneralDescription": "Konfigurace základních nastavení zdroje včetně názvu a typu",
    "resourceSeeAll": "Zobrazit všechny zdroje",
-    "resourceInfo": "Informace o zdroji",
+    "resourceCreateGeneral": "Obecné",
    "resourceNameDescription": "Toto je zobrazovaný název zdroje.",
    "siteSelect": "Vybrat lokalitu",
    "siteSearch": "Hledat lokalitu",
@@ -231,12 +255,15 @@
    "noCountryFound": "Nebyla nalezena žádná země.",
    "siteSelectionDescription": "Tato lokalita poskytne připojení k cíli.",
    "resourceType": "Typ zdroje",
-    "resourceTypeDescription": "Určete, jak přistupovat ke zdroji",
+    "resourceTypeDescription": "Toto určuje protokol zdroje a jak bude zobrazen v prohlížeči. Později to nelze změnit.",
+    "resourceDomainDescription": "Zdroji bude obsluhován tento plně kvalifikovaný doménový název.",
    "resourceHTTPSSettings": "Nastavení HTTPS",
    "resourceHTTPSSettingsDescription": "Nakonfigurujte, jak bude dokument přístupný přes HTTPS",
+    "resourcePortDescription": "Externí port na instanci nebo uzlu Pangolin, kde bude zdroj dostupný.",
    "domainType": "Typ domény",
    "subdomain": "Subdoména",
    "baseDomain": "Základní doména",
+    "configure": "Konfigurovat",
    "subdomnainDescription": "Subdoména, kde bude zdroj přístupný.",
    "resourceRawSettings": "Nastavení TCP/UDP",
    "resourceRawSettingsDescription": "Nakonfigurujte, jak bude dokument přístupný přes TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Naučte se konfigurovat zdroje TCP/UDP",
    "resourceBack": "Zpět na zdroje",
    "resourceGoTo": "Přejít na dokument",
+    "resourcePolicyDelete": "Smazat zásadu zdroje",
+    "resourcePolicyDeleteConfirm": "Potvrdit smazání zásady zdroje",
    "resourceDelete": "Odstranit dokument",
    "resourceDeleteConfirm": "Potvrdit odstranění dokumentu",
+    "labelDelete": "Smazat štítek",
+    "labelAdd": "Přidat štítek",
+    "labelCreateSuccessMessage": "Štítek byl úspěšně vytvořen",
+    "labelEditSuccessMessage": "Štítek byl úspěšně změněn",
+    "labelNameField": "Název štítku",
+    "labelColorField": "Barva štítku",
+    "labelPlaceholder": "Př. domací laboratoř",
+    "labelCreate": "Vytvořit štítek",
+    "createLabelDialogTitle": "Vytvořit štítek",
+    "createLabelDialogDescription": "Vytvořte nový štítek, který může být přiřazen této organizaci",
+    "labelEdit": "Upravit štítek",
+    "editLabelDialogTitle": "Aktualizovat štítek",
+    "editLabelDialogDescription": "Upravte nový štítek, který může být přiřazen této organizaci",
+    "labelDeleteConfirm": "Potvrdit smazání štítku",
+    "labelErrorDelete": "Nepodařilo se smazat štítek",
+    "labelMessageRemove": "Tato akce je trvalá. Všechny weby, zdroje a klienti označeni tímto štítkem budou neoznačeni.",
+    "labelQuestionRemove": "Jste si jisti, že chcete odebrat štítek z organizace?",
    "visibility": "Viditelnost",
    "enabled": "Povoleno",
    "disabled": "Zakázáno",
@@ -265,6 +311,8 @@
    "rules": "Pravidla",
    "resourceSettingDescription": "Konfigurace nastavení na zdroji",
    "resourceSetting": "Nastavení {resourceName}",
+    "resourcePolicySettingDescription": "Nakonfigurujte nastavení na zásadě zdroje",
+    "resourcePolicySetting": "Nastavení {policyName}",
    "alwaysAllow": "Obejít Auth",
    "alwaysDeny": "Blokovat přístup",
    "passToAuth": "Předat k ověření",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Žádná pravidla. Přidejte pravidlo pomocí formuláře.",
    "rulesOrder": "Pravidla jsou hodnocena podle priority vzestupně.",
    "rulesSubmit": "Uložit pravidla",
+    "policyErrorCreate": "Chyba při vytváření zásady",
+    "policyErrorCreateDescription": "Při vytváření zásady došlo k chybě",
+    "policyErrorCreateMessageDescription": "Došlo k neočekávané chybě",
+    "policyErrorUpdate": "Chyba při aktualizaci zásady",
+    "policyErrorUpdateDescription": "Při aktualizaci zásady došlo k chybě",
+    "policyErrorUpdateMessageDescription": "Došlo k neočekávané chybě",
+    "policyCreatedSuccess": "Zásada zdroje byla úspěšně vytvořena",
+    "policyUpdatedSuccess": "Zásada zdroje byla úspěšně aktualizována",
+    "authMethodsSave": "Uložit metody ověřování",
+    "rulesSave": "Uložit pravidla",
    "resourceErrorCreate": "Chyba při vytváření zdroje",
    "resourceErrorCreateDescription": "Při vytváření zdroje došlo k chybě",
    "resourceErrorCreateMessage": "Chyba při vytváření zdroje:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Přidat PIN kód",
    "pincodeRemove": "Odstranit PIN kód",
    "resourceAuthMethods": "Metody ověřování",
+    "resourcePolicyAuthMethodsEmpty": "Žádná metoda ověřování",
+    "resourcePolicyOtpEmpty": "Žádné jednorázové hesla",
+    "resourcePolicyReadOnly": "Tato zásada je pouze ke čtení",
+    "resourcePolicyReadOnlyDescription": "Tato zásada zdroje je sdílena mezi více zdroji, nelze ji upravovat na této stránce.",
+    "editSharedPolicy": "Upravit sdílenou zásadu",
+    "resourcePolicyTypeSave": "Uložit typ zdroje",
+    "resourcePolicySelect": "Vybrat zásadu zdroje",
+    "resourcePolicySelectError": "Vyberte zásadu zdroje",
+    "resourcePolicyNotFound": "Zásada nenalezena",
+    "resourcePolicySearch": "Hledat zásady",
+    "resourcePolicyRulesEmpty": "Žádná pravidla ověřování",
    "resourceAuthMethodsDescriptions": "Povolit přístup ke zdroji pomocí dodatečných metod autorizace",
    "resourceAuthSettingsSave": "Úspěšně uloženo",
    "resourceAuthSettingsSaveDescription": "Nastavení ověřování bylo uloženo",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Nastavit anonymní kód",
    "resourcePincodeSetupTitleDescription": "Nastavit pincode pro ochranu tohoto zdroje",
    "resourceRoleDescription": "Administrátoři mají vždy přístup k tomuto zdroji.",
+    "resourcePolicySelectTitle": "Zásada přístupu ke zdrojům",
+    "resourcePolicySelectDescription": "Vyberte typ zásady zdroje ověřování",
+    "resourcePolicyInline": "Inline Zásada Zdroje",
+    "resourcePolicyInlineDescription": "Zásada přístupu se zaměřením pouze na tento zdroj",
+    "resourcePolicyShared": "Sdílená Zásada Zdroje",
+    "resourcePolicySharedDescription": "Tento zdroj používá sdílenou zásadu. Nastavení na úrovni zásady (metody ověřování, seznam povolených emailů) jsou uzamčena. Níže můžete přidat pravidla, role a uživatele specifické pro zdroj.",
    "resourceUsersRoles": "Kontrola přístupu",
    "resourceUsersRolesDescription": "Nastavení, kteří uživatelé a role mohou navštívit tento zdroj",
    "resourceUsersRolesSubmit": "Uložit přístupové řízení",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Při připojování k {name}došlo k chybě. Obraťte se na správce.",
    "idpErrorNotFound": "IdP nenalezen",
    "inviteInvalid": "Neplatná pozvánka",
+    "labels": "Štítky",
+    "orgLabelsDescription": "Spravujte štítky v této organizaci.",
+    "addLabels": "Přidat štítky",
+    "siteLabelsTab": "Štítky",
+    "siteLabelsDescription": "Spravujte štítky přiřazené k této lokalitě.",
+    "labelsNotFound": "Štítky nenalezeny",
+    "labelSearch": "Hledat štítky",
+    "accessLabelFilterCount": "{count, plural, one {# štítek} few {# štítky} other {# štítků}}",
+    "labelOverflowCount": "+{count, plural, one {# štítek} few {# štítky} other {# štítků}}",
+    "accessLabelFilterClear": "Vymazat filtry štítků",
+    "selectColor": "Vybrat barvu",
+    "createNewLabel": "Vytvořit nový štítek organizace \"{label}\"",
    "inviteInvalidDescription": "Odkaz pro pozvání je neplatný.",
    "inviteErrorWrongUser": "Pozvat není pro tohoto uživatele",
    "inviteErrorUserNotExists": "Uživatel neexistuje. Nejprve si vytvořte účet.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Zdroje",
    "sidebarProxyResources": "Veřejnost",
    "sidebarClientResources": "Soukromé",
+    "sidebarPolicies": "Zásady",
+    "sidebarResourcePolicies": "Zdroje",
    "sidebarAccessControl": "Kontrola přístupu",
    "sidebarLogsAndAnalytics": "Logy & Analytika",
    "sidebarTeam": "Tým",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Stránka {id}",
    "standaloneHcFilterResourceIdFallback": "Zdroj {id}",
    "blueprints": "Plány",
-    "blueprintsDescription": "Použít deklarativní konfigurace a zobrazit předchozí běhy",
+    "blueprintsLog": "Protokol plánů",
+    "blueprintsDescription": "Prohlédněte si aplikace předchozích plánů a jejich výsledky",
    "blueprintAdd": "Přidat plán",
    "blueprintGoBack": "Zobrazit všechny plány",
    "blueprintCreate": "Vytvořit plán",
@@ -1575,7 +1665,17 @@
    "contents": "Obsah",
    "parsedContents": "Parsed content (Pouze pro čtení)",
    "enableDockerSocket": "Povolit Docker plán",
-    "enableDockerSocketDescription": "Povolte seškrábání štítků na Docker Socket pro popisky plánů. Nová cesta musí být k dispozici.",
+    "enableDockerSocketDescription": "Povolte seškrábání štítků pro Docker Socket pro štítky plánů. Před připojením na lokalitní konektor musí být uvedena cesta k soketu. Přečtěte si, jak to funguje <docsLink>v dokumentaci</docsLink>.",
+    "newtAutoUpdate": "Povolit automatickou aktualizaci stránek",
+    "newtAutoUpdateDescription": "Když je zapnuto, konektory lokality se automaticky aktualizují na nejnovější verzi, když je k dispozici nové vydání.",
+    "siteAutoUpdate": "Automatická aktualizace stránek",
+    "siteAutoUpdateLabel": "Povolte automatickou aktualizaci",
+    "siteAutoUpdateDescription": "Ovládněte, zda bude konektor tohoto webu automaticky stahovat nejnovější verzi.",
+    "siteAutoUpdateOrgDefault": "Výchozí organizace: {state}",
+    "siteAutoUpdateOverriding": "Přepsání nastavení organizace",
+    "siteAutoUpdateResetToOrg": "Obnovit na výchozí organizaci",
+    "siteAutoUpdateEnabled": "povoleno",
+    "siteAutoUpdateDisabled": "zakázáno",
    "viewDockerContainers": "Zobrazit kontejnery Dockeru",
    "containersIn": "Kontejnery v {siteName}",
    "selectContainerDescription": "Vyberte jakýkoli kontejner pro použití jako název hostitele pro tento cíl. Klikněte na port pro použití portu.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Certifikát",
    "certificateStatusAutoRefreshHint": "Stav se automaticky obnovuje.",
    "loading": "Načítání",
+    "loadingEllipsis": "Načítání...",
    "loadingAnalytics": "Načítání analytiky",
    "restart": "Restartovat",
    "domains": "Domény",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Spravujte své předplatné za placené samohostované licenční klíče",
    "billingCurrentKeys": "Aktuální klíče",
    "billingModifyCurrentPlan": "Upravit aktuální tarif",
+    "billingManageLicenseSubscriptionDescription": "Spravujte své předplatné pro placené licence k samoobslužnému hostingu a stahujte faktury.",
    "billingConfirmUpgrade": "Potvrdit aktualizaci",
    "billingConfirmDowngrade": "Potvrdit downgrade",
    "billingConfirmUpgradeDescription": "Chystáte se povýšit svůj tarif. Přečtěte si nové limity a ceny.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Čas je v sekundách",
    "requireDeviceApproval": "Vyžadovat schválení zařízení",
    "requireDeviceApprovalDescription": "Uživatelé s touto rolí potřebují nová zařízení schválená správcem, než se mohou připojit a přistupovat ke zdrojům.",
-    "sshAccess": "SSH přístup",
+    "sshSettings": "Nastavení SSH",
+    "rdpSettings": "Nastavení RDP",
+    "vncSettings": "Nastavení VNC",
+    "sshServer": "SSH server",
+    "rdpServer": "RDP server",
+    "vncServer": "VNC server",
+    "sshServerDescription": "Nastavit metodu ověřování, umístění démona a cíl serveru",
+    "rdpServerDescription": "Nakonfigurujte cíl a port serveru RDP",
+    "vncServerDescription": "Nakonfigurujte cíl a port serveru VNC",
+    "sshServerMode": "Režim",
+    "sshServerModeStandard": "Standardní SSH server",
+    "sshServerModePangolin": "SSH Pangolin",
+    "sshServerModeStandardDescription": "Příkazy zpracovávané po síti na SSH server jako např. OpenSSH.",
+    "sshServerModeNative": "Nativní SSH server",
+    "sshServerModeNativeDescription": "Příkazy se provádí přímo na hostiteli přes Konektor lokality. Nastavení sítě není vyžadováno.",
+    "sshAuthenticationMethod": "Metoda ověřování",
+    "sshAuthMethodManual": "Ruční ověřování",
+    "sshAuthMethodManualDescription": "Vyžaduje existující přihlašovací údaje hostitele. Obchází automatické zřizování.",
+    "sshAuthMethodAutomated": "Automatické zřizování",
+    "sshAuthMethodAutomatedDescription": "Automaticky vytváří uživatele, skupiny a oprávnění sudo na hostiteli.",
+    "sshAuthDaemonLocation": "Umístění ověřovacího démona",
+    "sshDaemonLocationSiteDescription": "Spouští se lokálně na počítači s konektorem stránky.",
+    "sshDaemonLocationRemote": "Na vzdáleném hostiteli",
+    "sshDaemonLocationRemoteDescription": "Spouští se na jiném cílovém počítači v téže síti.",
+    "sshDaemonDisclaimer": "Ujistěte se, že váš cílový hostitel je správně nakonfigurován k přímu spuštění ověřovacího démona, jinak zřizování selže.",
+    "sshDaemonPort": "Port démona",
+    "sshServerDestination": "Cíl serveru",
+    "sshServerDestinationDescription": "Nakonfigurujte cíl a port SSH serveru",
+    "destination": "Cíl",
+    "bgTargetMultiSiteDisclaimer": "Výběr více lokalit umožňuje odolné směrování a převzetí služeb při selhání pro vysokou dostupnost.",
    "roleAllowSsh": "Povolit SSH",
    "roleAllowSshAllow": "Povolit",
    "roleAllowSshDisallow": "Zakázat",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Uživatel může spustit pouze zadané příkazy s sudo.",
    "sshSudo": "Povolit sudo",
    "sshSudoCommands": "Sudo příkazy",
-    "sshSudoCommandsDescription": "Čárkami oddělený seznam příkazů, které může uživatel spouštět s sudo.",
+    "sshSudoCommandsDescription": "Čárkami oddělený seznam příkazů, které je uživatel povolen spustit s sudo. Musí být použity absolutní cesty.",
    "sshCreateHomeDir": "Vytvořit domovský adresář",
    "sshUnixGroups": "Unixové skupiny",
    "sshUnixGroupsDescription": "Čárkou oddělené skupiny Unix přidají uživatele do cílového hostitele.",
@@ -2051,7 +2182,7 @@
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schéma",
-    "editInternalResourceDialogEnableSsl": "Povolit SSL",
+    "editInternalResourceDialogEnableSsl": "Povolit TLS",
    "editInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
    "editInternalResourceDialogDestination": "Místo určení",
    "editInternalResourceDialogDestinationHostDescription": "IP adresa nebo název hostitele zdroje v síti webu.",
@@ -2102,7 +2233,7 @@
    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schéma",
    "createInternalResourceDialogScheme": "Schéma",
-    "createInternalResourceDialogEnableSsl": "Povolit SSL",
+    "createInternalResourceDialogEnableSsl": "Povolit TLS",
    "createInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
    "createInternalResourceDialogDestination": "Místo určení",
    "createInternalResourceDialogDestinationHostDescription": "IP adresa nebo název hostitele zdroje v síti webu.",
@@ -2235,7 +2366,7 @@
        "description": "Spolehlivější a nízko udržovaný Pangolinův server s dalšími zvony a bičkami",
        "introTitle": "Spravovaný Pangolin",
        "introDescription": "je možnost nasazení určená pro lidi, kteří chtějí jednoduchost a spolehlivost při zachování soukromých a samoobslužných dat.",
-        "introDetail": "Pomocí této volby stále provozujete vlastní uzel Pangolin - tunely, SSL terminály a provoz všech pobytů na vašem serveru. Rozdíl spočívá v tom, že řízení a monitorování se řeší prostřednictvím našeho cloudového panelu, který odemkne řadu výhod:",
+        "introDetail": "Pomocí této volby stále provozujete vlastní uzel Pangolin - vaše tunely, ukončení TLS a provoz zůstávají na vašem serveru. Rozdíl spočívá v tom, že správa a monitoring jsou řešeny prostřednictvím naší cloudové řídící desky, což odemyká řadu výhod:",
        "benefitSimplerOperations": {
            "title": "Jednoduchý provoz",
            "description": "Není třeba spouštět svůj vlastní poštovní server nebo nastavit komplexní upozornění. Ze schránky dostanete upozornění na zdravotní kontrolu a výpadek."
@@ -2939,7 +3070,7 @@
    "learnMore": "Zjistit více",
    "backToHome": "Zpět na domovskou stránku",
    "needToSignInToOrg": "Potřebujete použít identitního poskytovatele vaší organizace?",
-    "maintenanceMode": "Režim údržby",
+    "maintenanceMode": "Údržbová stránka",
    "maintenanceModeDescription": "Zobrazit stránku údržby návštěvníkům",
    "maintenanceModeType": "Typ režimu údržby",
    "showMaintenancePage": "Zobrazit stránku údržby návštěvníkům",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Odhadované dokončení:",
    "createInternalResourceDialogDestinationRequired": "Cíl je povinný",
    "available": "Dostupné",
+    "disabledResourceDescription": "Když je deaktivován, zdroj bude nedostupný pro každého.",
    "archived": "Archivováno",
    "noArchivedDevices": "Nebyla nalezena žádná archivovaná zařízení",
    "deviceArchived": "Zařízení archivováno",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Zdroj je zakázán",
    "memberPortalShowingResources": "Zobrazeny {start}-{end} z {total} zdrojů",
    "memberPortalPrevious": "Předchozí",
-    "memberPortalNext": "Následující"
+    "memberPortalNext": "Následující",
+    "httpSettings": "Nastavení HTTP",
+    "tcpSettings": "Nastavení TCP",
+    "udpSettings": "Nastavení UDP",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Zřizování bezpečného připojení…",
+    "sshConnecting": "Připojení…",
+    "sshInitializing": "Inicializace…",
+    "sshSignInTitle": "Přihlášení do SSH",
+    "sshSignInDescription": "Zadejte své SSH přihlašovací údaje",
+    "sshPasswordTab": "Heslo",
+    "sshPrivateKeyTab": "Soukromý klíč",
+    "sshPrivateKeyField": "Soukromý klíč",
+    "sshPrivateKeyDisclaimer": "Váš soukromý klíč není ukládán ani viditelný pro Pangolin. Alternativně můžete použít krátkodobé certifikáty pro bezproblémové ověřování pomocí vaší stávající identity Pangolin.",
+    "sshLearnMore": "Přečtěte si více",
+    "sshPrivateKeyFile": "Soubor soukromého klíče",
+    "sshAuthenticate": "Ověřit",
+    "sshTerminate": "Ukončit",
+    "sshPoweredBy": "Vytváří",
+    "sshErrorNoTarget": "Cíl nebyl určen",
+    "sshErrorWebSocket": "Chyba připojení WebSocketu",
+    "sshErrorAuthFailed": "Ověření selhalo",
+    "sshErrorConnectionClosed": "Připojení bylo uzavřeno před dokončením ověřování"
 }
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Beim Erstellen des Freigabelinks ist ein Fehler aufgetreten",
    "shareCreateDescription": "Jeder mit diesem Link kann auf die Ressource zugreifen",
    "shareTitleOptional": "Titel (optional)",
+    "sharePathOptional": "Pfad (optional)",
    "expireIn": "Läuft ab in",
    "neverExpire": "Läuft nie ab",
    "shareExpireDescription": "Ablaufzeit ist, wie lange der Link verwendet werden kann und bietet Zugriff auf die Ressource. Nach dieser Zeit wird der Link nicht mehr funktionieren und Benutzer, die diesen Link benutzt haben, verlieren den Zugriff auf die Ressource.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Suche Ressourcen...",
    "resourceAdd": "Ressource hinzufügen",
    "resourceErrorDelte": "Fehler beim Löschen der Ressource",
+    "resourcePoliciesTitle": "Ressourcenrichtlinien verwalten",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Angehängte Ressourcen",
+    "resourcePoliciesAttachedResources": "{count} Ressource(n)",
+    "resourcePoliciesAttachedResourcesEmpty": "keine Ressourcen",
+    "resourcePoliciesDescription": "Erstellen und verwalten Sie Authentifizierungsrichtlinien, um den Zugang zu Ihren Ressourcen zu steuern",
+    "resourcePoliciesSearch": "Richtlinien suchen...",
+    "resourcePoliciesAdd": "Richtlinie hinzufügen",
+    "resourcePoliciesDefaultBadgeText": "Standardrichtlinie",
+    "resourcePoliciesCreate": "Ressourcenrichtlinie erstellen",
+    "resourcePoliciesCreateDescription": "Befolgen Sie die unten stehenden Schritte, um eine neue Richtlinie zu erstellen",
+    "resourcePolicyName": "Richtlinienname",
+    "resourcePolicyNameDescription": "Geben Sie dieser Richtlinie einen Namen, um sie für Ihre Ressourcen zu identifizieren",
+    "resourcePolicyNamePlaceholder": "z. B. Richtlinie für internen Zugriff",
+    "resourcePoliciesSeeAll": "Alle Richtlinien anzeigen",
+    "resourcePolicyAuthMethodAdd": "Authentifizierungsmethode hinzufügen",
+    "resourcePolicyOtpEmailAdd": "OTP-E-Mails hinzufügen",
+    "resourcePolicyRulesAdd": "Regeln hinzufügen",
+    "resourcePolicyAuthMethodsDescription": "Ermöglichen Sie den Zugriff auf Ressourcen über zusätzliche Authentifizierungsmethoden",
+    "resourcePolicyUsersRolesDescription": "Konfigurieren Sie, welche Benutzer und Rollen diese Ressource besuchen können",
+    "rulesResourcePolicyDescription": "Konfigurieren Sie Regeln, um den Zugang zu den mit dieser Richtlinie verbundenen Ressourcen zu kontrollieren",
    "authentication": "Authentifizierung",
    "protected": "Geschützt",
    "notProtected": "Nicht geschützt",
    "resourceMessageRemove": "Einmal entfernt, wird die Ressource nicht mehr zugänglich sein. Alle mit der Ressource verbundenen Ziele werden ebenfalls entfernt.",
    "resourceQuestionRemove": "Sind Sie sicher, dass Sie die Ressource aus der Organisation entfernen möchten?",
+    "resourcePolicyMessageRemove": "Einmal entfernt, wird die Ressourcenrichtlinie nicht mehr zugänglich sein. Alle mit der Ressource verbundenen Ressourcen werden nicht mehr zugeordnet und bleiben ohne Authentifizierung.",
+    "resourcePolicyQuestionRemove": "Sind Sie sicher, dass Sie die Ressourcenrichtlinie aus der Organisation entfernen möchten?",
    "resourceHTTP": "HTTPS-Ressource",
    "resourceHTTPDescription": "Proxy-Anfragen über HTTPS mit einem voll qualifizierten Domain-Namen.",
    "resourceRaw": "Direkte TCP/UDP Ressource (raw)",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Proxy-Anfragen über rohe TCP/UDP mit Portnummer. Benötigt Sites, um sich mit einem entfernten Knoten zu verbinden.",
    "resourceCreate": "Ressource erstellen",
    "resourceCreateDescription": "Folgen Sie den Schritten unten, um eine neue Ressource zu erstellen",
+    "resourceCreateGeneralDescription": "Konfigurieren Sie die Grundeinstellungen der Ressource, einschließlich Name und Typ",
    "resourceSeeAll": "Alle Ressourcen anzeigen",
-    "resourceInfo": "Ressourcen-Informationen",
+    "resourceCreateGeneral": "Allgemein",
    "resourceNameDescription": "Dies ist der Anzeigename für die Ressource.",
    "siteSelect": "Standort auswählen",
    "siteSearch": "Standorte durchsuchen",
@@ -231,12 +255,15 @@
    "noCountryFound": "Kein Land gefunden.",
    "siteSelectionDescription": "Dieser Standort wird die Verbindung zum Ziel herstellen.",
    "resourceType": "Ressourcentyp",
-    "resourceTypeDescription": "Legen Sie fest, wie Sie auf die Ressource zugreifen",
+    "resourceTypeDescription": "Dies steuert das Ressourcenprotokoll und wie es im Browser gerendert wird. Dies kann später nicht geändert werden.",
+    "resourceDomainDescription": "Die Ressource wird unter diesem vollständig qualifizierten Domainnamen bereitgestellt.",
    "resourceHTTPSSettings": "HTTPS-Einstellungen",
    "resourceHTTPSSettingsDescription": "Konfigurieren Sie den Zugriff auf die Ressource über HTTPS",
+    "resourcePortDescription": "Der externe Port auf der Pangolin-Instanz oder dem Knoten, an dem die Ressource zugänglich ist.",
    "domainType": "Domain-Typ",
    "subdomain": "Subdomain",
    "baseDomain": "Basis-Domain",
+    "configure": "Konfiguration",
    "subdomnainDescription": "Die Subdomäne, auf die die Ressource zugegriffen werden soll.",
    "resourceRawSettings": "TCP/UDP Einstellungen",
    "resourceRawSettingsDescription": "Konfigurieren, wie auf die Ressource über TCP/UDP zugegriffen wird",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Lernen Sie, wie Sie TCP/UDP Ressourcen konfigurieren",
    "resourceBack": "Zurück zu den Ressourcen",
    "resourceGoTo": "Zu Ressource gehen",
+    "resourcePolicyDelete": "Ressourcenrichtlinie löschen",
+    "resourcePolicyDeleteConfirm": "Löschen der Ressourcenrichtlinie bestätigen",
    "resourceDelete": "Ressource löschen",
    "resourceDeleteConfirm": "Ressource löschen bestätigen",
+    "labelDelete": "Etikett löschen",
+    "labelAdd": "Etikett hinzufügen",
+    "labelCreateSuccessMessage": "Etikett erfolgreich erstellt",
+    "labelEditSuccessMessage": "Etikett erfolgreich bearbeitet",
+    "labelNameField": "Etikettenname",
+    "labelColorField": "Etikettenfarbe",
+    "labelPlaceholder": "Beispiel: Heimlabor",
+    "labelCreate": "Etikett erstellen",
+    "createLabelDialogTitle": "Etikett erstellen",
+    "createLabelDialogDescription": "Erstellen Sie ein neues Etikett, das dieser Organisation zugeordnet werden kann",
+    "labelEdit": "Etikett bearbeiten",
+    "editLabelDialogTitle": "Etikett aktualisieren",
+    "editLabelDialogDescription": "Bearbeiten Sie ein neues Etikett, das dieser Organisation zugeordnet werden kann",
+    "labelDeleteConfirm": "Löschen des Etiketts bestätigen",
+    "labelErrorDelete": "Etikett konnte nicht gelöscht werden",
+    "labelMessageRemove": "Diese Aktion ist dauerhaft. Alle Standorte, Ressourcen und Clients, die mit diesem Etikett versehen sind, werden nicht mehr zugeordnet.",
+    "labelQuestionRemove": "Sind Sie sicher, dass Sie das Etikett aus der Organisation entfernen möchten?",
    "visibility": "Sichtbarkeit",
    "enabled": "Aktiviert",
    "disabled": "Deaktiviert",
@@ -265,6 +311,8 @@
    "rules": "Regeln",
    "resourceSettingDescription": "Einstellungen für die Ressource konfigurieren",
    "resourceSetting": "{resourceName} Einstellungen",
+    "resourcePolicySettingDescription": "Konfigurieren Sie die Einstellungen der Ressourcenrichtlinie",
+    "resourcePolicySetting": "{policyName} Einstellungen",
    "alwaysAllow": "Authentifizierung umgehen",
    "alwaysDeny": "Zugriff blockieren",
    "passToAuth": "Weiterleiten zur Authentifizierung",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Keine Regeln. Fügen Sie eine Regel über das Formular hinzu.",
    "rulesOrder": "Regeln werden nach aufsteigender Priorität ausgewertet.",
    "rulesSubmit": "Regeln speichern",
+    "policyErrorCreate": "Fehler beim Erstellen der Richtlinie",
+    "policyErrorCreateDescription": "Beim Erstellen der Richtlinie ist ein Fehler aufgetreten",
+    "policyErrorCreateMessageDescription": "Ein unerwarteter Fehler ist aufgetreten",
+    "policyErrorUpdate": "Fehler beim Aktualisieren der Richtlinie",
+    "policyErrorUpdateDescription": "Beim Aktualisieren der Richtlinie ist ein Fehler aufgetreten",
+    "policyErrorUpdateMessageDescription": "Ein unerwarteter Fehler ist aufgetreten",
+    "policyCreatedSuccess": "Ressourcenrichtlinie erfolgreich erstellt",
+    "policyUpdatedSuccess": "Ressourcenrichtlinie erfolgreich aktualisiert",
+    "authMethodsSave": "Authentifizierungsmethoden speichern",
+    "rulesSave": "Regeln speichern",
    "resourceErrorCreate": "Fehler beim Erstellen der Ressource",
    "resourceErrorCreateDescription": "Beim Erstellen der Ressource ist ein Fehler aufgetreten",
    "resourceErrorCreateMessage": "Fehler beim Erstellen der Ressource:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "PIN-Code hinzufügen",
    "pincodeRemove": "PIN-Code entfernen",
    "resourceAuthMethods": "Authentifizierungsmethoden",
+    "resourcePolicyAuthMethodsEmpty": "Keine Authentifizierungsmethode",
+    "resourcePolicyOtpEmpty": "Kein Einmal-Passwort",
+    "resourcePolicyReadOnly": "Diese Richtlinie ist nur lesbar",
+    "resourcePolicyReadOnlyDescription": "Diese Ressourcenrichtlinie wird über mehrere Ressourcen geteilt, Sie können sie auf dieser Seite nicht bearbeiten.",
+    "editSharedPolicy": "Geteilte Richtlinie bearbeiten",
+    "resourcePolicyTypeSave": "Ressourcentyp speichern",
+    "resourcePolicySelect": "Ressourcenrichtlinie auswählen",
+    "resourcePolicySelectError": "Wählen Sie eine Ressourcenrichtlinie aus",
+    "resourcePolicyNotFound": "Richtlinie nicht gefunden",
+    "resourcePolicySearch": "Richtlinien suchen",
+    "resourcePolicyRulesEmpty": "Keine Authentifizierungsregeln",
    "resourceAuthMethodsDescriptions": "Ermöglichen Sie den Zugriff auf die Ressource über zusätzliche Authentifizierungsmethoden",
    "resourceAuthSettingsSave": "Erfolgreich gespeichert",
    "resourceAuthSettingsSaveDescription": "Authentifizierungseinstellungen wurden gespeichert",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "PIN-Code festlegen",
    "resourcePincodeSetupTitleDescription": "Legen Sie einen PIN-Code fest, um diese Ressource zu schützen",
    "resourceRoleDescription": "Administratoren haben immer Zugriff auf diese Ressource.",
+    "resourcePolicySelectTitle": "Zugriffsrichtlinie für Ressourcen",
+    "resourcePolicySelectDescription": "Wählen Sie den Ressourcentransfertyp für die Authentifizierung",
+    "resourcePolicyInline": "Inline-Ressourcenrichtlinie",
+    "resourcePolicyInlineDescription": "Zugriffsrichtlinie nur für diese Ressource",
+    "resourcePolicyShared": "Geteilte Ressourcenrichtlinie",
+    "resourcePolicySharedDescription": "Diese Ressource verwendet eine geteilte Richtlinie. Richtlinienebene Einstellungen (Authentifizierungsmethoden, E-Mail-Whitelist) sind gesperrt. Sie können ressourcenspezifische Regeln, Rollen und Benutzer hinzufügen.",
    "resourceUsersRoles": "Zugriffskontrolle",
    "resourceUsersRolesDescription": "Konfigurieren Sie, welche Benutzer und Rollen diese Ressource besuchen können",
    "resourceUsersRolesSubmit": "Zugriffskontrollen speichern",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Es gab ein Problem bei der Verbindung zu {name}. Bitte kontaktieren Sie Ihren Administrator.",
    "idpErrorNotFound": "IdP nicht gefunden",
    "inviteInvalid": "Ungültige Einladung",
+    "labels": "Etiketten",
+    "orgLabelsDescription": "Etiketten in dieser Organisation verwalten.",
+    "addLabels": "Etiketten hinzufügen",
+    "siteLabelsTab": "Etiketten",
+    "siteLabelsDescription": "Verwalten Sie die mit diesem Standort verbundenen Etiketten.",
+    "labelsNotFound": "Etiketten nicht gefunden",
+    "labelSearch": "Etiketten suchen",
+    "accessLabelFilterCount": "{count, plural, one {# Etikett} other {# Etiketten}}",
+    "labelOverflowCount": "+{count, plural, one {# Etikett} other {# Etiketten}}",
+    "accessLabelFilterClear": "Etikettenfilter löschen",
+    "selectColor": "Farbe auswählen",
+    "createNewLabel": "Neues Org-Etikett \"{label}\" erstellen",
    "inviteInvalidDescription": "Der Einladungslink ist ungültig.",
    "inviteErrorWrongUser": "Einladung ist nicht für diesen Benutzer",
    "inviteErrorUserNotExists": "Benutzer existiert nicht. Bitte erstelle zuerst ein Konto.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Ressourcen",
    "sidebarProxyResources": "Öffentlich",
    "sidebarClientResources": "Privat",
+    "sidebarPolicies": "Richtlinien",
+    "sidebarResourcePolicies": "Ressourcen",
    "sidebarAccessControl": "Zugriffskontrolle",
    "sidebarLogsAndAnalytics": "Protokolle & Analysen",
    "sidebarTeam": "Team",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Standort {id}",
    "standaloneHcFilterResourceIdFallback": "Ressource {id}",
    "blueprints": "Blaupausen",
-    "blueprintsDescription": "Deklarative Konfigurationen anwenden und vorherige Abläufe anzeigen",
+    "blueprintsLog": "Blaupausen-Protokoll",
+    "blueprintsDescription": "Frühere Blaupausen-Anwendungen und deren Ergebnisse ansehen",
    "blueprintAdd": "Blueprint hinzufügen",
    "blueprintGoBack": "Alle Blueprints ansehen",
    "blueprintCreate": "Blueprint erstellen",
@@ -1575,7 +1665,17 @@
    "contents": "Inhalt",
    "parsedContents": "Analysierte Inhalte (Nur lesen)",
    "enableDockerSocket": "Docker Blueprint aktivieren",
-    "enableDockerSocketDescription": "Aktiviere Docker-Socket-Label-Scraping für Blueprintbeschriftungen. Der Socket-Pfad muss neu angegeben werden.",
+    "enableDockerSocketDescription": "Aktiviere Docker-Socket-Label-Scraping für Blueprint-Etiketten. Der Socket-Pfad muss dem Site-Connector angegeben werden. Lesen Sie, wie dies in <docsLink>der Dokumentation</docsLink> funktioniert.",
+    "newtAutoUpdate": "Standort-Auto-Update aktivieren",
+    "newtAutoUpdateDescription": "Wenn aktiviert, aktualisieren sich die Standort-Connectoren automatisch auf die neueste Version, sobald eine neue Version verfügbar ist.",
+    "siteAutoUpdate": "Standort-Auto-Update",
+    "siteAutoUpdateLabel": "Autoupdate aktivieren",
+    "siteAutoUpdateDescription": "Steuern Sie, ob der Connector dieses Standorts automatisch die neueste Version herunterlädt.",
+    "siteAutoUpdateOrgDefault": "Standard der Organisation: {state}",
+    "siteAutoUpdateOverriding": "Organisations-Einstellung überschreiben",
+    "siteAutoUpdateResetToOrg": "Auf Standard der Organisation zurücksetzen",
+    "siteAutoUpdateEnabled": "aktiviert",
+    "siteAutoUpdateDisabled": "deaktiviert",
    "viewDockerContainers": "Docker Container anzeigen",
    "containersIn": "Container in {siteName}",
    "selectContainerDescription": "Wählen Sie einen Container, der als Hostname für dieses Ziel verwendet werden soll. Klicken Sie auf einen Port, um einen Port zu verwenden.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Zertifikat",
    "certificateStatusAutoRefreshHint": "Der Status wird automatisch aktualisiert.",
    "loading": "Laden",
+    "loadingEllipsis": "Laden...",
    "loadingAnalytics": "Analytik wird geladen",
    "restart": "Neustart",
    "domains": "Domänen",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Verwalten Sie Ihr Abonnement für kostenpflichtige selbstgehostete Lizenzschlüssel",
    "billingCurrentKeys": "Aktuelle Tasten",
    "billingModifyCurrentPlan": "Aktuelles Paket ändern",
+    "billingManageLicenseSubscriptionDescription": "Verwalten Sie Ihr Abonnement für bezahlte selbst gehostete Lizenzschlüssel und laden Sie Rechnungen herunter.",
    "billingConfirmUpgrade": "Upgrade bestätigen",
    "billingConfirmDowngrade": "Downgrade bestätigen",
    "billingConfirmUpgradeDescription": "Sie sind dabei, Ihr Paket zu aktualisieren. Schauen Sie sich die neuen Limits und Preise unten an.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Zeit ist in Sekunden",
    "requireDeviceApproval": "Gerätegenehmigungen erforderlich",
    "requireDeviceApprovalDescription": "Benutzer mit dieser Rolle benötigen neue Geräte, die von einem Administrator genehmigt wurden, bevor sie sich verbinden und auf Ressourcen zugreifen können.",
-    "sshAccess": "SSH-Zugriff",
+    "sshSettings": "SSH-Einstellungen",
+    "rdpSettings": "RDP-Einstellungen",
+    "vncSettings": "VNC-Einstellungen",
+    "sshServer": "SSH-Server",
+    "rdpServer": "RDP-Server",
+    "vncServer": "VNC-Server",
+    "sshServerDescription": "Richten Sie die Authentifizierungsmethode, den Daemon-Standort und das Serverziel ein",
+    "rdpServerDescription": "Konfigurieren Sie das Ziel und den Port des RDP-Servers",
+    "vncServerDescription": "Konfigurieren Sie das Ziel und den Port des VNC-Servers",
+    "sshServerMode": "Modus",
+    "sshServerModeStandard": "Standard-SSH-Server",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Routen Befehle über Netzwerk zu einem SSH-Server wie OpenSSH.",
+    "sshServerModeNative": "Nativer SSH-Server",
+    "sshServerModeNativeDescription": "Führt Befehle direkt auf dem Host über den Site Connector aus. Keine Netzwerkkonfiguration erforderlich.",
+    "sshAuthenticationMethod": "Authentifizierungsmethode",
+    "sshAuthMethodManual": "Manuelle Authentifizierung",
+    "sshAuthMethodManualDescription": "Erfordert vorhandene Host-Anmeldeinformationen. Umgeht die automatische Bereitstellung.",
+    "sshAuthMethodAutomated": "Automatisierte Bereitstellung",
+    "sshAuthMethodAutomatedDescription": "Erstellt automatisch Benutzer, Gruppen und Sudo-Berechtigungen auf dem Host.",
+    "sshAuthDaemonLocation": "Standort des Auth-Daemon",
+    "sshDaemonLocationSiteDescription": "Wird lokal auf dem Rechner ausgeführt, der den Site-Connector beherbergt.",
+    "sshDaemonLocationRemote": "Auf Remote-Host",
+    "sshDaemonLocationRemoteDescription": "Wird auf einem separaten Zielrechner im gleichen Netzwerk ausgeführt.",
+    "sshDaemonDisclaimer": "Stellen Sie sicher, dass Ihr Zielhost korrekt konfiguriert ist, um den Auth-Daemon auszuführen, bevor Sie dieses Setup abschließen, andernfalls wird die Bereitstellung fehlschlagen.",
+    "sshDaemonPort": "Daemon-Port",
+    "sshServerDestination": "Serverziel",
+    "sshServerDestinationDescription": "Konfigurieren Sie das Ziel und den Port des SSH-Servers",
+    "destination": "Ziel",
+    "bgTargetMultiSiteDisclaimer": "Die Auswahl mehrerer Standorte ermöglicht eine widerstandsfähige Weiterleitung und einen Failover für hohe Verfügbarkeit.",
    "roleAllowSsh": "SSH erlauben",
    "roleAllowSshAllow": "Erlauben",
    "roleAllowSshDisallow": "Nicht zulassen",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Benutzer kann nur die angegebenen Befehle mit sudo ausführen.",
    "sshSudo": "sudo erlauben",
    "sshSudoCommands": "Sudo-Befehle",
-    "sshSudoCommandsDescription": "Kommagetrennte Liste von Befehlen, die der Benutzer mit sudo ausführen darf.",
+    "sshSudoCommandsDescription": "Komma-getrennte Liste von Befehlen, die der Benutzer mit sudo ausführen darf. Es müssen absolute Pfade verwendet werden.",
    "sshCreateHomeDir": "Home-Verzeichnis erstellen",
    "sshUnixGroups": "Unix-Gruppen",
    "sshUnixGroupsDescription": "Durch Komma getrennte Unix-Gruppen, um den Benutzer auf dem Zielhost hinzuzufügen.",
@@ -2235,7 +2366,7 @@
        "description": "Zuverlässiger und wartungsarmer Pangolin Server mit zusätzlichen Glocken und Pfeifen",
        "introTitle": "Verwalteter selbstgehosteter Pangolin",
        "introDescription": "ist eine Deployment-Option, die für Personen konzipiert wurde, die Einfachheit und zusätzliche Zuverlässigkeit wünschen, während sie ihre Daten privat und selbstgehostet halten.",
-        "introDetail": "Mit dieser Option haben Sie immer noch Ihren eigenen Pangolin-Knoten – Ihre Tunnel, TLS-Terminierung und Traffic bleiben auf Ihrem Server. Der Unterschied besteht darin, dass Verwaltung und Überwachung über unser Cloud-Dashboard abgewickelt werden, das eine Reihe von Vorteilen freischaltet:",
+        "introDetail": "Mit dieser Option betreiben Sie weiterhin Ihren eigenen Pangolin-Knoten – Ihre Tunnel, TLS-Terminierung und der gesamte Datenverkehr bleiben auf Ihrem Server. Der Unterschied besteht darin, dass die Verwaltung und Überwachung über unser Cloud-Dashboard erfolgt, was eine Reihe von Vorteilen freischaltet:",
        "benefitSimplerOperations": {
            "title": "Einfachere Operationen",
            "description": "Sie brauchen keinen eigenen Mail-Server auszuführen oder komplexe Warnungen einzurichten. Sie erhalten Gesundheitschecks und Ausfallwarnungen aus dem Box."
@@ -2939,7 +3070,7 @@
    "learnMore": "Mehr erfahren",
    "backToHome": "Zurück zur Startseite",
    "needToSignInToOrg": "Benötigen Sie den Identitätsanbieter Ihres Unternehmens?",
-    "maintenanceMode": "Wartungsmodus",
+    "maintenanceMode": "Wartungsseite",
    "maintenanceModeDescription": "Eine Wartungsseite für Besucher anzeigen",
    "maintenanceModeType": "Art des Wartungsmodus",
    "showMaintenancePage": "Eine Wartungsseite für Besucher anzeigen",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Geschätzter Abschluss:",
    "createInternalResourceDialogDestinationRequired": "Ziel ist erforderlich",
    "available": "Verfügbar",
+    "disabledResourceDescription": "Wenn deaktiviert, ist die Ressource für alle unzugänglich.",
    "archived": "Archiviert",
    "noArchivedDevices": "Keine archivierten Geräte gefunden",
    "deviceArchived": "Gerät archiviert",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Ressource deaktiviert",
    "memberPortalShowingResources": "Zeige {start}-{end} von {total} Ressourcen",
    "memberPortalPrevious": "Vorherige",
-    "memberPortalNext": "Nächste"
+    "memberPortalNext": "Nächste",
+    "httpSettings": "HTTP-Einstellungen",
+    "tcpSettings": "TCP-Einstellungen",
+    "udpSettings": "UDP-Einstellungen",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Aufbau einer sicheren Verbindung…",
+    "sshConnecting": "Verbindung wird hergestellt…",
+    "sshInitializing": "Initialisieren…",
+    "sshSignInTitle": "Anmelden bei SSH",
+    "sshSignInDescription": "Geben Sie Ihre SSH-Anmeldedaten ein",
+    "sshPasswordTab": "Passwort",
+    "sshPrivateKeyTab": "Privater Schlüssel",
+    "sshPrivateKeyField": "Privater Schlüssel",
+    "sshPrivateKeyDisclaimer": "Ihr privater Schlüssel wird von Pangolin nicht gespeichert oder angezeigt. Alternativ können Sie kurzlebige Zertifikate für nahtlose Authentifizierung mit Ihrer bestehenden Pangolin-Identität verwenden.",
+    "sshLearnMore": "Mehr erfahren",
+    "sshPrivateKeyFile": "Private Schlüsseldatei",
+    "sshAuthenticate": "Authentifizieren",
+    "sshTerminate": "Beenden",
+    "sshPoweredBy": "Bereitgestellt von",
+    "sshErrorNoTarget": "Kein Ziel angegeben",
+    "sshErrorWebSocket": "WebSocket-Verbindung fehlgeschlagen",
+    "sshErrorAuthFailed": "Authentifizierung fehlgeschlagen",
+    "sshErrorConnectionClosed": "Verbindung geschlossen, bevor die Authentifizierung abgeschlossen wurde"
 }
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -2046,6 +2046,7 @@
    "requireDeviceApproval": "Require Device Approvals",
    "requireDeviceApprovalDescription": "Users with this role need new devices approved by an admin before they can connect and access resources.",
    "sshSettings": "SSH Settings",
+    "sshAccess": "SSH Access",
    "rdpSettings": "RDP Settings",
    "vncSettings": "VNC Settings",
    "sshServer": "SSH Server",
@@ -3346,6 +3347,8 @@
    "idpUnassociateQuestion": "Are you sure you want to unassociate this identity provider from this organization?",
    "idpUnassociateDescription": "All users associated with this identity provider will be removed from this organization, but the identity provider will still continue to exist for other associated organizations.",
    "idpUnassociateConfirm": "Confirm Unassociate Identity Provider",
+    "idpConfirmDeleteAndRemoveMeFromOrg": "DELETE AND REMOVE ME FROM ORG",
+    "idpUnassociateAndRemoveMeFromOrg": "UNASSOCIATE AND REMOVE ME FROM ORG",
    "idpUnassociateWarning": "This cannot be undone for this organization.",
    "idpUnassociatedDescription": "Identity provider unassociated from this organization successfully",
    "idpUnassociateMenu": "Unassociate",
--- a/messages/es-ES.json
+++ b/messages/es-ES.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Se ha producido un error al crear el enlace compartido",
    "shareCreateDescription": "Cualquiera con este enlace puede acceder al recurso",
    "shareTitleOptional": "Título (opcional)",
+    "sharePathOptional": "Ruta (opcional)",
    "expireIn": "Caduca en",
    "neverExpire": "Nunca expirar",
    "shareExpireDescription": "El tiempo de caducidad es cuánto tiempo el enlace será utilizable y proporcionará acceso al recurso. Después de este tiempo, el enlace ya no funcionará, y los usuarios que usaron este enlace perderán el acceso al recurso.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Buscar recursos...",
    "resourceAdd": "Añadir Recurso",
    "resourceErrorDelte": "Error al eliminar el recurso",
+    "resourcePoliciesTitle": "Administrar Políticas de Recursos",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Recursos Adjuntos",
+    "resourcePoliciesAttachedResources": "{count} recurso/s",
+    "resourcePoliciesAttachedResourcesEmpty": "sin recursos",
+    "resourcePoliciesDescription": "Cree y administre políticas de autenticación para controlar el acceso a sus recursos",
+    "resourcePoliciesSearch": "Buscar políticas...",
+    "resourcePoliciesAdd": "Agregar Política",
+    "resourcePoliciesDefaultBadgeText": "Política predeterminada",
+    "resourcePoliciesCreate": "Crear Política de Recursos",
+    "resourcePoliciesCreateDescription": "Siga los pasos a continuación para crear una nueva política",
+    "resourcePolicyName": "Nombre de la política",
+    "resourcePolicyNameDescription": "Déle a esta política un nombre para identificarla en sus recursos",
+    "resourcePolicyNamePlaceholder": "por ejemplo, Política de Acceso Interno",
+    "resourcePoliciesSeeAll": "Ver todas las políticas",
+    "resourcePolicyAuthMethodAdd": "Agregar Método de Autenticación",
+    "resourcePolicyOtpEmailAdd": "Agregar correos electrónicos OTP",
+    "resourcePolicyRulesAdd": "Añadir reglas",
+    "resourcePolicyAuthMethodsDescription": "Permitir el acceso a los recursos a través de métodos de autenticación adicionales",
+    "resourcePolicyUsersRolesDescription": "Configure qué usuarios y roles pueden visitar los recursos asociados",
+    "rulesResourcePolicyDescription": "Configure reglas para controlar el acceso a los recursos asociados a esta política",
    "authentication": "Autenticación",
    "protected": "Protegido",
    "notProtected": "No protegido",
    "resourceMessageRemove": "Una vez eliminado, el recurso ya no será accesible. Todos los objetivos asociados con el recurso también serán eliminados.",
    "resourceQuestionRemove": "¿Está seguro que desea eliminar el recurso de la organización?",
+    "resourcePolicyMessageRemove": "Una vez eliminada, la política de recursos ya no será accesible. Todos los recursos asociados al recurso serán desvinculados y quedarán sin autenticación.",
+    "resourcePolicyQuestionRemove": "¿Está seguro de que desea eliminar la política de recursos de la organización?",
    "resourceHTTP": "HTTPS Recurso",
    "resourceHTTPDescription": "Proxy proporciona solicitudes sobre HTTPS usando un nombre de dominio completamente calificado.",
    "resourceRaw": "Recurso TCP/UDP sin procesar",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Las peticiones de proxy sobre TCP/UDP crudas usando un número de puerto. Requiere que los sitios se conecten a un nodo remoto.",
    "resourceCreate": "Crear Recurso",
    "resourceCreateDescription": "Siga los siguientes pasos para crear un nuevo recurso",
+    "resourceCreateGeneralDescription": "Configurar la configuración básica del recurso, incluido el nombre y el tipo",
    "resourceSeeAll": "Ver todos los recursos",
-    "resourceInfo": "Información del recurso",
+    "resourceCreateGeneral": "General",
    "resourceNameDescription": "Este es el nombre para mostrar el recurso.",
    "siteSelect": "Seleccionar sitio",
    "siteSearch": "Buscar sitio",
@@ -231,12 +255,15 @@
    "noCountryFound": "Ningún país encontrado.",
    "siteSelectionDescription": "Este sitio proporcionará conectividad al objetivo.",
    "resourceType": "Tipo de recurso",
-    "resourceTypeDescription": "Determina cómo acceder al recurso",
+    "resourceTypeDescription": "Esto controla el protocolo del recurso y cómo se renderizará en el navegador. Esto no se puede cambiar más tarde.",
+    "resourceDomainDescription": "El recurso se servirá en este nombre de dominio completamente calificado.",
    "resourceHTTPSSettings": "Configuración HTTPS",
    "resourceHTTPSSettingsDescription": "Configurar cómo se accederá al recurso a través de HTTPS",
+    "resourcePortDescription": "El puerto externo en la instancia o nodo de Pangolin donde el recurso será accesible.",
    "domainType": "Tipo de dominio",
    "subdomain": "Subdominio",
    "baseDomain": "Dominio base",
+    "configure": "Configurar",
    "subdomnainDescription": "El subdominio al que el recurso será accesible.",
    "resourceRawSettings": "Configuración TCP/UDP",
    "resourceRawSettingsDescription": "Configurar cómo se accederá al recurso a través de TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Aprende cómo configurar los recursos TCP/UDP",
    "resourceBack": "Volver a Recursos",
    "resourceGoTo": "Ir a Recurso",
+    "resourcePolicyDelete": "Eliminar Política de Recursos",
+    "resourcePolicyDeleteConfirm": "Confirmar eliminación de la política de recursos",
    "resourceDelete": "Eliminar Recurso",
    "resourceDeleteConfirm": "Confirmar Borrar Recurso",
+    "labelDelete": "Eliminar etiqueta",
+    "labelAdd": "Agregar etiqueta",
+    "labelCreateSuccessMessage": "Etiqueta creada correctamente",
+    "labelEditSuccessMessage": "Etiqueta modificada correctamente",
+    "labelNameField": "Nombre de la etiqueta",
+    "labelColorField": "Color de la etiqueta",
+    "labelPlaceholder": "Ej: homelab",
+    "labelCreate": "Crear etiqueta",
+    "createLabelDialogTitle": "Crear etiqueta",
+    "createLabelDialogDescription": "Cree una nueva etiqueta que se pueda adjuntar a esta organización",
+    "labelEdit": "Editar etiqueta",
+    "editLabelDialogTitle": "Actualizar etiqueta",
+    "editLabelDialogDescription": "Edite una nueva etiqueta que se pueda adjuntar a esta organización",
+    "labelDeleteConfirm": "Confirmar eliminación de etiqueta",
+    "labelErrorDelete": "Error al eliminar la etiqueta",
+    "labelMessageRemove": "Esta acción es permanente. Todos los sitios, recursos y clientes etiquetados con esta etiqueta serán des- etiquetados.",
+    "labelQuestionRemove": "¿Está seguro de que desea eliminar la etiqueta de la organización?",
    "visibility": "Visibilidad",
    "enabled": "Activado",
    "disabled": "Deshabilitado",
@@ -265,6 +311,8 @@
    "rules": "Reglas",
    "resourceSettingDescription": "Configurar la configuración del recurso",
    "resourceSetting": "Ajustes {resourceName}",
+    "resourcePolicySettingDescription": "Configure la configuración en la política de recursos",
+    "resourcePolicySetting": "Configuración {policyName}",
    "alwaysAllow": "Autorización Bypass",
    "alwaysDeny": "Bloquear acceso",
    "passToAuth": "Pasar a Autenticación",
@@ -747,6 +795,16 @@
    "rulesNoOne": "No hay reglas. Agregue una regla usando el formulario.",
    "rulesOrder": "Las reglas son evaluadas por prioridad en orden ascendente.",
    "rulesSubmit": "Guardar Reglas",
+    "policyErrorCreate": "Error al crear la política",
+    "policyErrorCreateDescription": "Se ha producido un error al crear la política",
+    "policyErrorCreateMessageDescription": "Se ha producido un error inesperado",
+    "policyErrorUpdate": "Error al actualizar la política",
+    "policyErrorUpdateDescription": "Se ha producido un error al actualizar la política",
+    "policyErrorUpdateMessageDescription": "Se ha producido un error inesperado",
+    "policyCreatedSuccess": "Política de recursos creada con éxito",
+    "policyUpdatedSuccess": "Política de recursos actualizada con éxito",
+    "authMethodsSave": "Guardar métodos de autenticación",
+    "rulesSave": "Guardar reglas",
    "resourceErrorCreate": "Error al crear recurso",
    "resourceErrorCreateDescription": "Se ha producido un error al crear el recurso",
    "resourceErrorCreateMessage": "Error al crear el recurso:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Añadir código PIN",
    "pincodeRemove": "Eliminar código PIN",
    "resourceAuthMethods": "Métodos de autenticación",
+    "resourcePolicyAuthMethodsEmpty": "No hay método de autenticación",
+    "resourcePolicyOtpEmpty": "Sin contraseña de un solo uso",
+    "resourcePolicyReadOnly": "Esta política es solo de lectura",
+    "resourcePolicyReadOnlyDescription": "Esta política de recursos se comparte entre varios recursos, no puede editarla en esta página.",
+    "editSharedPolicy": "Editar Política Compartida",
+    "resourcePolicyTypeSave": "Guardar tipo de recurso",
+    "resourcePolicySelect": "Seleccionar política de recursos",
+    "resourcePolicySelectError": "Seleccione una política de recursos",
+    "resourcePolicyNotFound": "Política no encontrada",
+    "resourcePolicySearch": "Buscar políticas",
+    "resourcePolicyRulesEmpty": "Sin reglas de autenticación",
    "resourceAuthMethodsDescriptions": "Permitir el acceso al recurso a través de métodos de autenticación adicionales",
    "resourceAuthSettingsSave": "Guardado correctamente",
    "resourceAuthSettingsSaveDescription": "Se han guardado los ajustes de autenticación",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Definir Pincode",
    "resourcePincodeSetupTitleDescription": "Establecer un pincode para proteger este recurso",
    "resourceRoleDescription": "Los administradores siempre pueden acceder a este recurso.",
+    "resourcePolicySelectTitle": "Política de Acceso a Recursos",
+    "resourcePolicySelectDescription": "Seleccione el tipo de política de recursos para la autenticación",
+    "resourcePolicyInline": "Política de Recursos Integrada",
+    "resourcePolicyInlineDescription": "Política de Acceso solo destinada a este recurso",
+    "resourcePolicyShared": "Política de Recursos Compartida",
+    "resourcePolicySharedDescription": "Este recurso utiliza una política compartida. Las configuraciones a nivel de política (métodos de autenticación, lista blanca de correos electrónicos) están bloqueadas. Puede agregar reglas específicas de recursos, roles y usuarios más abajo.",
    "resourceUsersRoles": "Controles de acceso",
    "resourceUsersRolesDescription": "Configurar qué usuarios y roles pueden visitar este recurso",
    "resourceUsersRolesSubmit": "Guardar controles de acceso",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Hubo un problema al conectar con {name}. Por favor, póngase en contacto con su administrador.",
    "idpErrorNotFound": "IdP no encontrado",
    "inviteInvalid": "Invitación inválida",
+    "labels": "Etiquetas",
+    "orgLabelsDescription": "Administrar etiquetas en esta organización.",
+    "addLabels": "Agregar etiquetas",
+    "siteLabelsTab": "Etiquetas",
+    "siteLabelsDescription": "Administrar las etiquetas asociadas con este sitio.",
+    "labelsNotFound": "Etiquetas no encontradas",
+    "labelSearch": "Buscar etiquetas",
+    "accessLabelFilterCount": "{count, plural, one {# etiqueta} other {# etiquetas}}",
+    "labelOverflowCount": "+{count, plural, one {# etiqueta} other {# etiquetas}}",
+    "accessLabelFilterClear": "Borrar filtros de etiquetas",
+    "selectColor": "Seleccionar color",
+    "createNewLabel": "Crear nueva etiqueta de organización \"{label}\"",
    "inviteInvalidDescription": "El enlace de invitación no es válido.",
    "inviteErrorWrongUser": "La invitación no es para este usuario",
    "inviteErrorUserNotExists": "El usuario no existe. Por favor, cree una cuenta primero.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Recursos",
    "sidebarProxyResources": "Público",
    "sidebarClientResources": "Privado",
+    "sidebarPolicies": "Políticas",
+    "sidebarResourcePolicies": "Recursos",
    "sidebarAccessControl": "Control de acceso",
    "sidebarLogsAndAnalytics": "Registros y análisis",
    "sidebarTeam": "Equipo",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Sitio {id}",
    "standaloneHcFilterResourceIdFallback": "Recurso {id}",
    "blueprints": "Planos",
-    "blueprintsDescription": "Aplicar configuraciones declarativas y ver ejecuciones anteriores",
+    "blueprintsLog": "Registro de planos",
+    "blueprintsDescription": "Ver aplicaciones de plano anteriores y sus resultados",
    "blueprintAdd": "Añadir plano",
    "blueprintGoBack": "Ver todos los Planos",
    "blueprintCreate": "Crear Plano",
@@ -1575,7 +1665,17 @@
    "contents": "Contenido",
    "parsedContents": "Contenido analizado (Sólo lectura)",
    "enableDockerSocket": "Habilitar Plano Docker",
-    "enableDockerSocketDescription": "Activar el raspado de etiquetas de Socket Docker para etiquetas de planos. La ruta del Socket debe proporcionarse a Newt.",
+    "enableDockerSocketDescription": "Activar el raspado de etiquetas del socket Docker para etiquetas de planos. La ruta del socket debe proporcionarse al conector del sitio. Lea sobre cómo funciona esto en <docsLink>la documentación</docsLink>.",
+    "newtAutoUpdate": "Habilitar actualización automática del sitio",
+    "newtAutoUpdateDescription": "Cuando está habilitado, los conectores del sitio se actualizarán automáticamente a la última versión cuando haya disponible una nueva versión.",
+    "siteAutoUpdate": "Actualización automática del sitio",
+    "siteAutoUpdateLabel": "Habilitar actualización automática",
+    "siteAutoUpdateDescription": "Controlar si el conector de este sitio descarga automáticamente la última versión.",
+    "siteAutoUpdateOrgDefault": "Predeterminado de la organización: {state}",
+    "siteAutoUpdateOverriding": "Configuración de anulación de la organización",
+    "siteAutoUpdateResetToOrg": "Restablecer al predeterminado de la organización",
+    "siteAutoUpdateEnabled": "activado",
+    "siteAutoUpdateDisabled": "deshabilitado",
    "viewDockerContainers": "Ver contenedores Docker",
    "containersIn": "Contenedores en {siteName}",
    "selectContainerDescription": "Seleccione cualquier contenedor para usar como nombre de host para este objetivo. Haga clic en un puerto para usar un puerto.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Certificado",
    "certificateStatusAutoRefreshHint": "El estado se actualiza automáticamente.",
    "loading": "Cargando",
+    "loadingEllipsis": "Cargando...",
    "loadingAnalytics": "Cargando analíticas",
    "restart": "Reiniciar",
    "domains": "Dominios",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Administra tu suscripción para las claves de licencia autoalojadas pagadas",
    "billingCurrentKeys": "Claves actuales",
    "billingModifyCurrentPlan": "Modificar plan actual",
+    "billingManageLicenseSubscriptionDescription": "Administre su suscripción para claves de licencia autogestionadas pagas y descargue facturas.",
    "billingConfirmUpgrade": "Confirmar actualización",
    "billingConfirmDowngrade": "Confirmar descenso",
    "billingConfirmUpgradeDescription": "Estás a punto de actualizar tu plan. Revisa los nuevos límites y precios a continuación.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "El tiempo está en segundos",
    "requireDeviceApproval": "Requiere aprobaciones del dispositivo",
    "requireDeviceApprovalDescription": "Los usuarios con este rol necesitan nuevos dispositivos aprobados por un administrador antes de poder conectarse y acceder a los recursos.",
-    "sshAccess": "Acceso a SSH",
+    "sshSettings": "Configuración SSH",
+    "rdpSettings": "Configuración RDP",
+    "vncSettings": "Configuración VNC",
+    "sshServer": "Servidor SSH",
+    "rdpServer": "Servidor RDP",
+    "vncServer": "Servidor VNC",
+    "sshServerDescription": "Configure el método de autenticación, la ubicación del daemon y el destino del servidor",
+    "rdpServerDescription": "Configure el destino y el puerto del servidor RDP",
+    "vncServerDescription": "Configure el destino y el puerto del servidor VNC",
+    "sshServerMode": "Modo",
+    "sshServerModeStandard": "Servidor SSH estándar",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Rutas de comandos a través de la red a un servidor SSH como OpenSSH.",
+    "sshServerModeNative": "Servidor SSH nativo",
+    "sshServerModeNativeDescription": "Ejecuta comandos directamente en el host a través del Conector de Sitio. No se requiere configuración de red.",
+    "sshAuthenticationMethod": "Método de autenticación",
+    "sshAuthMethodManual": "Autenticación manual",
+    "sshAuthMethodManualDescription": "Requiere credenciales de host existentes. Omite la provisión automática.",
+    "sshAuthMethodAutomated": "Provisión automatizada",
+    "sshAuthMethodAutomatedDescription": "Crea automáticamente usuarios, grupos y permisos de sudo en el host.",
+    "sshAuthDaemonLocation": "Ubicación del Daemon de Autenticación",
+    "sshDaemonLocationSiteDescription": "Ejecuta localmente en la máquina que aloja el conector de sitio.",
+    "sshDaemonLocationRemote": "En Host Remoto",
+    "sshDaemonLocationRemoteDescription": "Ejecuta en una máquina objetivo separada en la misma red.",
+    "sshDaemonDisclaimer": "Asegúrese de que su host objetivo esté correctamente configurado para ejecutar el daemon de autenticación antes de completar esta configuración, o la provisión fallará.",
+    "sshDaemonPort": "Puerto del Daemon",
+    "sshServerDestination": "Destino del Servidor",
+    "sshServerDestinationDescription": "Configure el destino y el puerto del servidor SSH",
+    "destination": "Destino",
+    "bgTargetMultiSiteDisclaimer": "Seleccionar múltiples sitios permite el enrutamiento resiliente y el failover para alta disponibilidad.",
    "roleAllowSsh": "Permitir SSH",
    "roleAllowSshAllow": "Permitir",
    "roleAllowSshDisallow": "Rechazar",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "El usuario sólo puede ejecutar los comandos especificados con sudo.",
    "sshSudo": "Permitir sudo",
    "sshSudoCommands": "Comandos Sudo",
-    "sshSudoCommandsDescription": "Lista separada por comas de comandos que el usuario puede ejecutar con sudo.",
+    "sshSudoCommandsDescription": "Lista separada por comas de comandos que el usuario puede ejecutar con sudo. Se deben usar rutas absolutas.",
    "sshCreateHomeDir": "Crear directorio principal",
    "sshUnixGroups": "Grupos Unix",
    "sshUnixGroupsDescription": "Grupos Unix separados por comas para agregar el usuario en el host de destino.",
@@ -2235,7 +2366,7 @@
        "description": "Servidor Pangolin autoalojado más fiable y de bajo mantenimiento con campanas y silbidos extra",
        "introTitle": "Pangolin autogestionado",
        "introDescription": "es una opción de despliegue diseñada para personas que quieren simplicidad y fiabilidad extra mientras mantienen sus datos privados y autoalojados.",
-        "introDetail": "Con esta opción, todavía ejecuta su propio nodo Pangolin, sus túneles, terminación TLS y tráfico permanecen en su servidor. La diferencia es que la gestión y el control se gestionan a través de nuestro panel de control en la nube, que desbloquea una serie de ventajas:",
+        "introDetail": "Con esta opción, todavía ejecuta su propio nodo Pangolin, sus túneles, terminación del TLS y tráfico permanecen en su servidor. La diferencia es que la gestión y el monitoreo se manejan a través de nuestro panel de control en la nube, lo que desbloquea una serie de beneficios:",
        "benefitSimplerOperations": {
            "title": "Operaciones simples",
            "description": "No necesitas ejecutar tu propio servidor de correo o configurar alertas complejas. Recibirás cheques de salud y alertas de tiempo de inactividad."
@@ -2939,7 +3070,7 @@
    "learnMore": "Más información",
    "backToHome": "Volver a inicio",
    "needToSignInToOrg": "¿Necesita usar el proveedor de identidad de su organización?",
-    "maintenanceMode": "Modo de mantenimiento",
+    "maintenanceMode": "Página de Mantenimiento",
    "maintenanceModeDescription": "Muestra una página de mantenimiento a los visitantes",
    "maintenanceModeType": "Tipo de modo de mantenimiento",
    "showMaintenancePage": "Mostrar página de mantenimiento a los visitantes",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Estimado completado:",
    "createInternalResourceDialogDestinationRequired": "Se requiere destino",
    "available": "Disponible",
+    "disabledResourceDescription": "Cuando está deshabilitado, el recurso será inaccesible para todos.",
    "archived": "Archivado",
    "noArchivedDevices": "No se encontraron dispositivos archivados",
    "deviceArchived": "Dispositivo archivado",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Recurso Deshabilitado",
    "memberPortalShowingResources": "Mostrando {start}-{end} de {total} recursos",
    "memberPortalPrevious": "Anterior",
-    "memberPortalNext": "Siguiente"
+    "memberPortalNext": "Siguiente",
+    "httpSettings": "Configuración HTTP",
+    "tcpSettings": "Configuración TCP",
+    "udpSettings": "Configuración UDP",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Estableciendo una conexión segura…",
+    "sshConnecting": "Conectando…",
+    "sshInitializing": "Inicializando…",
+    "sshSignInTitle": "Iniciar sesión en SSH",
+    "sshSignInDescription": "Ingrese sus credenciales SSH",
+    "sshPasswordTab": "Contraseña",
+    "sshPrivateKeyTab": "Clave Privada",
+    "sshPrivateKeyField": "Clave Privada",
+    "sshPrivateKeyDisclaimer": "Su clave privada no se almacena ni es visible para Pangolin. Alternativamente, puede usar certificados de corta duración para una autenticación sin interrupciones usando su identidad Pangolin existente.",
+    "sshLearnMore": "Más información",
+    "sshPrivateKeyFile": "Archivo de clave privada",
+    "sshAuthenticate": "Autenticarse",
+    "sshTerminate": "Terminar",
+    "sshPoweredBy": "Desarrollado por",
+    "sshErrorNoTarget": "No se especificó el objetivo",
+    "sshErrorWebSocket": "Conexión WebSocket fallida",
+    "sshErrorAuthFailed": "Falló la autenticación",
+    "sshErrorConnectionClosed": "La conexión se cerró antes de completar la autenticación"
 }
--- a/messages/fr-FR.json
+++ b/messages/fr-FR.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Une erreur s'est produite lors de la création du lien partageable",
    "shareCreateDescription": "N'importe qui avec ce lien peut accéder à la ressource",
    "shareTitleOptional": "Titre (facultatif)",
+    "sharePathOptional": "Chemin (optionnel)",
    "expireIn": "Expire dans",
    "neverExpire": "N'expire jamais",
    "shareExpireDescription": "Le délai d'expiration correspond à la période pendant laquelle le lien sera utilisable et permettra d'accéder à la ressource. Passé ce délai, le lien ne fonctionnera plus et les utilisateurs qui l'ont utilisé perdront l'accès à la ressource.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Chercher des ressources...",
    "resourceAdd": "Ajouter une ressource",
    "resourceErrorDelte": "Erreur lors de la de suppression de la ressource",
+    "resourcePoliciesTitle": "Gérer les politiques de ressource",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Ressources attachées",
+    "resourcePoliciesAttachedResources": "{count} ressource(s)",
+    "resourcePoliciesAttachedResourcesEmpty": "pas de ressources",
+    "resourcePoliciesDescription": "Créer et gérer des politiques d'authentification pour contrôler l'accès à vos ressources",
+    "resourcePoliciesSearch": "Chercher des politiques...",
+    "resourcePoliciesAdd": "Ajouter une politique",
+    "resourcePoliciesDefaultBadgeText": "Politique par défaut",
+    "resourcePoliciesCreate": "Créer une politique de ressource",
+    "resourcePoliciesCreateDescription": "Suivez les étapes ci-dessous pour créer une nouvelle politique",
+    "resourcePolicyName": "Nom de la politique",
+    "resourcePolicyNameDescription": "Donnez à cette politique un nom pour l'identifier parmi vos ressources",
+    "resourcePolicyNamePlaceholder": "par exemple : Politique d'Accès Interne",
+    "resourcePoliciesSeeAll": "Voir toutes les politiques",
+    "resourcePolicyAuthMethodAdd": "Ajouter une méthode d'authentification",
+    "resourcePolicyOtpEmailAdd": "Ajouter des emails pour OTP",
+    "resourcePolicyRulesAdd": "Ajouter des règles",
+    "resourcePolicyAuthMethodsDescription": "Permettre l'accès aux ressources via des méthodes d'authentification supplémentaires",
+    "resourcePolicyUsersRolesDescription": "Configurer quels utilisateurs et rôles peuvent visiter les ressources associées",
+    "rulesResourcePolicyDescription": "Configurer les règles pour contrôler l'accès aux ressources associées à cette politique",
    "authentication": "Authentification",
    "protected": "Protégé",
    "notProtected": "Non Protégé",
    "resourceMessageRemove": "Une fois supprimée, la ressource ne sera plus accessible. Toutes les cibles associées à la ressource seront également supprimées.",
    "resourceQuestionRemove": "Êtes-vous sûr de vouloir retirer la ressource de l'organisation ?",
+    "resourcePolicyMessageRemove": "Une fois supprimée, la politique de ressource ne sera plus accessible. Toutes les ressources associées seront détachées et laissées sans authentification.",
+    "resourcePolicyQuestionRemove": "Êtes-vous sûr de vouloir supprimer la politique de ressource de l'organisation ?",
    "resourceHTTP": "Ressource HTTPS",
    "resourceHTTPDescription": "Proxy les demandes sur HTTPS en utilisant un nom de domaine entièrement qualifié.",
    "resourceRaw": "Ressource TCP/UDP brute",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Requêtes de proxy sur TCP/UDP brute en utilisant un numéro de port. Nécessite des sites pour se connecter à un noeud distant.",
    "resourceCreate": "Créer une ressource",
    "resourceCreateDescription": "Suivez les étapes ci-dessous pour créer une nouvelle ressource",
+    "resourceCreateGeneralDescription": "Configurer les paramètres de ressource de base, y compris le nom et le type",
    "resourceSeeAll": "Voir toutes les ressources",
-    "resourceInfo": "Informations sur la ressource",
+    "resourceCreateGeneral": "Général",
    "resourceNameDescription": "Ceci est le nom d'affichage de la ressource.",
    "siteSelect": "Sélectionnez un nœud",
    "siteSearch": "Chercher un nœud",
@@ -231,12 +255,15 @@
    "noCountryFound": "Aucun pays trouvé.",
    "siteSelectionDescription": "Ce site fournira la connectivité à la cible.",
    "resourceType": "Type de ressource",
-    "resourceTypeDescription": "Déterminer comment accéder à la ressource",
+    "resourceTypeDescription": "Cela contrôle le protocole de la ressource et comment il sera rendu dans le navigateur. Cela ne peut pas être changé plus tard.",
+    "resourceDomainDescription": "La ressource sera servie à ce nom de domaine pleinement qualifié.",
    "resourceHTTPSSettings": "Paramètres HTTPS",
    "resourceHTTPSSettingsDescription": "Configurer comment la ressource sera accédée via HTTPS",
+    "resourcePortDescription": "Le port externe sur l'instance ou nœud Pangolin où la ressource sera accessible.",
    "domainType": "Type de domaine",
    "subdomain": "Sous-domaine",
    "baseDomain": "Domaine racine",
+    "configure": "Configurer",
    "subdomnainDescription": "Le sous-domaine où la ressource sera accessible.",
    "resourceRawSettings": "Paramètres TCP/UDP",
    "resourceRawSettingsDescription": "Configurer comment la ressource sera accédée via TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Apprenez à configurer les ressources TCP/UDP",
    "resourceBack": "Retour aux ressources",
    "resourceGoTo": "Aller à la ressource",
+    "resourcePolicyDelete": "Supprimer la politique de ressource",
+    "resourcePolicyDeleteConfirm": "Confirmer la suppression de la politique de ressource",
    "resourceDelete": "Supprimer la ressource",
    "resourceDeleteConfirm": "Confirmer la suppression de la ressource",
+    "labelDelete": "Supprimer Étiquette",
+    "labelAdd": "Ajouter Étiquette",
+    "labelCreateSuccessMessage": "Étiquette créée avec succès",
+    "labelEditSuccessMessage": "Étiquette modifiée avec succès",
+    "labelNameField": "Nom de l'étiquette",
+    "labelColorField": "Couleur de l'étiquette",
+    "labelPlaceholder": "Ex : homelab",
+    "labelCreate": "Créer Étiquette",
+    "createLabelDialogTitle": "Créer Étiquette",
+    "createLabelDialogDescription": "Créer une nouvelle étiquette qui peut être attachée à cette organisation",
+    "labelEdit": "Modifier Étiquette",
+    "editLabelDialogTitle": "Mettre à jour Étiquette",
+    "editLabelDialogDescription": "Modifier une nouvelle étiquette qui peut être attachée à cette organisation",
+    "labelDeleteConfirm": "Confirmer la suppression de l'étiquette",
+    "labelErrorDelete": "Échec de la suppression de l'étiquette",
+    "labelMessageRemove": "Cette action est permanente. Tous les sites, ressources et clients étiquetés avec cette étiquette seront détachés.",
+    "labelQuestionRemove": "Êtes-vous sûr de vouloir supprimer l'étiquette de l'organisation ?",
    "visibility": "Visibilité",
    "enabled": "Activé",
    "disabled": "Désactivé",
@@ -265,6 +311,8 @@
    "rules": "Règles",
    "resourceSettingDescription": "Configurer les paramètres de la ressource",
    "resourceSetting": "Réglages de {resourceName}",
+    "resourcePolicySettingDescription": "Configurer les paramètres de la politique de ressource",
+    "resourcePolicySetting": "Paramètres de {policyName}",
    "alwaysAllow": "Outrepasser l'authentification",
    "alwaysDeny": "Bloquer l'accès",
    "passToAuth": "Passer à l'authentification",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Aucune règle. Ajoutez une règle en utilisant le formulaire.",
    "rulesOrder": "Les règles sont évaluées par priorité dans l'ordre croissant.",
    "rulesSubmit": "Enregistrer les règles",
+    "policyErrorCreate": "Erreur lors de la création de la politique",
+    "policyErrorCreateDescription": "Une erreur s'est produite lors de la création de la politique",
+    "policyErrorCreateMessageDescription": "Une erreur inattendue s'est produite",
+    "policyErrorUpdate": "Erreur lors de la mise à jour de la politique",
+    "policyErrorUpdateDescription": "Une erreur s'est produite lors de la mise à jour de la politique",
+    "policyErrorUpdateMessageDescription": "Une erreur inattendue s'est produite",
+    "policyCreatedSuccess": "Politique de ressource créée avec succès",
+    "policyUpdatedSuccess": "Politique de ressource mise à jour avec succès",
+    "authMethodsSave": "Enregistrer les méthodes d'authentification",
+    "rulesSave": "Enregistrer les règles",
    "resourceErrorCreate": "Erreur lors de la création de la ressource",
    "resourceErrorCreateDescription": "Une erreur s'est produite lors de la création de la ressource",
    "resourceErrorCreateMessage": "Erreur lors de la création de la ressource :",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Ajouter un code PIN",
    "pincodeRemove": "Supprimer le code PIN",
    "resourceAuthMethods": "Méthodes d'authentification",
+    "resourcePolicyAuthMethodsEmpty": "Pas de méthode d'authentification",
+    "resourcePolicyOtpEmpty": "Aucun mot de passe à usage unique",
+    "resourcePolicyReadOnly": "Cette politique est en lecture seule",
+    "resourcePolicyReadOnlyDescription": "Cette politique de ressource est partagée sur plusieurs ressources, vous ne pouvez pas l'éditer sur cette page.",
+    "editSharedPolicy": "Modifier la politique partagée",
+    "resourcePolicyTypeSave": "Enregistrer le type de ressource",
+    "resourcePolicySelect": "Sélectionner la politique de ressource",
+    "resourcePolicySelectError": "Sélectionner une politique de ressource",
+    "resourcePolicyNotFound": "Politique introuvable",
+    "resourcePolicySearch": "Chercher des politiques",
+    "resourcePolicyRulesEmpty": "Pas de règles d'authentification",
    "resourceAuthMethodsDescriptions": "Permettre l'accès à la ressource via des méthodes d'authentification supplémentaires",
    "resourceAuthSettingsSave": "Enregistré avec succès",
    "resourceAuthSettingsSaveDescription": "Les paramètres d'authentification ont été enregistrés",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Définir le code PIN",
    "resourcePincodeSetupTitleDescription": "Définir un code PIN pour protéger cette ressource",
    "resourceRoleDescription": "Les administrateurs peuvent toujours accéder à cette ressource.",
+    "resourcePolicySelectTitle": "Politique d'accès à la ressource",
+    "resourcePolicySelectDescription": "Sélectionner le type de politique de ressource pour l'authentification",
+    "resourcePolicyInline": "Politique de ressource en ligne",
+    "resourcePolicyInlineDescription": "Politique d'accès limitée uniquement à cette ressource",
+    "resourcePolicyShared": "Politique de ressource partagée",
+    "resourcePolicySharedDescription": "Cette ressource utilise une politique partagée. Les paramètres de niveau politique (méthodes d'authentification, liste blanche email) sont verrouillés. Vous pouvez ajouter des règles spécifiques à la ressource, rôles et utilisateurs ci-dessous.",
    "resourceUsersRoles": "Contrôles d'accès",
    "resourceUsersRolesDescription": "Configurer quels utilisateurs et rôles peuvent visiter cette ressource",
    "resourceUsersRolesSubmit": "Enregistrer les contrôles d'accès",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Un problème est survenu lors de la connexion à {name}. Veuillez contacter votre administrateur.",
    "idpErrorNotFound": "IdP introuvable",
    "inviteInvalid": "Invitation invalide",
+    "labels": "Étiquettes",
+    "orgLabelsDescription": "Gérer les étiquettes dans cette organisation.",
+    "addLabels": "Ajouter des étiquettes",
+    "siteLabelsTab": "Étiquettes",
+    "siteLabelsDescription": "Gérer les étiquettes associées à ce site.",
+    "labelsNotFound": "Étiquettes introuvables",
+    "labelSearch": "Chercher des étiquettes",
+    "accessLabelFilterCount": "{count, plural, one {# étiquette} other {# étiquettes}}",
+    "labelOverflowCount": "+{count, plural, one {# étiquette} other {# étiquettes}}",
+    "accessLabelFilterClear": "Effacer les filtres d'étiquette",
+    "selectColor": "Sélectionner la couleur",
+    "createNewLabel": "Créer une nouvelle étiquette d'organisation \"{label}\"",
    "inviteInvalidDescription": "Le lien d'invitation n'est pas valide.",
    "inviteErrorWrongUser": "L'invitation n'est pas pour cet utilisateur",
    "inviteErrorUserNotExists": "L'utilisateur n'existe pas. Veuillez d'abord créer un compte.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Ressource",
    "sidebarProxyResources": "Publique",
    "sidebarClientResources": "Privé",
+    "sidebarPolicies": "Politiques",
+    "sidebarResourcePolicies": "Ressources",
    "sidebarAccessControl": "Contrôle d'accès",
    "sidebarLogsAndAnalytics": "Journaux & Analytiques",
    "sidebarTeam": "Equipe",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Site {id}",
    "standaloneHcFilterResourceIdFallback": "Ressource {id}",
    "blueprints": "Configs",
-    "blueprintsDescription": "Appliquer les configurations déclaratives et afficher les exécutions précédentes",
+    "blueprintsLog": "Journal des plans",
+    "blueprintsDescription": "Voir les applications passées des plans et leurs résultats",
    "blueprintAdd": "Ajouter une Config",
    "blueprintGoBack": "Voir toutes les Configs",
    "blueprintCreate": "Créer une Config",
@@ -1575,7 +1665,17 @@
    "contents": "Contenus",
    "parsedContents": "Contenu analysé (lecture seule)",
    "enableDockerSocket": "Activer la Config Docker",
-    "enableDockerSocketDescription": "Activer le ramassage d'étiquettes de socket Docker pour les étiquettes de plan. Le chemin de socket doit être fourni à Newt.",
+    "enableDockerSocketDescription": "Activer le ramassage d'étiquettes de socket Docker pour les étiquettes de plan. Le chemin du socket doit être fourni au connecteur du site. Lisez plus à ce sujet dans <docsLink>la documentation</docsLink>.",
+    "newtAutoUpdate": "Activer la mise à jour automatique du site",
+    "newtAutoUpdateDescription": "Lorsqu'il est activé, les connecteurs de site se mettront automatiquement à jour vers la dernière version lorsqu'une nouvelle version sera disponible.",
+    "siteAutoUpdate": "Mise à jour automatique du site",
+    "siteAutoUpdateLabel": "Activer la mise à jour automatique",
+    "siteAutoUpdateDescription": "Contrôler si le connecteur de ce site télécharge automatiquement la dernière version.",
+    "siteAutoUpdateOrgDefault": "Valeur par défaut de l'organisation : {state}",
+    "siteAutoUpdateOverriding": "Substitution des paramètres de l'organisation",
+    "siteAutoUpdateResetToOrg": "Réinitialiser à la valeur par défaut de l'organisation",
+    "siteAutoUpdateEnabled": "activé",
+    "siteAutoUpdateDisabled": "désactivé",
    "viewDockerContainers": "Voir les conteneurs Docker",
    "containersIn": "Conteneurs en {siteName}",
    "selectContainerDescription": "Sélectionnez n'importe quel conteneur à utiliser comme nom d'hôte pour cette cible. Cliquez sur un port pour utiliser un port.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Certificat",
    "certificateStatusAutoRefreshHint": "L'état se rafraîchit automatiquement.",
    "loading": "Chargement",
+    "loadingEllipsis": "Chargement...",
    "loadingAnalytics": "Chargement de l'analyse",
    "restart": "Redémarrer",
    "domains": "Domaines",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Gérer votre abonnement pour les clés de licence auto-hébergées payantes",
    "billingCurrentKeys": "Clés actuelles",
    "billingModifyCurrentPlan": "Modifier le plan actuel",
+    "billingManageLicenseSubscriptionDescription": "Gérez votre abonnement pour clés de licence auto-hébergées payantes et téléchargez les factures.",
    "billingConfirmUpgrade": "Confirmer la mise à niveau",
    "billingConfirmDowngrade": "Confirmer la rétrogradation",
    "billingConfirmUpgradeDescription": "Vous êtes sur le point de mettre à niveau votre offre. Examinez les nouvelles limites et les nouveaux prix ci-dessous.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Le temps est exprimé en secondes",
    "requireDeviceApproval": "Exiger les autorisations de l'appareil",
    "requireDeviceApprovalDescription": "Les utilisateurs ayant ce rôle ont besoin de nouveaux périphériques approuvés par un administrateur avant de pouvoir se connecter et accéder aux ressources.",
-    "sshAccess": "Accès SSH",
+    "sshSettings": "Paramètres SSH",
+    "rdpSettings": "Paramètres RDP",
+    "vncSettings": "Paramètres VNC",
+    "sshServer": "Serveur SSH",
+    "rdpServer": "Serveur RDP",
+    "vncServer": "Serveur VNC",
+    "sshServerDescription": "Configurer la méthode d'authentification, l'emplacement du démon et la destination du serveur",
+    "rdpServerDescription": "Configurer la destination et le port du serveur RDP",
+    "vncServerDescription": "Configurer la destination et le port du serveur VNC",
+    "sshServerMode": "Mode",
+    "sshServerModeStandard": "Serveur SSH Standard",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Relai les commandes sur le réseau vers un serveur SSH tel qu'OpenSSH.",
+    "sshServerModeNative": "Serveur SSH Natif",
+    "sshServerModeNativeDescription": "Exécute les commandes directement sur l'hôte via le Connecteur de Site. Aucune configuration réseau requise.",
+    "sshAuthenticationMethod": "Méthode d'authentification",
+    "sshAuthMethodManual": "Authentification Manuelle",
+    "sshAuthMethodManualDescription": "Nécessite des identifiants d'hôte existants. Évite l'approvisionnement automatique.",
+    "sshAuthMethodAutomated": "Approvisionnement Automatisé",
+    "sshAuthMethodAutomatedDescription": "Crée automatiquement des utilisateurs, groupes, et permissions sudo sur l'hôte.",
+    "sshAuthDaemonLocation": "Emplacement du Démon Auth",
+    "sshDaemonLocationSiteDescription": "Exécute localement sur la machine hébergeant le connecteur de site.",
+    "sshDaemonLocationRemote": "Sur hôte distant",
+    "sshDaemonLocationRemoteDescription": "S'exécute sur une machine cible séparée sur le même réseau.",
+    "sshDaemonDisclaimer": "Assurez-vous que votre hôte cible est correctement configuré pour exécuter le daemon auth avant de terminer cette configuration, ou l'approvisionnement échouera.",
+    "sshDaemonPort": "Port du Démon",
+    "sshServerDestination": "Destination du Serveur",
+    "sshServerDestinationDescription": "Configurer la destination et le port du serveur SSH",
+    "destination": "Destination",
+    "bgTargetMultiSiteDisclaimer": "La sélection de plusieurs sites permet un routage résilient et une bascule pour une haute disponibilité.",
    "roleAllowSsh": "Autoriser SSH",
    "roleAllowSshAllow": "Autoriser",
    "roleAllowSshDisallow": "Interdire",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "L'utilisateur ne peut exécuter que les commandes spécifiées avec sudo.",
    "sshSudo": "Autoriser sudo",
    "sshSudoCommands": "Commandes Sudo",
-    "sshSudoCommandsDescription": "Liste des commandes séparées par des virgules que l'utilisateur est autorisé à exécuter avec sudo.",
+    "sshSudoCommandsDescription": "Liste de commandes séparées par des virgules que l'utilisateur est autorisé à exécuter avec sudo. Des chemins absolus doivent être utilisés.",
    "sshCreateHomeDir": "Créer un répertoire personnel",
    "sshUnixGroups": "Groupes Unix",
    "sshUnixGroupsDescription": "Groupes Unix séparés par des virgules pour ajouter l'utilisateur sur l'hôte cible.",
@@ -2235,7 +2366,7 @@
        "description": "Serveur Pangolin auto-hébergé avec des cloches et des sifflets supplémentaires",
        "introTitle": "Pangolin auto-hébergé géré",
        "introDescription": "est une option de déploiement conçue pour les personnes qui veulent de la simplicité et de la fiabilité tout en gardant leurs données privées et auto-hébergées.",
-        "introDetail": "Avec cette option, vous exécutez toujours votre propre nœud Pangolin - vos tunnels, la terminaison TLS et le trafic restent sur votre serveur. La différence est que la gestion et la surveillance sont gérées via notre tableau de bord du cloud, qui déverrouille un certain nombre d'avantages :",
+        "introDetail": "Avec cette option, vous exécutez toujours votre propre nœud Pangolin - vos tunnels, la terminaison TLS et le trafic restent sur votre serveur. La différence est que la gestion et la surveillance sont gérées via notre tableau de bord du cloud, ce qui débloque un certain nombre d'avantages :",
        "benefitSimplerOperations": {
            "title": "Opérations plus simples",
            "description": "Pas besoin de faire tourner votre propre serveur de messagerie ou de configurer des alertes complexes. Vous obtiendrez des contrôles de santé et des alertes de temps d'arrêt par la suite."
@@ -2939,7 +3070,7 @@
    "learnMore": "En savoir plus",
    "backToHome": "Retour à l'accueil",
    "needToSignInToOrg": "Besoin d'utiliser le fournisseur d'identité de votre organisation ?",
-    "maintenanceMode": "Mode de maintenance",
+    "maintenanceMode": "Page de maintenance",
    "maintenanceModeDescription": "Afficher une page de maintenance aux visiteurs",
    "maintenanceModeType": "Type de mode de maintenance",
    "showMaintenancePage": "Afficher une page de maintenance aux visiteurs",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Achèvement estimé :",
    "createInternalResourceDialogDestinationRequired": "La destination est requise",
    "available": "Disponible",
+    "disabledResourceDescription": "Lorsqu'il est désactivé, la ressource sera inaccessible pour tout le monde.",
    "archived": "Archivé",
    "noArchivedDevices": "Aucun périphérique archivé trouvé",
    "deviceArchived": "Appareil archivé",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Ressource désactivée",
    "memberPortalShowingResources": "Affichage de {start}-{end} sur {total} ressources",
    "memberPortalPrevious": "Précédent",
-    "memberPortalNext": "Suivant"
+    "memberPortalNext": "Suivant",
+    "httpSettings": "Paramètres HTTP",
+    "tcpSettings": "Paramètres TCP",
+    "udpSettings": "Paramètres UDP",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Établissement d'une connexion sécurisée…",
+    "sshConnecting": "Connexion…",
+    "sshInitializing": "Initialisation…",
+    "sshSignInTitle": "Se connecter à SSH",
+    "sshSignInDescription": "Entrez vos identifiants SSH",
+    "sshPasswordTab": "Mot de passe",
+    "sshPrivateKeyTab": "Clé Privée",
+    "sshPrivateKeyField": "Clé Privée",
+    "sshPrivateKeyDisclaimer": "Votre clé privée n'est pas stockée ou visible par Pangolin. Alternativement, vous pouvez utiliser des certificats de courte durée pour une authentification transparente utilisant votre identité Pangolin existante.",
+    "sshLearnMore": "En savoir plus",
+    "sshPrivateKeyFile": "Fichier de Clé Privée",
+    "sshAuthenticate": "Authentifier",
+    "sshTerminate": "Terminer",
+    "sshPoweredBy": "Propulsé par",
+    "sshErrorNoTarget": "Aucune cible spécifiée",
+    "sshErrorWebSocket": "Échec de la connexion WebSocket",
+    "sshErrorAuthFailed": "Échec de l'authentification",
+    "sshErrorConnectionClosed": "Connexion fermée avant que l'authentification soit terminée"
 }
--- a/messages/it-IT.json
+++ b/messages/it-IT.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Si è verificato un errore durante la creazione del link di condivisione",
    "shareCreateDescription": "Chiunque con questo link può accedere alla risorsa",
    "shareTitleOptional": "Titolo (facoltativo)",
+    "sharePathOptional": "Percorso (opzionale)",
    "expireIn": "Scadenza In",
    "neverExpire": "Nessuna scadenza",
    "shareExpireDescription": "Il tempo di scadenza indica per quanto tempo il link sarà utilizzabile e fornirà accesso alla risorsa. Dopo questo tempo, il link non funzionerà più e gli utenti che hanno utilizzato questo link perderanno l'accesso alla risorsa.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Cerca risorse...",
    "resourceAdd": "Aggiungi Risorsa",
    "resourceErrorDelte": "Errore nell'eliminare la risorsa",
+    "resourcePoliciesTitle": "Gestisci Politiche sulle Risorse",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Risorse collegate",
+    "resourcePoliciesAttachedResources": "{count} risorsa(e)",
+    "resourcePoliciesAttachedResourcesEmpty": "nessuna risorsa",
+    "resourcePoliciesDescription": "Crea e gestisci le politiche di autenticazione per controllare l'accesso alle tue risorse",
+    "resourcePoliciesSearch": "Cerca politiche...",
+    "resourcePoliciesAdd": "Aggiungi Politica",
+    "resourcePoliciesDefaultBadgeText": "Politica Predefinita",
+    "resourcePoliciesCreate": "Crea Politica Risorse",
+    "resourcePoliciesCreateDescription": "Segui i passaggi seguenti per creare una nuova politica",
+    "resourcePolicyName": "Nome Politica",
+    "resourcePolicyNameDescription": "Dai un nome a questa politica per identificarla tra le tue risorse",
+    "resourcePolicyNamePlaceholder": "es. Politica di Accesso Interno",
+    "resourcePoliciesSeeAll": "Vedi Tutte le Politiche",
+    "resourcePolicyAuthMethodAdd": "Aggiungi Metodo di Autenticazione",
+    "resourcePolicyOtpEmailAdd": "Aggiungi email OTP",
+    "resourcePolicyRulesAdd": "Aggiungi Regole",
+    "resourcePolicyAuthMethodsDescription": "Consenti l'accesso alle risorse tramite metodi di autenticazione aggiuntivi",
+    "resourcePolicyUsersRolesDescription": "Configura quali utenti e ruoli possono visitare le risorse associate",
+    "rulesResourcePolicyDescription": "Configura regole per controllare l'accesso alle risorse associate a questa politica",
    "authentication": "Autenticazione",
    "protected": "Protetto",
    "notProtected": "Non Protetto",
    "resourceMessageRemove": "Una volta rimossa la risorsa non sarà più accessibile. Tutti gli oggetti target associati alla risorsa saranno rimossi.",
    "resourceQuestionRemove": "Sei sicuro di voler rimuovere la risorsa dall'organizzazione?",
+    "resourcePolicyMessageRemove": "Una volta rimossa, la politica delle risorse non sarà più accessibile. Tutte le risorse associate saranno dissociate e rimarranno senza autenticazione.",
+    "resourcePolicyQuestionRemove": "Sei sicuro di voler rimuovere la politica delle risorse dall'organizzazione?",
    "resourceHTTP": "Risorsa HTTPS",
    "resourceHTTPDescription": "Richieste proxy su HTTPS usando un nome di dominio completo.",
    "resourceRaw": "Risorsa Raw TCP/UDP",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Richiesta proxy su TCP/UDP grezzo utilizzando un numero di porta. Richiede siti per connettersi a un nodo remoto.",
    "resourceCreate": "Crea Risorsa",
    "resourceCreateDescription": "Segui i passaggi seguenti per creare una nuova risorsa",
+    "resourceCreateGeneralDescription": "Configura le impostazioni generali delle risorse, inclusi il nome e il tipo",
    "resourceSeeAll": "Vedi Tutte Le Risorse",
-    "resourceInfo": "Informazioni Risorsa",
+    "resourceCreateGeneral": "Generale",
    "resourceNameDescription": "Questo è il nome visualizzato per la risorsa.",
    "siteSelect": "Seleziona sito",
    "siteSearch": "Cerca sito",
@@ -231,12 +255,15 @@
    "noCountryFound": "Nessun paese trovato.",
    "siteSelectionDescription": "Questo sito fornirà connettività all'oggetto target.",
    "resourceType": "Tipo Di Risorsa",
-    "resourceTypeDescription": "Determinare come accedere alla risorsa",
+    "resourceTypeDescription": "Questo controlla il protocollo delle risorse e come verrà reso nel browser. Questo non può essere modificato in seguito.",
+    "resourceDomainDescription": "La risorsa sarà servita su questo dominio completamente qualificato.",
    "resourceHTTPSSettings": "Impostazioni HTTPS",
    "resourceHTTPSSettingsDescription": "Configura come sarà possibile accedere alla risorsa su HTTPS",
+    "resourcePortDescription": "La porta esterna sull'istanza o nodo Pangolin dove la risorsa sarà accessibile.",
    "domainType": "Tipo Di Dominio",
    "subdomain": "Sottodominio",
    "baseDomain": "Dominio Base",
+    "configure": "Configura",
    "subdomnainDescription": "Il sottodominio in cui la risorsa sarà accessibile.",
    "resourceRawSettings": "Impostazioni TCP/UDP",
    "resourceRawSettingsDescription": "Configura come accedere alla risorsa tramite TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Scopri come configurare le risorse TCP/UDP",
    "resourceBack": "Torna alle risorse",
    "resourceGoTo": "Vai alla Risorsa",
+    "resourcePolicyDelete": "Elimina Politica Risorse",
+    "resourcePolicyDeleteConfirm": "Conferma Eliminazione Politica Risorse",
    "resourceDelete": "Elimina Risorsa",
    "resourceDeleteConfirm": "Conferma Eliminazione Risorsa",
+    "labelDelete": "Elimina Etichetta",
+    "labelAdd": "Aggiungi Etichetta",
+    "labelCreateSuccessMessage": "Etichetta Creata con Successo",
+    "labelEditSuccessMessage": "Etichetta Modificata con Successo",
+    "labelNameField": "Nome Etichetta",
+    "labelColorField": "Colore Etichetta",
+    "labelPlaceholder": "Es: homelab",
+    "labelCreate": "Crea Etichetta",
+    "createLabelDialogTitle": "Crea Etichetta",
+    "createLabelDialogDescription": "Crea una nuova etichetta che può essere allegata a questa organizzazione",
+    "labelEdit": "Modifica Etichetta",
+    "editLabelDialogTitle": "Aggiorna Etichetta",
+    "editLabelDialogDescription": "Modifica una nuova etichetta che può essere allegata a questa organizzazione",
+    "labelDeleteConfirm": "Conferma Eliminazione Etichetta",
+    "labelErrorDelete": "Impossibile eliminare l'etichetta",
+    "labelMessageRemove": "Questa azione è permanente. Tutti i siti, le risorse e i clienti associati a questa etichetta verranno dissociati.",
+    "labelQuestionRemove": "Sei sicuro di voler rimuovere l'etichetta dall'organizzazione?",
    "visibility": "Visibilità",
    "enabled": "Abilitato",
    "disabled": "Disabilitato",
@@ -265,6 +311,8 @@
    "rules": "Regole",
    "resourceSettingDescription": "Configura le impostazioni sulla risorsa",
    "resourceSetting": "Impostazioni {resourceName}",
+    "resourcePolicySettingDescription": "Configura le impostazioni sulla politica delle risorse",
+    "resourcePolicySetting": "Impostazioni del sito {policyName}",
    "alwaysAllow": "Bypass Autenticazione",
    "alwaysDeny": "Blocca Accesso",
    "passToAuth": "Passa all'autenticazione",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Nessuna regola. Aggiungi una regola usando il modulo.",
    "rulesOrder": "Le regole sono valutate per priorità in ordine crescente.",
    "rulesSubmit": "Salva Regole",
+    "policyErrorCreate": "Errore nella creazione della politica",
+    "policyErrorCreateDescription": "Si è verificato un errore durante la creazione della politica",
+    "policyErrorCreateMessageDescription": "Si è verificato un errore imprevisto",
+    "policyErrorUpdate": "Errore nell'aggiornamento della politica",
+    "policyErrorUpdateDescription": "Si è verificato un errore durante l'aggiornamento della politica",
+    "policyErrorUpdateMessageDescription": "Si è verificato un errore imprevisto",
+    "policyCreatedSuccess": "Politica risorse creata con successo",
+    "policyUpdatedSuccess": "Politica risorse aggiornata con successo",
+    "authMethodsSave": "Salva metodi di autenticazione",
+    "rulesSave": "Salva Regole",
    "resourceErrorCreate": "Errore nella creazione della risorsa",
    "resourceErrorCreateDescription": "Si è verificato un errore durante la creazione della risorsa",
    "resourceErrorCreateMessage": "Errore nella creazione della risorsa:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Aggiungi Codice PIN",
    "pincodeRemove": "Rimuovi Codice PIN",
    "resourceAuthMethods": "Metodi di Autenticazione",
+    "resourcePolicyAuthMethodsEmpty": "Nessun metodo di autenticazione",
+    "resourcePolicyOtpEmpty": "Nessuna password monouso",
+    "resourcePolicyReadOnly": "Questa politica è sola lettura",
+    "resourcePolicyReadOnlyDescription": "Questa politica delle risorse è condivisa su più risorse, non puoi modificarla in questa pagina.",
+    "editSharedPolicy": "Modifica Politica Condivisa",
+    "resourcePolicyTypeSave": "Salva tipo di risorsa",
+    "resourcePolicySelect": "Seleziona politica delle risorse",
+    "resourcePolicySelectError": "Seleziona una politica delle risorse",
+    "resourcePolicyNotFound": "Politica non trovata",
+    "resourcePolicySearch": "Cerca politiche",
+    "resourcePolicyRulesEmpty": "Nessuna regola di autenticazione",
    "resourceAuthMethodsDescriptions": "Consenti l'accesso alla risorsa tramite metodi di autenticazione aggiuntivi",
    "resourceAuthSettingsSave": "Salvato con successo",
    "resourceAuthSettingsSaveDescription": "Le impostazioni di autenticazione sono state salvate",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Imposta Codice PIN",
    "resourcePincodeSetupTitleDescription": "Imposta un codice PIN per proteggere questa risorsa",
    "resourceRoleDescription": "Gli amministratori possono sempre accedere a questa risorsa.",
+    "resourcePolicySelectTitle": "Politica di Accesso Risorse",
+    "resourcePolicySelectDescription": "Seleziona il tipo di politica delle risorse per l'autenticazione",
+    "resourcePolicyInline": "Politica Inline delle Risorse",
+    "resourcePolicyInlineDescription": "Politica di Accesso limitata solo a questa risorsa",
+    "resourcePolicyShared": "Politica Condivisa delle Risorse",
+    "resourcePolicySharedDescription": "Questa risorsa utilizza una politica condivisa. Le impostazioni a livello di politica (metodi di autenticazione, email whitelist) sono bloccate. Puoi aggiungere regole, ruoli e utenti specifici per la risorsa di seguito.",
    "resourceUsersRoles": "Controlli di Accesso",
    "resourceUsersRolesDescription": "Configura quali utenti e ruoli possono visitare questa risorsa",
    "resourceUsersRolesSubmit": "Salva Controlli di Accesso",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Si è verificato un problema durante la connessione a {name}. Contatta il tuo amministratore.",
    "idpErrorNotFound": "IdP non trovato",
    "inviteInvalid": "Invito Non Valido",
+    "labels": "Etichette",
+    "orgLabelsDescription": "Gestisci le etichette in questa organizzazione.",
+    "addLabels": "Aggiungi etichette",
+    "siteLabelsTab": "Etichette",
+    "siteLabelsDescription": "Gestisci le etichette associate a questo sito.",
+    "labelsNotFound": "Etichette non trovate",
+    "labelSearch": "Cerca etichette",
+    "accessLabelFilterCount": "{count, plural, one {# etichetta} other {# etichette}}",
+    "labelOverflowCount": "+{count, plural, one {# etichetta} other {# etichette}}",
+    "accessLabelFilterClear": "Cancella filtri etichette",
+    "selectColor": "Seleziona colore",
+    "createNewLabel": "Crea nuova etichetta dell'organizzazione \"{label}\"",
    "inviteInvalidDescription": "Il link di invito non è valido.",
    "inviteErrorWrongUser": "L'invito non è per questo utente",
    "inviteErrorUserNotExists": "L'utente non esiste. Si prega di creare prima un account.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Risorse",
    "sidebarProxyResources": "Pubblico",
    "sidebarClientResources": "Privato",
+    "sidebarPolicies": "Politiche",
+    "sidebarResourcePolicies": "Risorse",
    "sidebarAccessControl": "Controllo Accesso",
    "sidebarLogsAndAnalytics": "Registri E Analisi",
    "sidebarTeam": "Squadra",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Sito {id}",
    "standaloneHcFilterResourceIdFallback": "Risorsa {id}",
    "blueprints": "Progetti",
-    "blueprintsDescription": "Applica le configurazioni dichiarative e visualizza le partite precedenti",
+    "blueprintsLog": "Registro Progetti",
+    "blueprintsDescription": "Visualizza le applicazioni passate dei progetti e i loro risultati",
    "blueprintAdd": "Aggiungi Progetto",
    "blueprintGoBack": "Vedi tutti i progetti",
    "blueprintCreate": "Crea Progetto",
@@ -1575,7 +1665,17 @@
    "contents": "Contenuti",
    "parsedContents": "Sommario Analizzato (Solo Lettura)",
    "enableDockerSocket": "Abilita Progetto Docker",
-    "enableDockerSocketDescription": "Abilita la raschiatura dell'etichetta Docker Socket per le etichette dei progetti. Il percorso del socket deve essere fornito a Newt.",
+    "enableDockerSocketDescription": "Abilita lo scraping delle etichette Docker Socket per le etichette dei progetti. Il percorso del socket deve essere fornito al connettore del sito. Leggi come funziona nel <docsLink>documentazione</docsLink>.",
+    "newtAutoUpdate": "Abilita Aggiornamento Automatico del Sito",
+    "newtAutoUpdateDescription": "Quando abilitato, i connettori di sito si aggiorneranno automaticamente all'ultima versione quando è disponibile un nuovo rilascio.",
+    "siteAutoUpdate": "Aggiornamento Automatico del Sito",
+    "siteAutoUpdateLabel": "Abilita Aggiornamento Automatico",
+    "siteAutoUpdateDescription": "Controlla se il connettore di questo sito scarica automaticamente l'ultima versione.",
+    "siteAutoUpdateOrgDefault": "Predefinito dell'organizzazione: {state}",
+    "siteAutoUpdateOverriding": "Sovrascrivere le impostazioni dell'organizzazione",
+    "siteAutoUpdateResetToOrg": "Reimposta al Predefinito dell'Organizzazione",
+    "siteAutoUpdateEnabled": "abilitato",
+    "siteAutoUpdateDisabled": "disabilitato",
    "viewDockerContainers": "Visualizza Contenitori Docker",
    "containersIn": "Contenitori in {siteName}",
    "selectContainerDescription": "Seleziona qualsiasi contenitore da usare come hostname per questo obiettivo. Fai clic su una porta per usare una porta.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Certificato",
    "certificateStatusAutoRefreshHint": "Lo stato si aggiorna automaticamente.",
    "loading": "Caricamento",
+    "loadingEllipsis": "Caricamento...",
    "loadingAnalytics": "Caricamento Delle Analisi",
    "restart": "Riavvia",
    "domains": "Domini",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Gestisci il tuo abbonamento per le chiavi di licenza self-hosted a pagamento",
    "billingCurrentKeys": "Tasti Attuali",
    "billingModifyCurrentPlan": "Modifica Il Piano Corrente",
+    "billingManageLicenseSubscriptionDescription": "Gestisci il tuo abbonamento per le chiavi di licenza autogestite a pagamento e scarica le fatture.",
    "billingConfirmUpgrade": "Conferma Aggiornamento",
    "billingConfirmDowngrade": "Conferma Downgrade",
    "billingConfirmUpgradeDescription": "Stai per aggiornare il tuo piano. Controlla i nuovi limiti e prezzi qui sotto.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Il tempo è in secondi",
    "requireDeviceApproval": "Richiede Approvazioni Dispositivo",
    "requireDeviceApprovalDescription": "Gli utenti con questo ruolo hanno bisogno di nuovi dispositivi approvati da un amministratore prima di poter connettersi e accedere alle risorse.",
-    "sshAccess": "Accesso SSH",
+    "sshSettings": "Impostazioni SSH",
+    "rdpSettings": "Impostazioni RDP",
+    "vncSettings": "Impostazioni VNC",
+    "sshServer": "Server SSH",
+    "rdpServer": "Server RDP",
+    "vncServer": "Server VNC",
+    "sshServerDescription": "Configura il metodo di autenticazione, la posizione del demone e la destinazione del server",
+    "rdpServerDescription": "Configura la destinazione e la porta del server RDP",
+    "vncServerDescription": "Configura la destinazione e la porta del server VNC",
+    "sshServerMode": "Modalità",
+    "sshServerModeStandard": "Server SSH Standard",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Instrada comandi sulla rete a un server SSH come OpenSSH.",
+    "sshServerModeNative": "Server SSH Nativo",
+    "sshServerModeNativeDescription": "Esegue comandi direttamente sull'host tramite il connettore del sito. Non è richiesta la configurazione di rete.",
+    "sshAuthenticationMethod": "Metodo di Autenticazione",
+    "sshAuthMethodManual": "Autenticazione Manuale",
+    "sshAuthMethodManualDescription": "Richiede credenziali host esistenti. Bypassa il provisioning automatico.",
+    "sshAuthMethodAutomated": "Provisioning Automatico",
+    "sshAuthMethodAutomatedDescription": "Crea automaticamente utenti, gruppi e permessi sudo sull'host.",
+    "sshAuthDaemonLocation": "Posizione Daemon Autenticazione",
+    "sshDaemonLocationSiteDescription": "Eseguito localmente sulla macchina che ospita il connettore del sito.",
+    "sshDaemonLocationRemote": "Su Host Remoto",
+    "sshDaemonLocationRemoteDescription": "Eseguito su una macchina target separata nella stessa rete.",
+    "sshDaemonDisclaimer": "Assicurati che l'host target sia correttamente configurato per eseguire il demone di autenticazione prima di completare questa configurazione, altrimenti il provisioning fallirà.",
+    "sshDaemonPort": "Porta Daemon",
+    "sshServerDestination": "Destinazione Server",
+    "sshServerDestinationDescription": "Configura la destinazione e la porta del server SSH",
+    "destination": "Destinazione",
+    "bgTargetMultiSiteDisclaimer": "Selezionare più siti abilita instradamento resiliente e failover per alta disponibilità.",
    "roleAllowSsh": "Consenti SSH",
    "roleAllowSshAllow": "Consenti",
    "roleAllowSshDisallow": "Non Consentire",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "L'utente può eseguire solo i comandi specificati con sudo.",
    "sshSudo": "Consenti sudo",
    "sshSudoCommands": "Comandi Sudo",
-    "sshSudoCommandsDescription": "Elenco di comandi separati da virgole che l'utente può eseguire con sudo.",
+    "sshSudoCommandsDescription": "Elenco separato da virgole di comandi che l'utente è autorizzato a eseguire con sudo. Devono essere utilizzati percorsi assoluti.",
    "sshCreateHomeDir": "Crea Cartella Home",
    "sshUnixGroups": "Gruppi Unix",
    "sshUnixGroupsDescription": "Gruppi Unix separati da virgole per aggiungere l'utente sull'host di destinazione.",
@@ -2051,7 +2182,7 @@
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Metodo HTTP",
-    "editInternalResourceDialogEnableSsl": "Abilitare TLS",
+    "editInternalResourceDialogEnableSsl": "Abilita TLS",
    "editInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
    "editInternalResourceDialogDestination": "Destinazione",
    "editInternalResourceDialogDestinationHostDescription": "L'indirizzo IP o il nome host della risorsa nella rete del sito.",
@@ -2102,7 +2233,7 @@
    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Metodo HTTP",
    "createInternalResourceDialogScheme": "Metodo HTTP",
-    "createInternalResourceDialogEnableSsl": "Abilitare TLS",
+    "createInternalResourceDialogEnableSsl": "Abilita TLS",
    "createInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
    "createInternalResourceDialogDestination": "Destinazione",
    "createInternalResourceDialogDestinationHostDescription": "L'indirizzo IP o il nome host della risorsa nella rete del sito.",
@@ -2939,7 +3070,7 @@
    "learnMore": "Scopri di più",
    "backToHome": "Torna alla home",
    "needToSignInToOrg": "Hai bisogno di utilizzare il provider di identità della tua organizzazione?",
-    "maintenanceMode": "Modalità di Manutenzione",
+    "maintenanceMode": "Pagina di Manutenzione",
    "maintenanceModeDescription": "Visualizza una pagina di manutenzione ai visitatori",
    "maintenanceModeType": "Tipo di Modalità di Manutenzione",
    "showMaintenancePage": "Mostra una pagina di manutenzione ai visitatori",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Completamento Stimato:",
    "createInternalResourceDialogDestinationRequired": "Destinazione richiesta",
    "available": "Disponibile",
+    "disabledResourceDescription": "Quando disabilitato, la risorsa sarà inaccessibile a tutti.",
    "archived": "Archiviato",
    "noArchivedDevices": "Nessun dispositivo archiviato trovato",
    "deviceArchived": "Dispositivo archiviato",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Risorsa Disabilitata",
    "memberPortalShowingResources": "Mostrando {start}-{end} di {total} risorse",
    "memberPortalPrevious": "Precedente",
-    "memberPortalNext": "Successivo"
+    "memberPortalNext": "Successivo",
+    "httpSettings": "Impostazioni HTTP",
+    "tcpSettings": "Impostazioni TCP",
+    "udpSettings": "Impostazioni UDP",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Stabilire una connessione sicura…",
+    "sshConnecting": "Connessione…",
+    "sshInitializing": "Inizializzazione…",
+    "sshSignInTitle": "Accedi a SSH",
+    "sshSignInDescription": "Inserisci le tue credenziali SSH",
+    "sshPasswordTab": "Password",
+    "sshPrivateKeyTab": "Chiave Privata",
+    "sshPrivateKeyField": "Chiave Privata",
+    "sshPrivateKeyDisclaimer": "La tua chiave privata non è memorizzata o visibile a Pangolin. In alternativa, puoi utilizzare certificati a vita breve per un'autenticazione continua utilizzando la tua identità Pangolin esistente.",
+    "sshLearnMore": "Scopri di più",
+    "sshPrivateKeyFile": "File Chiave Privata",
+    "sshAuthenticate": "Autentica",
+    "sshTerminate": "Termina",
+    "sshPoweredBy": "Offerto da",
+    "sshErrorNoTarget": "Nessun obiettivo specificato",
+    "sshErrorWebSocket": "Connessione WebSocket fallita",
+    "sshErrorAuthFailed": "Autenticazione fallita",
+    "sshErrorConnectionClosed": "Connessione chiusa prima del completamento dell'autenticazione"
 }
--- a/messages/ko-KR.json
+++ b/messages/ko-KR.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "공유 링크를 생성하는 동안 오류가 발생했습니다",
    "shareCreateDescription": "이 링크가 있는 누구나 리소스에 접근할 수 있습니다.",
    "shareTitleOptional": "제목 (선택 사항)",
+    "sharePathOptional": "경로 (선택 사항)",
    "expireIn": "만료됨",
    "neverExpire": "만료되지 않음",
    "shareExpireDescription": "만료 시간은 링크가 사용 가능하고 리소스에 접근할 수 있는 기간입니다. 이 시간이 지나면 링크는 더 이상 작동하지 않으며, 이 링크를 사용한 사용자는 리소스에 대한 접근 권한을 잃게 됩니다.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "리소스 검색...",
    "resourceAdd": "리소스 추가",
    "resourceErrorDelte": "리소스 삭제 중 오류 발생",
+    "resourcePoliciesTitle": "리소스 정책 관리",
+    "resourcePoliciesAttachedResourcesColumnTitle": "첨부 리소스",
+    "resourcePoliciesAttachedResources": "{count} 리소스",
+    "resourcePoliciesAttachedResourcesEmpty": "리소스 없음",
+    "resourcePoliciesDescription": "리소스에 대한 접근을 제어할 인증 정책을 생성 및 관리합니다",
+    "resourcePoliciesSearch": "정책 검색...",
+    "resourcePoliciesAdd": "정책 추가",
+    "resourcePoliciesDefaultBadgeText": "기본 정책",
+    "resourcePoliciesCreate": "리소스 정책 생성",
+    "resourcePoliciesCreateDescription": "새로운 정책을 생성하려면 아래 단계들을 따르세요",
+    "resourcePolicyName": "정책 이름",
+    "resourcePolicyNameDescription": "이 정책에 리소스 간에 식별할 이름을 지정합니다",
+    "resourcePolicyNamePlaceholder": "예: 내부 접근 정책",
+    "resourcePoliciesSeeAll": "모든 정책 보기",
+    "resourcePolicyAuthMethodAdd": "인증 방법 추가",
+    "resourcePolicyOtpEmailAdd": "OTP 이메일 추가",
+    "resourcePolicyRulesAdd": "규칙 추가",
+    "resourcePolicyAuthMethodsDescription": "추가 인증 방법을 통해 리소스에 대한 접근을 허용합니다",
+    "resourcePolicyUsersRolesDescription": "어떤 사용자와 역할이 관련된 리소스를 방문할 수 있는지 구성합니다",
+    "rulesResourcePolicyDescription": "이 정책에 연결된 접근 리소스를 제어할 규칙을 구성하세요",
    "authentication": "인증",
    "protected": "보호됨",
    "notProtected": "보호되지 않음",
    "resourceMessageRemove": "제거되면 리소스에 더 이상 접근할 수 없습니다. 리소스와 연결된 모든 대상도 제거됩니다.",
    "resourceQuestionRemove": "조직에서 리소스를 제거하시겠습니까?",
+    "resourcePolicyMessageRemove": "제거되면 리소스 정책에 접근할 수 없습니다. 리소스와 관련된 모든 리소스가 연동되지 않으며 인증 없이 남겨집니다.",
+    "resourcePolicyQuestionRemove": "정말로 조직에서 리소스 정책을 제거하시겠습니까?",
    "resourceHTTP": "HTTPS 리소스",
    "resourceHTTPDescription": "완전한 도메인 이름을 사용해 RAW 또는 HTTPS로 프록시 요청을 수행합니다.",
    "resourceRaw": "원시 TCP/UDP 리소스",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "포트 번호를 사용하여 원격 노드에 연결해야 합니다. 원격 노드에서 리소스를 사용하려면 사용자 지정 도메인을 사용하십시오.",
    "resourceCreate": "리소스 생성",
    "resourceCreateDescription": "아래 단계를 따라 새 리소스를 생성하세요.",
+    "resourceCreateGeneralDescription": "이름 및 유형을 포함한 기본 리소스 설정 구성",
    "resourceSeeAll": "모든 리소스 보기",
-    "resourceInfo": "리소스 정보",
+    "resourceCreateGeneral": "일반",
    "resourceNameDescription": "이것은 리소스의 표시 이름입니다.",
    "siteSelect": "사이트 선택",
    "siteSearch": "사이트 검색",
@@ -231,12 +255,15 @@
    "noCountryFound": "국가를 찾을 수 없습니다.",
    "siteSelectionDescription": "이 사이트는 대상에 대한 연결을 제공합니다.",
    "resourceType": "리소스 유형",
-    "resourceTypeDescription": "리소스에 액세스하는 방법을 결정하세요.",
+    "resourceTypeDescription": "이것은 리소스 프로토콜 및 브라우저에서 렌더링되는 방식에 영향을 줍니다. 나중에 변경할 수 없습니다.",
+    "resourceDomainDescription": "리소스는 숙주 네임에서 제공됩니다.",
    "resourceHTTPSSettings": "HTTPS 설정",
    "resourceHTTPSSettingsDescription": "리소스가 HTTPS로 접근할 수 있는 방식을 구성합니다.",
+    "resourcePortDescription": "리소스에 접근할 수 있는 Pangolin 인스턴스나 노드의 외부 포트입니다.",
    "domainType": "도메인 유형",
    "subdomain": "서브도메인",
    "baseDomain": "기본 도메인",
+    "configure": "구성",
    "subdomnainDescription": "리소스에 접근할 수 있는 하위 도메인입니다.",
    "resourceRawSettings": "TCP/UDP 설정",
    "resourceRawSettingsDescription": "TCP/UDP를 통해 리소스에 접근하는 방법을 구성하세요.",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "TCP/UDP 리소스 구성 방법 알아보기",
    "resourceBack": "리소스로 돌아가기",
    "resourceGoTo": "리소스로 이동",
+    "resourcePolicyDelete": "리소스 정책 삭제",
+    "resourcePolicyDeleteConfirm": "리소스 정책 삭제 확인",
    "resourceDelete": "리소스 삭제",
    "resourceDeleteConfirm": "리소스 삭제 확인",
+    "labelDelete": "레이블 삭제",
+    "labelAdd": "레이블 추가",
+    "labelCreateSuccessMessage": "레이블이 성공적으로 생성되었습니다",
+    "labelEditSuccessMessage": "레이블이 성공적으로 수정되었습니다",
+    "labelNameField": "레이블 이름",
+    "labelColorField": "레이블 색상",
+    "labelPlaceholder": "예: homelab",
+    "labelCreate": "레이블 만들기",
+    "createLabelDialogTitle": "레이블 만들기",
+    "createLabelDialogDescription": "이 조직에 연결할 수 있는 새 레이블을 만듭니다",
+    "labelEdit": "레이블 편집",
+    "editLabelDialogTitle": "레이블 업데이트",
+    "editLabelDialogDescription": "이 조직에 연결할 수 있는 새 레이블을 편집합니다",
+    "labelDeleteConfirm": "레이블 삭제 확인",
+    "labelErrorDelete": "레이블 삭제 실패",
+    "labelMessageRemove": "이 작업은 영구적입니다. 이 레이블과 태그된 모든 사이트, 리소스, 클라이언트의 태그가 제거됩니다.",
+    "labelQuestionRemove": "정말로 조직에서 레이블을 제거하시겠습니까?",
    "visibility": "가시성",
    "enabled": "활성화됨",
    "disabled": "비활성화됨",
@@ -265,6 +311,8 @@
    "rules": "규칙",
    "resourceSettingDescription": "리소스의 설정을 구성하세요.",
    "resourceSetting": "{resourceName} 설정",
+    "resourcePolicySettingDescription": "리소스 정책에 대한 설정을 구성합니다",
+    "resourcePolicySetting": "{policyName} 설정",
    "alwaysAllow": "인증 우회",
    "alwaysDeny": "접근 차단",
    "passToAuth": "인증으로 전달",
@@ -747,6 +795,16 @@
    "rulesNoOne": "규칙이 없습니다. 양식을 사용하여 규칙을 추가하십시오.",
    "rulesOrder": "규칙은 우선 순위에 따라 오름차순으로 평가됩니다.",
    "rulesSubmit": "규칙 저장",
+    "policyErrorCreate": "정책 생성 오류",
+    "policyErrorCreateDescription": "정책 생성 중 오류가 발생했습니다",
+    "policyErrorCreateMessageDescription": "예기치 않은 오류가 발생했습니다",
+    "policyErrorUpdate": "정책 업데이트 오류",
+    "policyErrorUpdateDescription": "정책 업데이트 중 오류가 발생했습니다",
+    "policyErrorUpdateMessageDescription": "예기치 않은 오류가 발생했습니다",
+    "policyCreatedSuccess": "리소스 정책이 성공적으로 생성되었습니다",
+    "policyUpdatedSuccess": "리소스 정책이 성공적으로 업데이트되었습니다",
+    "authMethodsSave": "인증 방법 저장",
+    "rulesSave": "규칙 저장",
    "resourceErrorCreate": "리소스 생성 오류",
    "resourceErrorCreateDescription": "리소스를 생성하는 중 오류가 발생했습니다.",
    "resourceErrorCreateMessage": "리소스 생성 오류:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "PIN 코드 추가",
    "pincodeRemove": "PIN 코드 제거",
    "resourceAuthMethods": "인증 방법",
+    "resourcePolicyAuthMethodsEmpty": "인증 방법 없음",
+    "resourcePolicyOtpEmpty": "일회용 비밀번호 없음",
+    "resourcePolicyReadOnly": "이 정책은 읽기 전용입니다",
+    "resourcePolicyReadOnlyDescription": "이 리소스 정책은 여러 리소스에 걸쳐 공유됩니다. 이 페이지에서는 수정할 수 없습니다.",
+    "editSharedPolicy": "공유 정책 편집",
+    "resourcePolicyTypeSave": "리소스 유형 저장",
+    "resourcePolicySelect": "리소스 정책 선택",
+    "resourcePolicySelectError": "리소스 정책 선택 오류",
+    "resourcePolicyNotFound": "정책을 찾을 수 없습니다",
+    "resourcePolicySearch": "정책 검색",
+    "resourcePolicyRulesEmpty": "인증 규칙 없음",
    "resourceAuthMethodsDescriptions": "추가 인증 방법을 통해 리소스에 대한 액세스 허용",
    "resourceAuthSettingsSave": "성공적으로 저장되었습니다.",
    "resourceAuthSettingsSaveDescription": "인증 설정이 저장되었습니다",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "핀코드 설정",
    "resourcePincodeSetupTitleDescription": "이 리소스를 보호하기 위해 핀 코드를 설정하십시오.",
    "resourceRoleDescription": "관리자는 항상 이 리소스에 접근할 수 있습니다.",
+    "resourcePolicySelectTitle": "리소스 액세스 정책",
+    "resourcePolicySelectDescription": "인증을 위한 리소스 정책 유형을 선택하세요",
+    "resourcePolicyInline": "인라인 리소스 정책",
+    "resourcePolicyInlineDescription": "이 리소스에만 범위가 있는 액세스 정책",
+    "resourcePolicyShared": "공유 리소스 정책",
+    "resourcePolicySharedDescription": "이 리소스는 공유 정책을 사용합니다. 정책 수준 설정(인증 방법, 이메일 화이트리스트)은 잠겨 있습니다. 아래에서 리소스별 규칙, 역할 및 사용자를 추가할 수 있습니다.",
    "resourceUsersRoles": "접근 제어",
    "resourceUsersRolesDescription": "이 리소스를 방문할 수 있는 사용자 및 역할을 구성하십시오",
    "resourceUsersRolesSubmit": "접근 제어 저장",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "{name}에 연결하는 데 문제가 발생했습니다. 관리자에게 문의하십시오.",
    "idpErrorNotFound": "IdP를 찾을 수 없습니다.",
    "inviteInvalid": "유효하지 않은 초대",
+    "labels": "레이블",
+    "orgLabelsDescription": "이 조직의 레이블을 관리합니다.",
+    "addLabels": "레이블 추가",
+    "siteLabelsTab": "레이블",
+    "siteLabelsDescription": "이 사이트와 연결된 레이블을 관리합니다.",
+    "labelsNotFound": "레이블을 찾을 수 없습니다",
+    "labelSearch": "레이블 검색",
+    "accessLabelFilterCount": "{count, plural, other {# 레이블}}",
+    "labelOverflowCount": " +{count, plural, other {# 레이블}}",
+    "accessLabelFilterClear": "레이블 필터 초기화",
+    "selectColor": "색상 선택",
+    "createNewLabel": "새 조직 레이블 \"{label}\" 만들기",
    "inviteInvalidDescription": "초대 링크가 유효하지 않습니다.",
    "inviteErrorWrongUser": "이 초대는 이 사용자에게 해당되지 않습니다",
    "inviteErrorUserNotExists": "사용자가 존재하지 않습니다. 먼저 계정을 생성해 주세요.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "리소스",
    "sidebarProxyResources": "공유",
    "sidebarClientResources": "비공개",
+    "sidebarPolicies": "정책",
+    "sidebarResourcePolicies": "리소스",
    "sidebarAccessControl": "액세스 제어",
    "sidebarLogsAndAnalytics": "로그 및 분석",
    "sidebarTeam": "팀",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "사이트 {id}",
    "standaloneHcFilterResourceIdFallback": "리소스 {id}",
    "blueprints": "청사진",
-    "blueprintsDescription": "선언적 구성을 적용하고 이전 실행을 봅니다",
+    "blueprintsLog": "블루프린트 로그",
+    "blueprintsDescription": "과거 블루프린트 적용 및 결과 보기",
    "blueprintAdd": "청사진 추가",
    "blueprintGoBack": "모든 청사진 보기",
    "blueprintCreate": "청사진 생성",
@@ -1575,7 +1665,17 @@
    "contents": "콘텐츠",
    "parsedContents": "구문 분석된 콘텐츠 (읽기 전용)",
    "enableDockerSocket": "Docker 청사진 활성화",
-    "enableDockerSocketDescription": "블루프린트 레이블을 위한 Docker 소켓 레이블 수집을 활성화합니다. 소켓 경로는 Newt에 제공되어야 합니다.",
+    "enableDockerSocketDescription": "블루프린트 레이블을 위한 Docker 소켓 레이블 스크래핑을 활성화합니다. 소켓 경로는 사이트 커넥터에 제공되어야 합니다. 동작 방법에 대한 자세한 정보는 <docsLink>문서</docsLink>에서 확인하세요.",
+    "newtAutoUpdate": "사이트 자동 업데이트 활성화",
+    "newtAutoUpdateDescription": "활성화되면, 사이트 커넥터는 새 릴리스가 출시될 때 자동으로 최신 버전으로 업데이트됩니다.",
+    "siteAutoUpdate": "사이트 자동 업데이트",
+    "siteAutoUpdateLabel": "자동 업데이트 활성화",
+    "siteAutoUpdateDescription": "이 사이트의 커넥터가 최신 버전을 자동으로 다운로드할지 여부를 제어합니다.",
+    "siteAutoUpdateOrgDefault": "조직 기본값: {state}",
+    "siteAutoUpdateOverriding": "조직 설정 재정의",
+    "siteAutoUpdateResetToOrg": "조직 기본값으로 재설정",
+    "siteAutoUpdateEnabled": "활성화됨",
+    "siteAutoUpdateDisabled": "비활성화됨",
    "viewDockerContainers": "도커 컨테이너 보기",
    "containersIn": "{siteName}의 컨테이너",
    "selectContainerDescription": "이 대상을 위한 호스트 이름으로 사용할 컨테이너를 선택하세요. 포트를 사용하려면 포트를 클릭하세요.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "인증서",
    "certificateStatusAutoRefreshHint": "상태가 자동으로 새로 고쳐집니다.",
    "loading": "로딩 중",
+    "loadingEllipsis": "로딩 중...",
    "loadingAnalytics": "분석 로딩 중",
    "restart": "재시작",
    "domains": "도메인",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "유료 독립 호스트 라이센스 키를 위한 구독 관리",
    "billingCurrentKeys": "현재 키",
    "billingModifyCurrentPlan": "현재 계획 수정",
+    "billingManageLicenseSubscriptionDescription": "유료 셀프호스티드 라이선스 키에 대한 구독을 관리하고 송장을 다운로드합니다.",
    "billingConfirmUpgrade": "업그레이드 확인",
    "billingConfirmDowngrade": "다운그레이드 확인",
    "billingConfirmUpgradeDescription": "계획을 업그레이드하려고 합니다. 아래의 새로운 제한 및 가격을 검토하세요.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "시간은 초 단위입니다",
    "requireDeviceApproval": "장치 승인 요구",
    "requireDeviceApprovalDescription": "이 역할을 가진 사용자는 장치가 연결되기 전에 관리자의 승인이 필요합니다.",
-    "sshAccess": "SSH 접속",
+    "sshSettings": "SSH 설정",
+    "rdpSettings": "RDP 설정",
+    "vncSettings": "VNC 설정",
+    "sshServer": "SSH 서버",
+    "rdpServer": "RDP 서버",
+    "vncServer": "VNC 서버",
+    "sshServerDescription": "인증 방법, 데몬 위치 및 서버 목적지를 설정합니다",
+    "rdpServerDescription": "RDP 서버의 목적지 및 포트를 구성합니다",
+    "vncServerDescription": "VNC 서버의 목적지 및 포트를 구성합니다",
+    "sshServerMode": "모드",
+    "sshServerModeStandard": "표준 SSH 서버",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "네트워크를 통해 OpenSSH와 같은 SSH 서버로 명령을 전달합니다.",
+    "sshServerModeNative": "네이티브 SSH 서버",
+    "sshServerModeNativeDescription": "사이트 커넥터를 통해 호스트에서 직접 명령을 실행합니다. 네트워크 구성이 필요 없습니다.",
+    "sshAuthenticationMethod": "인증 방법",
+    "sshAuthMethodManual": "수동 인증",
+    "sshAuthMethodManualDescription": "기존 호스트 자격 증명이 필요합니다. 자동 프로비저닝을 우회합니다.",
+    "sshAuthMethodAutomated": "자동 프로비저닝",
+    "sshAuthMethodAutomatedDescription": "호스트에 사용자, 그룹 및 sudo 권한을 자동으로 생성합니다.",
+    "sshAuthDaemonLocation": "인증 데몬 위치",
+    "sshDaemonLocationSiteDescription": "사이트 커넥터를 호스팅하는 기계에서 로컬로 실행됩니다.",
+    "sshDaemonLocationRemote": "원격 호스트에서",
+    "sshDaemonLocationRemoteDescription": "같은 네트워크의 별도의 대상 기계에서 실행됩니다.",
+    "sshDaemonDisclaimer": "이 설정을 완료하기 전에 인증 데몬을 실행할 대상 호스트가 적절히 구성되었는지 확인하십시오. 그렇지 않으면 프로비저닝이 실패할 수 있습니다.",
+    "sshDaemonPort": "데몬 포트",
+    "sshServerDestination": "서버 목적지",
+    "sshServerDestinationDescription": "SSH 서버의 목적지 및 포트를 구성합니다",
+    "destination": "대상지",
+    "bgTargetMultiSiteDisclaimer": "여러 사이트를 선택하면 고가용성을 위한 내구성 있는 라우팅 및 장애 조치를 활성화합니다.",
    "roleAllowSsh": "SSH 허용",
    "roleAllowSshAllow": "허용",
    "roleAllowSshDisallow": "허용 안 함",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "사용자는 sudo로 지정된 명령만 실행할 수 있습니다.",
    "sshSudo": "Sudo 허용",
    "sshSudoCommands": "Sudo 명령",
-    "sshSudoCommandsDescription": "사용자가 sudo로 실행할 수 있는 명령어의 쉼표로 구분된 목록입니다.",
+    "sshSudoCommandsDescription": "사용자가 sudo로 실행할 수 있는 명령의 쉼표로 구분된 목록입니다. 절대 경로를 사용해야 합니다.",
    "sshCreateHomeDir": "홈 디렉터리 생성",
    "sshUnixGroups": "유닉스 그룹",
    "sshUnixGroupsDescription": "대상 호스트에서 사용자에게 추가할 유닉스 그룹의 쉼표로 구분된 목록입니다.",
@@ -2235,7 +2366,7 @@
        "description": "더 신뢰할 수 있고 낮은 유지보수의 자체 호스팅 팡골린 서버, 추가 기능 포함",
        "introTitle": "관리 자체 호스팅 팡골린",
        "introDescription": "는 자신의 데이터를 프라이빗하고 자체 호스팅을 유지하면서 더 간단하고 추가적인 신뢰성을 원하는 사람들을 위한 배포 옵션입니다.",
-        "introDetail": "이 옵션을 사용하면 여전히 자신의 팡골린 노드를 운영하고 - 터널, TLS 종료 및 트래픽 모두 서버에 유지됩니다. 차이점은 관리 및 모니터링이 클라우드 대시보드를 통해 처리되어 여러 혜택을 제공합니다.",
+        "introDetail": "이 옵션을 사용하면 여전히 자신의 Pangolin 노드를 운영하고 - 터널, TLS 종료, 트래픽 모두 서버에 유지됩니다. 차이점은 관리 및 모니터링이 클라우드 대시보드를 통해 처리되어 여러 혜택을 제공합니다:",
        "benefitSimplerOperations": {
            "title": "더 간단한 운영",
            "description": "자체 메일 서버를 운영하거나 복잡한 경고를 설정할 필요가 없습니다. 기본적으로 상태 점검 및 다운타임 경고를 받을 수 있습니다."
@@ -2939,7 +3070,7 @@
    "learnMore": "자세히 알아보기",
    "backToHome": "홈으로 돌아가기",
    "needToSignInToOrg": "조직의 아이덴티티 공급자를 사용해야 합니까?",
-    "maintenanceMode": "유지보수 모드",
+    "maintenanceMode": "유지 관리 페이지",
    "maintenanceModeDescription": "방문자에게 유지보수 페이지 표시",
    "maintenanceModeType": "유지보수 모드 유형",
    "showMaintenancePage": "방문자에게 유지보수 페이지 표시",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "예상 완료:",
    "createInternalResourceDialogDestinationRequired": "목적지가 필요합니다.",
    "available": "사용 가능",
+    "disabledResourceDescription": "비활성화되면 리소스에 모든 사람이 접근할 수 없습니다.",
    "archived": "보관된",
    "noArchivedDevices": "보관된 장치가 없습니다.",
    "deviceArchived": "장치가 보관되었습니다.",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "리소스 비활성화됨",
    "memberPortalShowingResources": "{start}-{end} 중 {total}개의 리소스를 표시 중",
    "memberPortalPrevious": "이전",
-    "memberPortalNext": "다음"
+    "memberPortalNext": "다음",
+    "httpSettings": "HTTP 설정",
+    "tcpSettings": "TCP 설정",
+    "udpSettings": "UDP 설정",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "보안 연결 설정 중…",
+    "sshConnecting": "연결 중…",
+    "sshInitializing": "초기화 중…",
+    "sshSignInTitle": "SSH에 로그인",
+    "sshSignInDescription": "SSH 자격 증명을 입력하세요",
+    "sshPasswordTab": "비밀번호",
+    "sshPrivateKeyTab": "개인 키",
+    "sshPrivateKeyField": "개인 키",
+    "sshPrivateKeyDisclaimer": "당신의 개인 키는 Pangolin에 저장되거나 보이지 않습니다. 대신, 기존 Pangolin 신원을 사용하여 매끄러운 인증을 제공하는 단기 인증서를 사용할 수 있습니다.",
+    "sshLearnMore": "자세히 알아보기",
+    "sshPrivateKeyFile": "개인 키 파일",
+    "sshAuthenticate": "인증",
+    "sshTerminate": "종료",
+    "sshPoweredBy": "제공자",
+    "sshErrorNoTarget": "지정된 대상이 없습니다",
+    "sshErrorWebSocket": "WebSocket 연결 실패",
+    "sshErrorAuthFailed": "인증 실패",
+    "sshErrorConnectionClosed": "인증이 완료되기 전에 연결이 닫혔습니다"
 }
--- a/messages/nb-NO.json
+++ b/messages/nb-NO.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Det oppsto en feil ved opprettelse av delingslenken",
    "shareCreateDescription": "Alle med denne lenken får tilgang til ressursen",
    "shareTitleOptional": "Tittel (valgfritt)",
+    "sharePathOptional": "Bane (valgfritt)",
    "expireIn": "Utløper om",
    "neverExpire": "Utløper aldri",
    "shareExpireDescription": "Utløpstid er hvor lenge lenken vil være brukbar og gi tilgang til ressursen. Etter denne tiden vil lenken ikke lenger fungere, og brukere som brukte denne lenken vil miste tilgangen til ressursen.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Søk i ressurser...",
    "resourceAdd": "Legg til ressurs",
    "resourceErrorDelte": "Feil ved sletting av ressurs",
+    "resourcePoliciesTitle": "Administrer Ressurspolitikk",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Vedlagte ressurser",
+    "resourcePoliciesAttachedResources": "{count} ressurs(er)",
+    "resourcePoliciesAttachedResourcesEmpty": "ingen ressurser",
+    "resourcePoliciesDescription": "Opprett og administrer autentiseringsregler for å kontrollere tilgang til dine ressurser",
+    "resourcePoliciesSearch": "Søk etter regler...",
+    "resourcePoliciesAdd": "Legg til policy",
+    "resourcePoliciesDefaultBadgeText": "Standard politisk",
+    "resourcePoliciesCreate": "Opprett Ressurspolitikk",
+    "resourcePoliciesCreateDescription": "Følg trinnene nedenfor for å lage en ny policy",
+    "resourcePolicyName": "Polisnavn",
+    "resourcePolicyNameDescription": "Gi denne policynavnet for å identifisere den på tvers av dine ressurser",
+    "resourcePolicyNamePlaceholder": "f.eks. Intern Tilgangspolicy",
+    "resourcePoliciesSeeAll": "Se Alle Policies",
+    "resourcePolicyAuthMethodAdd": "Legg til Autentiseringsmetode",
+    "resourcePolicyOtpEmailAdd": "Legg til OTP e-poster",
+    "resourcePolicyRulesAdd": "Legg til Regler",
+    "resourcePolicyAuthMethodsDescription": "Tillat tilgang til ressurser via tilleggsauthentiseringsmetoder",
+    "resourcePolicyUsersRolesDescription": "Konfigurer hvilke brukere og roller som kan besøke tilknyttede ressurser",
+    "rulesResourcePolicyDescription": "Konfigurer regler for å kontrollere tilgangen til ressurser som er knyttet til denne policyen",
    "authentication": "Autentisering",
    "protected": "Beskyttet",
    "notProtected": "Ikke beskyttet",
    "resourceMessageRemove": "Når den er fjernet, vil ressursen ikke lenger være tilgjengelig. Alle mål knyttet til ressursen vil også bli fjernet.",
    "resourceQuestionRemove": "Er du sikker på at du vil fjerne ressursen fra organisasjonen?",
+    "resourcePolicyMessageRemove": "Når den er fjernet, vil ressursen ikke lenger være tilgjengelig. Alle ressurser knyttet til ressursen vil bli frakoblet og stå uten autentisering.",
+    "resourcePolicyQuestionRemove": "Er du sikker på at du vil fjerne ressurspolitikken fra organisasjonen?",
    "resourceHTTP": "HTTPS-ressurs",
    "resourceHTTPDescription": "Proxy forespørsler over HTTPS ved å bruke et fullstendig kvalifisert domenenavn.",
    "resourceRaw": "Rå TCP/UDP-ressurs",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Proxy forespørsler om rå TCP/UDP ved hjelp av et portnummer. Krever sider for å koble til en ekstern node.",
    "resourceCreate": "Opprett ressurs",
    "resourceCreateDescription": "Følg trinnene nedenfor for å opprette en ny ressurs",
+    "resourceCreateGeneralDescription": "Konfigurer de grunnleggende ressursinnstillingene inkludert navnet og typen",
    "resourceSeeAll": "Se alle ressurser",
-    "resourceInfo": "Ressursinformasjon",
+    "resourceCreateGeneral": "Generelt",
    "resourceNameDescription": "Dette er visningsnavnet for ressursen.",
    "siteSelect": "Velg område",
    "siteSearch": "Søk i område",
@@ -231,12 +255,15 @@
    "noCountryFound": "Ingen land funnet.",
    "siteSelectionDescription": "Dette området vil gi tilkobling til mål.",
    "resourceType": "Ressurstype",
-    "resourceTypeDescription": "Bestemme hvordan denne ressursen skal brukes",
+    "resourceTypeDescription": "Dette kontrollerer ressursprotokollen og hvordan den vil vises i nettleseren. Dette kan ikke endres senere.",
+    "resourceDomainDescription": "Ressursen vil bli servert på dette fullstendig kvalifiserte domenenavnet.",
    "resourceHTTPSSettings": "HTTPS-innstillinger",
    "resourceHTTPSSettingsDescription": "Konfigurer hvordan ressursen skal nås over HTTPS",
+    "resourcePortDescription": "Den eksterne porten på Pangolin-instansen eller noden der ressursen vil være tilgjengelig.",
    "domainType": "Domenetype",
    "subdomain": "Underdomene",
    "baseDomain": "Grunndomene",
+    "configure": "Konfigurer",
    "subdomnainDescription": "Underdomenet hvor ressursen vil være tilgjengelig.",
    "resourceRawSettings": "TCP/UDP-innstillinger",
    "resourceRawSettingsDescription": "Konfigurer hvordan ressursen vil bli tilgjengelig over TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Lær hvordan å konfigurere TCP/UDP-ressurser",
    "resourceBack": "Tilbake til ressurser",
    "resourceGoTo": "Gå til ressurs",
+    "resourcePolicyDelete": "Slett Ressurspolitikk",
+    "resourcePolicyDeleteConfirm": "Bekreft sletting av ressurspolitikk",
    "resourceDelete": "Slett ressurs",
    "resourceDeleteConfirm": "Bekreft sletting av ressurs",
+    "labelDelete": "Slett etikett",
+    "labelAdd": "Legg til etikett",
+    "labelCreateSuccessMessage": "Etikett opprettet vellykket",
+    "labelEditSuccessMessage": "Etikett endret vellykket",
+    "labelNameField": "Etikettnavn",
+    "labelColorField": "Etikettfarge",
+    "labelPlaceholder": "Eksempel: homelab",
+    "labelCreate": "Opprett etikett",
+    "createLabelDialogTitle": "Opprett etikett",
+    "createLabelDialogDescription": "Opprett en ny etikett som kan knyttes til denne organisasjonen",
+    "labelEdit": "Rediger etikett",
+    "editLabelDialogTitle": "Oppdater etikett",
+    "editLabelDialogDescription": "Rediger en ny etikett som kan knyttes til denne organisasjonen",
+    "labelDeleteConfirm": "Bekreft sletting av etikett",
+    "labelErrorDelete": "Kunne ikke slette etikett",
+    "labelMessageRemove": "Denne handlingen er permanent. Alle steder, ressurser, og klienter tagget med denne etiketten vil bli umerket.",
+    "labelQuestionRemove": "Er du sikker på at du vil fjerne etiketten fra organisasjonen?",
    "visibility": "Synlighet",
    "enabled": "Aktivert",
    "disabled": "Deaktivert",
@@ -265,6 +311,8 @@
    "rules": "Regler",
    "resourceSettingDescription": "Konfigurere innstillingene på ressursen",
    "resourceSetting": "{resourceName} Innstillinger",
+    "resourcePolicySettingDescription": "Konfigurer innstillingene på ressurspolitikken",
+    "resourcePolicySetting": "{policyName} Innstillinger",
    "alwaysAllow": "Omgå Auth",
    "alwaysDeny": "Blokker tilgang",
    "passToAuth": "Pass til Autentisering",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Ingen regler. Legg til en regel ved å bruke skjemaet.",
    "rulesOrder": "Regler evalueres etter prioritet i stigende rekkefølge.",
    "rulesSubmit": "Lagre regler",
+    "policyErrorCreate": "Feil ved opprettelse av policy",
+    "policyErrorCreateDescription": "Det oppstod en feil under opprettelse av policyen",
+    "policyErrorCreateMessageDescription": "En uventet feil oppstod",
+    "policyErrorUpdate": "Feil ved oppdatering av policy",
+    "policyErrorUpdateDescription": "Det oppstod en feil ved oppdatering av policyen",
+    "policyErrorUpdateMessageDescription": "En uventet feil oppstod",
+    "policyCreatedSuccess": "Ressurspolitikken ble opprettet vellykket",
+    "policyUpdatedSuccess": "Ressurspolitikken ble oppdatert vellykket",
+    "authMethodsSave": "Lagre autentiseringsmetoder",
+    "rulesSave": "Lagre Regler",
    "resourceErrorCreate": "Feil under oppretting av ressurs",
    "resourceErrorCreateDescription": "Det oppstod en feil under oppretting av ressursen",
    "resourceErrorCreateMessage": "Feil ved oppretting av ressurs:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Legg til PIN-kode",
    "pincodeRemove": "Fjern PIN-kode",
    "resourceAuthMethods": "Autentiseringsmetoder",
+    "resourcePolicyAuthMethodsEmpty": "Ingen autentiseringsmetode",
+    "resourcePolicyOtpEmpty": "Ingen engangspassord",
+    "resourcePolicyReadOnly": "Denne policyen er kun lesbar",
+    "resourcePolicyReadOnlyDescription": "Denne ressursreglen deles på tvers av flere ressurser, du kan ikke redigere den på denne siden.",
+    "editSharedPolicy": "Rediger Delte Rekvireringer",
+    "resourcePolicyTypeSave": "Lagre Ressurstype",
+    "resourcePolicySelect": "Velg ressurspolitikk",
+    "resourcePolicySelectError": "Velg en ressursregel",
+    "resourcePolicyNotFound": "Policy ikke funnet",
+    "resourcePolicySearch": "Søk etter regler",
+    "resourcePolicyRulesEmpty": "Ingen autentiseringsregler",
    "resourceAuthMethodsDescriptions": "Tillat tilgang til ressursen via ytterligere autentiseringsmetoder",
    "resourceAuthSettingsSave": "Lagret vellykket",
    "resourceAuthSettingsSaveDescription": "Autentiseringsinnstillinger er lagret",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Angi PIN-kode",
    "resourcePincodeSetupTitleDescription": "Sett en pinkode for å beskytte denne ressursen",
    "resourceRoleDescription": "Administratorer har alltid tilgang til denne ressursen.",
+    "resourcePolicySelectTitle": "Ressurstilgangspolitikk",
+    "resourcePolicySelectDescription": "Velg policytype for autentisering",
+    "resourcePolicyInline": "Inline Ressursregler",
+    "resourcePolicyInlineDescription": "Tilgangspolitikk som kun er gyldig for denne ressursen",
+    "resourcePolicyShared": "Delte Ressursregler",
+    "resourcePolicySharedDescription": "Denne ressursen bruker en delt policy. Policyinnstillinger (autentiseringsmetoder, e-post whitelist) er låst. Du kan legge til ressurs-spesifikke regler, roller, og brukere nedenfor.",
    "resourceUsersRoles": "Tilgangskontroller",
    "resourceUsersRolesDescription": "Konfigurer hvilke brukere og roller som har tilgang til denne ressursen",
    "resourceUsersRolesSubmit": "Lagre tilgangskontroller",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Det oppstod et problem med å koble til {name}. Vennligst kontakt din administrator.",
    "idpErrorNotFound": "IdP ikke funnet",
    "inviteInvalid": "Ugyldig invitasjon",
+    "labels": "Etiketter",
+    "orgLabelsDescription": "Administrer etiketter i denne organisasjonen.",
+    "addLabels": "Legg til etiketter",
+    "siteLabelsTab": "Etiketter",
+    "siteLabelsDescription": "Administrer etiketter knyttet til dette nettstedet.",
+    "labelsNotFound": "Etiketter ikke funnet",
+    "labelSearch": "Søk etter etiketter",
+    "accessLabelFilterCount": "{count, plural, one {en etikett} other {# etiketter}}",
+    "labelOverflowCount": "+{count, plural, one {en etikett} other {# etiketter}}",
+    "accessLabelFilterClear": "Fjern etikettfiltre",
+    "selectColor": "Velg farge",
+    "createNewLabel": "Opprett ny org-etikett \"{label}\"",
    "inviteInvalidDescription": "Invitasjonslenken er ugyldig.",
    "inviteErrorWrongUser": "Invitasjonen er ikke for denne brukeren",
    "inviteErrorUserNotExists": "Brukeren eksisterer ikke. Vennligst opprett en konto først.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Ressurser",
    "sidebarProxyResources": "Offentlig",
    "sidebarClientResources": "Privat",
+    "sidebarPolicies": "Retningslinjer",
+    "sidebarResourcePolicies": "Ressurser",
    "sidebarAccessControl": "Tilgangskontroll",
    "sidebarLogsAndAnalytics": "Logger og analyser",
    "sidebarTeam": "Lag",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Område {id}",
    "standaloneHcFilterResourceIdFallback": "Ressurs {id}",
    "blueprints": "Tegninger",
-    "blueprintsDescription": "Bruk deklarative konfigurasjoner og vis tidligere kjøringer",
+    "blueprintsLog": "Blåkopieringslogg",
+    "blueprintsDescription": "Vis tidligere applikasjoner av blåkopier og deres resultater",
    "blueprintAdd": "Legg til blåkopi",
    "blueprintGoBack": "Se alle blåkopier",
    "blueprintCreate": "Opprette mal",
@@ -1575,7 +1665,17 @@
    "contents": "Innhold",
    "parsedContents": "Parastinnhold (kun lese)",
    "enableDockerSocket": "Aktiver Docker blåkopi",
-    "enableDockerSocketDescription": "Aktiver skraping av Docker Socket for blueprint Etiketter. Socket bane må brukes for nye.",
+    "enableDockerSocketDescription": "Aktiver Docker Socket etikett skrubbing for blueprint etiketter. Socket bane må oppgis til nettstedkobleren. Les om hvordan dette fungerer i <docsLink>dokumentasjonen</docsLink>.",
+    "newtAutoUpdate": "Aktiver Automatisk Oppdatering av Nettsted",
+    "newtAutoUpdateDescription": "Når aktivert, vil nettstedskoblere automatisk oppdatere til nyeste versjon når en ny utgave er tilgjengelig.",
+    "siteAutoUpdate": "Automatisk Oppdatering av Nettsted",
+    "siteAutoUpdateLabel": "Aktiver Automatisk Oppdatering",
+    "siteAutoUpdateDescription": "Kontroller om denne sidens kobler automatisk laster ned den nyeste versjonen.",
+    "siteAutoUpdateOrgDefault": "Organisasjon standard: {state}",
+    "siteAutoUpdateOverriding": "Overstyrer organisasjonens innstilling",
+    "siteAutoUpdateResetToOrg": "Tilbakestill til Organisasjonsstandard",
+    "siteAutoUpdateEnabled": "aktivert",
+    "siteAutoUpdateDisabled": "deaktivert",
    "viewDockerContainers": "Vis Docker-containere",
    "containersIn": "Containere i {siteName}",
    "selectContainerDescription": "Velg en hvilken som helst container for å bruke som vertsnavn for dette målet. Klikk på en port for å bruke en port.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Sertifikat",
    "certificateStatusAutoRefreshHint": "Status oppdateres automatisk.",
    "loading": "Laster inn",
+    "loadingEllipsis": "Laster inn...",
    "loadingAnalytics": "Laster inn analyser",
    "restart": "Start på nytt",
    "domains": "Domener",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Administrer abonnementet for betalte lisensnøkler selv hostet",
    "billingCurrentKeys": "Nåværende nøkler",
    "billingModifyCurrentPlan": "Endre gjeldende plan",
+    "billingManageLicenseSubscriptionDescription": "Administrer ditt abonnement for betalte egenvertslisensnøkler og last ned fakturaer.",
    "billingConfirmUpgrade": "Bekreft oppgradering",
    "billingConfirmDowngrade": "Bekreft nedgradering",
    "billingConfirmUpgradeDescription": "Du er i ferd med å oppgradere abonnementet ditt. Gå gjennom de nye grensene og pris nedenfor.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Tid er i sekunder",
    "requireDeviceApproval": "Krev enhetsgodkjenning",
    "requireDeviceApprovalDescription": "Brukere med denne rollen trenger nye enheter godkjent av en admin før de kan koble seg og få tilgang til ressurser.",
-    "sshAccess": "SSH tilgang",
+    "sshSettings": "SSH Innstillinger",
+    "rdpSettings": "RDP Innstillinger",
+    "vncSettings": "VNC Innstillinger",
+    "sshServer": "SSH-server",
+    "rdpServer": "RDP-server",
+    "vncServer": "VNC-server",
+    "sshServerDescription": "Sett opp autentiseringsmetoden, daemonplasseringen, og serverens destinasjon",
+    "rdpServerDescription": "Konfigurer destinasjonen og porten til RDP-serveren",
+    "vncServerDescription": "Konfigurer destinasjonen og porten til VNC-serveren",
+    "sshServerMode": "Modus",
+    "sshServerModeStandard": "Standard SSH-server",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Ruter kommandoer over nettverk til en SSH-server som OpenSSH.",
+    "sshServerModeNative": "Innfødt SSH Server",
+    "sshServerModeNativeDescription": "Utfører kommandoer direkte på verten via Nettsted-kobleren. Ingen nettverkskonfigurasjon kreves.",
+    "sshAuthenticationMethod": "Autentiseringsmetode",
+    "sshAuthMethodManual": "Manuell Autentisering",
+    "sshAuthMethodManualDescription": "Krever eksisterende vertlegitimasjon. Omgår automatisk klargjøring.",
+    "sshAuthMethodAutomated": "Automatisk Klargjøring",
+    "sshAuthMethodAutomatedDescription": "Oppretter automatisk brukere, grupper og sudo-tillatelser på verten.",
+    "sshAuthDaemonLocation": "Autentisering Daemon-plassering",
+    "sshDaemonLocationSiteDescription": "Utføres lokalt på maskinen som er vert for nettstedkobleren.",
+    "sshDaemonLocationRemote": "På Ekstern Vert",
+    "sshDaemonLocationRemoteDescription": "Utføres på en separat målenhet på samme nettverk.",
+    "sshDaemonDisclaimer": "Sørg for at målenheten din er riktig konfigurert for å kjøre autentiseringsdaemon før du fullfører denne oppsettet, eller klargjøring vil mislykkes.",
+    "sshDaemonPort": "Daemon-port",
+    "sshServerDestination": "Serverens Destinasjon",
+    "sshServerDestinationDescription": "Konfigurer destinasjonen og porten til SSH-serveren",
+    "destination": "Destinasjon",
+    "bgTargetMultiSiteDisclaimer": "Ved å velge flere nettsteder aktiveres robust ruting og feilaktig avbrudd for høy tilgjengelighet.",
    "roleAllowSsh": "Tillat SSH",
    "roleAllowSshAllow": "Tillat",
    "roleAllowSshDisallow": "Forby",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Brukeren kan bare kjøre de angitte kommandoene med sudo.",
    "sshSudo": "Tillat sudo",
    "sshSudoCommands": "Sudo kommandoer",
-    "sshSudoCommandsDescription": "Kommaseparert liste med kommandoer brukeren kan kjøre med sudo.",
+    "sshSudoCommandsDescription": "Kommaseparert liste over kommandoer brukeren tillates å kjøre med sudo. Absolutte stier må brukes.",
    "sshCreateHomeDir": "Opprett hjemmappe",
    "sshUnixGroups": "Unix grupper",
    "sshUnixGroupsDescription": "Kommaseparerte Unix grupper for å legge brukeren til på mål-verten.",
@@ -2235,7 +2366,7 @@
        "description": "Sikre og lavvedlikeholdsservere, selvbetjente Pangolin med ekstra klokker, og understell",
        "introTitle": "Administrert Self-Hosted Pangolin",
        "introDescription": "er et alternativ for bruk utviklet for personer som ønsker enkel og ekstra pålitelighet mens de fortsatt holder sine data privat og selvdrevne.",
-        "introDetail": "Med dette valget kjører du fortsatt din egen Pangolin-node - tunneler, TLS-terminering og trafikken ligger på serveren din. Forskjellen er at behandling og overvåking håndteres gjennom vårt skydashbord, som låser opp en rekke fordeler:",
+        "introDetail": "Med dette valget kjører du fortsatt din egen Pangolin-node - tunneler, TLS-terminering, og trafikken ligger på serveren din. Forskjellen er at behandling og overvåking håndteres gjennom vårt sky-dashbord, som låser opp en rekke fordeler:",
        "benefitSimplerOperations": {
            "title": "Enklere operasjoner",
            "description": "Ingen grunn til å kjøre din egen e-postserver eller sette opp kompleks varsling. Du vil få helsesjekk og nedetid varsler ut av boksen."
@@ -2939,7 +3070,7 @@
    "learnMore": "Lær mer",
    "backToHome": "Gå tilbake til start",
    "needToSignInToOrg": "Trenger du å bruke organisasjonens identitetsleverandør?",
-    "maintenanceMode": "Vedlikeholdsmodus",
+    "maintenanceMode": "Vedlikeholdsside",
    "maintenanceModeDescription": "Vis en vedlikeholdsside til besøkende",
    "maintenanceModeType": "Vedlikeholdsmodus type",
    "showMaintenancePage": "Vis en vedlikeholdsside til besøkende",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Estimert ferdigstillelse:",
    "createInternalResourceDialogDestinationRequired": "Destinasjonen er nødvendig",
    "available": "Tilgjengelig",
+    "disabledResourceDescription": "Når deaktivert, vil ressursen være utilgjengelig for alle.",
    "archived": "Arkivert",
    "noArchivedDevices": "Ingen arkiverte enheter funnet",
    "deviceArchived": "Enhet arkivert",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Ressurs deaktivert",
    "memberPortalShowingResources": "Viser {start}-{end} av {total} ressurser",
    "memberPortalPrevious": "Forrige",
-    "memberPortalNext": "Neste"
+    "memberPortalNext": "Neste",
+    "httpSettings": "HTTP Innstillinger",
+    "tcpSettings": "TCP Innstillinger",
+    "udpSettings": "UDP Innstillinger",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Opprette en sikker tilkobling…",
+    "sshConnecting": "Kobler til…",
+    "sshInitializing": "Initialiserer…",
+    "sshSignInTitle": "Logg inn på SSH",
+    "sshSignInDescription": "Oppgi dine SSH-legitimasjoner",
+    "sshPasswordTab": "Passord",
+    "sshPrivateKeyTab": "Privat Nøkkel",
+    "sshPrivateKeyField": "Privat Nøkkel",
+    "sshPrivateKeyDisclaimer": "Din private nøkkel er ikke lagret eller synlig for Pangolin. Alternativt kan du bruke kortevaliderte sertifikater for sømløs autentisering ved å bruke din eksisterende Pangolin-identitet.",
+    "sshLearnMore": "Lær mer",
+    "sshPrivateKeyFile": "Privat Nøkkelfil",
+    "sshAuthenticate": "Autentiser",
+    "sshTerminate": "Avslutt",
+    "sshPoweredBy": "Drevet av",
+    "sshErrorNoTarget": "Ingen mål spesifisert",
+    "sshErrorWebSocket": "WebSocket-tilkobling mislyktes",
+    "sshErrorAuthFailed": "Autentisering mislyktes",
+    "sshErrorConnectionClosed": "Tilkobling avsluttet før autentisering ble fullført"
 }
--- a/messages/nl-NL.json
+++ b/messages/nl-NL.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Fout opgetreden tijdens het maken van de share link",
    "shareCreateDescription": "Iedereen met deze link heeft toegang tot de pagina",
    "shareTitleOptional": "Titel (optioneel)",
+    "sharePathOptional": "Pad (optioneel)",
    "expireIn": "Vervalt in",
    "neverExpire": "Nooit verlopen",
    "shareExpireDescription": "Vervaltijd is hoe lang de link bruikbaar is en geeft toegang tot de bron. Na deze tijd zal de link niet meer werken en zullen gebruikers die deze link hebben gebruikt de toegang tot de pagina verliezen.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Zoek bronnen...",
    "resourceAdd": "Bron toevoegen",
    "resourceErrorDelte": "Fout bij verwijderen document",
+    "resourcePoliciesTitle": "Beheer Bron Beleid",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Bijgevoegde bronnen",
+    "resourcePoliciesAttachedResources": "{count} bron(nen)",
+    "resourcePoliciesAttachedResourcesEmpty": "geen bronnen",
+    "resourcePoliciesDescription": "Maak en beheer authenticatiebeleid om toegang tot uw bronnen te controleren",
+    "resourcePoliciesSearch": "Beleidsregels zoeken...",
+    "resourcePoliciesAdd": "Beleid toevoegen",
+    "resourcePoliciesDefaultBadgeText": "Standaard beleidsregel",
+    "resourcePoliciesCreate": "Creëer Bronbeleid",
+    "resourcePoliciesCreateDescription": "Volg de onderstaande stappen om een nieuw beleid aan te maken",
+    "resourcePolicyName": "Beleidsregelnaam",
+    "resourcePolicyNameDescription": "Geef deze beleidsregel een naam om deze te identificeren in uw bronnen",
+    "resourcePolicyNamePlaceholder": "bijv. Intern Toegangsbeleid",
+    "resourcePoliciesSeeAll": "Zie Alle Beleid",
+    "resourcePolicyAuthMethodAdd": "Authenticatiemethode toevoegen",
+    "resourcePolicyOtpEmailAdd": "OTP e-mails toevoegen",
+    "resourcePolicyRulesAdd": "Regels toevoegen",
+    "resourcePolicyAuthMethodsDescription": "Sta toegang tot bronnen toe via aanvullende authenticatiemethoden",
+    "resourcePolicyUsersRolesDescription": "Bepaal welke gebruikers en rollen geassocieerde bronnen kunnen bezoeken",
+    "rulesResourcePolicyDescription": "Stel regels in om toegang te regelen tot bronnen die zijn gekoppeld aan dit beleid",
    "authentication": "Authenticatie",
    "protected": "Beschermd",
    "notProtected": "Niet beveiligd",
    "resourceMessageRemove": "Eenmaal verwijderd, zal het bestand niet langer toegankelijk zijn. Alle doelen die gekoppeld zijn aan het hulpbron, zullen ook verwijderd worden.",
    "resourceQuestionRemove": "Weet u zeker dat u het document van de organisatie wilt verwijderen?",
+    "resourcePolicyMessageRemove": "Zodra verwijderd, zal het bronbeleid niet langer toegankelijk zijn. Alle met de bron geassocieerde bronnen worden ontkoppeld en zonder authenticatie achtergelaten.",
+    "resourcePolicyQuestionRemove": "Weet u zeker dat u het bronbeleid uit de organisatie wilt verwijderen?",
    "resourceHTTP": "HTTPS bron",
    "resourceHTTPDescription": "Proxyverzoeken via HTTPS met een volledig gekwalificeerde domeinnaam.",
    "resourceRaw": "TCP/UDP bron",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Proxy verzoeken over rauwe TCP/UDP met behulp van een poortnummer. Vereist sites om verbinding te maken met een remote node.",
    "resourceCreate": "Bron maken",
    "resourceCreateDescription": "Volg de onderstaande stappen om een nieuwe bron te maken",
+    "resourceCreateGeneralDescription": "Configureer de basisinstellingen van de bron, inclusief de naam en het type",
    "resourceSeeAll": "Alle bronnen bekijken",
-    "resourceInfo": "Bron informatie",
+    "resourceCreateGeneral": "Algemeen",
    "resourceNameDescription": "Dit is de weergavenaam voor het document.",
    "siteSelect": "Selecteer site",
    "siteSearch": "Zoek site",
@@ -231,12 +255,15 @@
    "noCountryFound": "Geen land gevonden.",
    "siteSelectionDescription": "Deze site zal connectiviteit met het doelwit bieden.",
    "resourceType": "Type bron",
-    "resourceTypeDescription": "Bepaal hoe u toegang wilt tot de bron",
+    "resourceTypeDescription": "Dit bepaalt het bronprotocol en hoe het in de browser wordt weergegeven. Dit kan later niet gewijzigd worden.",
+    "resourceDomainDescription": "De bron zal worden bediend onder deze volledig gekwalificeerde domeinnaam.",
    "resourceHTTPSSettings": "HTTPS instellingen",
    "resourceHTTPSSettingsDescription": "Stel in hoe de bron wordt benaderd via HTTPS",
+    "resourcePortDescription": "De externe poort op de Pangolin-instantie of -node waar de bron toegankelijk zal zijn.",
    "domainType": "Domein type",
    "subdomain": "Subdomein",
    "baseDomain": "Basis domein",
+    "configure": "Configureren",
    "subdomnainDescription": "Het subdomein waar de bron toegankelijk zal zijn.",
    "resourceRawSettings": "TCP/UDP instellingen",
    "resourceRawSettingsDescription": "Stel in hoe de bron wordt benaderd via TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Leer hoe je TCP/UDP bronnen kunt configureren",
    "resourceBack": "Terug naar bronnen",
    "resourceGoTo": "Ga naar Resource",
+    "resourcePolicyDelete": "Verwijder Bronbeleid",
+    "resourcePolicyDeleteConfirm": "Bevestig Verwijderen Bronbeleid",
    "resourceDelete": "Document verwijderen",
    "resourceDeleteConfirm": "Bevestig Verwijderen Document",
+    "labelDelete": "Label verwijderen",
+    "labelAdd": "Label toevoegen",
+    "labelCreateSuccessMessage": "Label succesvol aangemaakt",
+    "labelEditSuccessMessage": "Label succesvol gewijzigd",
+    "labelNameField": "Labelnaam",
+    "labelColorField": "Label kleur",
+    "labelPlaceholder": "Bijv.: homelab",
+    "labelCreate": "Label aanmaken",
+    "createLabelDialogTitle": "Label aanmaken",
+    "createLabelDialogDescription": "Maak een nieuw label aan dat aan deze organisatie kan worden gekoppeld",
+    "labelEdit": "Label bewerken",
+    "editLabelDialogTitle": "Label bijwerken",
+    "editLabelDialogDescription": "Bewerk een nieuw label dat aan deze organisatie kan worden gekoppeld",
+    "labelDeleteConfirm": "Bevestigen Verwijderen Label",
+    "labelErrorDelete": "Kan label niet verwijderen",
+    "labelMessageRemove": "Deze handeling is definitief. Alle sites, bronnen en klanten met dit label zullen worden onttakeld.",
+    "labelQuestionRemove": "Weet u zeker dat u het label uit de organisatie wilt verwijderen?",
    "visibility": "Zichtbaarheid",
    "enabled": "Ingeschakeld",
    "disabled": "Uitgeschakeld",
@@ -265,6 +311,8 @@
    "rules": "Regels",
    "resourceSettingDescription": "Configureer de instellingen in de bron",
    "resourceSetting": "{resourceName} instellingen",
+    "resourcePolicySettingDescription": "Configureer de instellingen op het bronbeleid",
+    "resourcePolicySetting": "{policyName} instellingen",
    "alwaysAllow": "Authenticatie omzeilen",
    "alwaysDeny": "Blokkeer toegang",
    "passToAuth": "Passeren naar Auth",
@@ -630,7 +678,7 @@
    "createdAt": "Aangemaakt op",
    "proxyErrorInvalidHeader": "Ongeldige aangepaste Header waarde. Gebruik het domeinnaam formaat, of sla leeg op om de aangepaste Host header ongedaan te maken.",
    "proxyErrorTls": "Ongeldige TLS servernaam. Gebruik de domeinnaam of sla leeg op om de TLS servernaam te verwijderen.",
-    "proxyEnableSSL": "TLS inschakelen",
+    "proxyEnableSSL": "Schakel TLS in",
    "proxyEnableSSLDescription": "SSL/TLS-versleuteling inschakelen voor beveiligde HTTPS-verbindingen naar de doelen.",
    "target": "Target",
    "configureTarget": "Doelstellingen configureren",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Geen regels. Voeg een regel toe via het formulier.",
    "rulesOrder": "Regels worden in oplopende volgorde volgens prioriteit beoordeeld.",
    "rulesSubmit": "Regels opslaan",
+    "policyErrorCreate": "Fout bij het maken van beleid",
+    "policyErrorCreateDescription": "Er is een fout opgetreden bij het maken van het beleid",
+    "policyErrorCreateMessageDescription": "Er is een onverwachte fout opgetreden",
+    "policyErrorUpdate": "Fout bij het bijwerken van beleid",
+    "policyErrorUpdateDescription": "Er is een fout opgetreden bij het bijwerken van het beleid",
+    "policyErrorUpdateMessageDescription": "Er is een onverwachte fout opgetreden",
+    "policyCreatedSuccess": "Bronbeleid met succes aangemaakt",
+    "policyUpdatedSuccess": "Bronbeleid succesvol bijgewerkt",
+    "authMethodsSave": "Bewaar authenticatiemethoden",
+    "rulesSave": "Regels opslaan",
    "resourceErrorCreate": "Fout bij maken document",
    "resourceErrorCreateDescription": "Er is een fout opgetreden bij het maken van het document",
    "resourceErrorCreateMessage": "Fout bij maken bron:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "PIN-code toevoegen",
    "pincodeRemove": "PIN-code verwijderen",
    "resourceAuthMethods": "Authenticatie methoden",
+    "resourcePolicyAuthMethodsEmpty": "Geen authenticatiemethode",
+    "resourcePolicyOtpEmpty": "Geen eenmalig wachtwoord",
+    "resourcePolicyReadOnly": "Dit beleid is alleen-lezen",
+    "resourcePolicyReadOnlyDescription": "Dit bronbeleid wordt gedeeld over meerdere bronnen, u kunt het niet op deze pagina bewerken.",
+    "editSharedPolicy": "Gedeeld Beleid Bewerken",
+    "resourcePolicyTypeSave": "Bewaar brontype",
+    "resourcePolicySelect": "Selecteer bronbeleid",
+    "resourcePolicySelectError": "Selecteer een bronbeleid",
+    "resourcePolicyNotFound": "Beleid niet gevonden",
+    "resourcePolicySearch": "Beleidsregels zoeken",
+    "resourcePolicyRulesEmpty": "Geen authenticatieregels",
    "resourceAuthMethodsDescriptions": "Sta toegang tot de bron toe via extra autorisatiemethoden",
    "resourceAuthSettingsSave": "Succesvol opgeslagen",
    "resourceAuthSettingsSaveDescription": "Verificatie-instellingen zijn opgeslagen",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Pincode instellen",
    "resourcePincodeSetupTitleDescription": "Stel een pincode in om deze hulpbron te beschermen",
    "resourceRoleDescription": "Beheerders hebben altijd toegang tot deze bron.",
+    "resourcePolicySelectTitle": "Toegangsbeleid voor bronnen",
+    "resourcePolicySelectDescription": "Selecteer het bronbeleidstype voor authenticatie",
+    "resourcePolicyInline": "Inline bronbeleid",
+    "resourcePolicyInlineDescription": "Toegangsbeleid alleen gericht op deze bron",
+    "resourcePolicyShared": "Gedeeld bronbeleid",
+    "resourcePolicySharedDescription": "Deze bron gebruikt een gedeeld beleid. Instellingen op beleidsniveau (authenticatiemethoden, e-mailwhitelist) zijn vergrendeld. U kunt hieronder bron-specifieke regels, rollen en gebruikers toevoegen.",
    "resourceUsersRoles": "Toegang Bediening",
    "resourceUsersRolesDescription": "Configureer welke gebruikers en rollen deze pagina kunnen bezoeken",
    "resourceUsersRolesSubmit": "Bewaar Toegangsbesturing",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Er was een probleem bij het verbinden met {name}. Neem contact op met uw beheerder.",
    "idpErrorNotFound": "IdP niet gevonden",
    "inviteInvalid": "Ongeldige uitnodiging",
+    "labels": "Labels",
+    "orgLabelsDescription": "Beheer labels in deze organisatie.",
+    "addLabels": "Labels toevoegen",
+    "siteLabelsTab": "Labels",
+    "siteLabelsDescription": "Beheer labels geassocieerd met deze site.",
+    "labelsNotFound": "Labels niet gevonden",
+    "labelSearch": "Labels zoeken",
+    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
+    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
+    "accessLabelFilterClear": "Labelfilters wissen",
+    "selectColor": "Kleur selecteren",
+    "createNewLabel": "Nieuw org-label \"{label}\" aanmaken",
    "inviteInvalidDescription": "Uitnodigingslink is ongeldig.",
    "inviteErrorWrongUser": "Uitnodiging is niet voor deze gebruiker",
    "inviteErrorUserNotExists": "Gebruiker bestaat niet. Maak eerst een account aan.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Bronnen",
    "sidebarProxyResources": "Openbaar",
    "sidebarClientResources": "Privé",
+    "sidebarPolicies": "Beleid",
+    "sidebarResourcePolicies": "Bronnen",
    "sidebarAccessControl": "Toegangs controle",
    "sidebarLogsAndAnalytics": "Logs & Analytics",
    "sidebarTeam": "Team",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Site {id}",
    "standaloneHcFilterResourceIdFallback": "Bron {id}",
    "blueprints": "Blauwdrukken",
-    "blueprintsDescription": "Gebruik declaratieve configuraties en bekijk vorige uitvoeringen.",
+    "blueprintsLog": "Log Blueprints",
+    "blueprintsDescription": "Bekijk eerdere blueprint-toepassingen en hun resultaten",
    "blueprintAdd": "Blauwdruk toevoegen",
    "blueprintGoBack": "Bekijk alle Blauwdrukken",
    "blueprintCreate": "Creëer blauwdruk",
@@ -1575,7 +1665,17 @@
    "contents": "Inhoud",
    "parsedContents": "Geparseerde inhoud (alleen lezen)",
    "enableDockerSocket": "Schakel Docker Blauwdruk in",
-    "enableDockerSocketDescription": "Schakel Docker Socket label in voor blauwdruk labels. Pad naar Nieuw.",
+    "enableDockerSocketDescription": "Schakel Docker Socket-label in voor blueprint-labels. Socket-pad moet worden opgegeven aan de siteconnector. Lees meer over hoe dit werkt in <docsLink>de documentatie</docsLink>.",
+    "newtAutoUpdate": "Automatische site-update inschakelen",
+    "newtAutoUpdateDescription": "Wanneer ingeschakeld, zullen site-connectors automatisch updaten naar de nieuwste versie wanneer een nieuwe release beschikbaar is.",
+    "siteAutoUpdate": "Automatische site-update",
+    "siteAutoUpdateLabel": "Automatische update inschakelen",
+    "siteAutoUpdateDescription": "Controleer of de siteconnector automatisch de laatste versie downloadt.",
+    "siteAutoUpdateOrgDefault": "Standaard van organisatie: {state}",
+    "siteAutoUpdateOverriding": "Overschrijving van organisatiestandaardinstelling",
+    "siteAutoUpdateResetToOrg": "Terugzetten naar standaard van organisatie",
+    "siteAutoUpdateEnabled": "ingeschakeld",
+    "siteAutoUpdateDisabled": "uitgeschakeld",
    "viewDockerContainers": "Bekijk Docker containers",
    "containersIn": "Containers in {siteName}",
    "selectContainerDescription": "Selecteer een container om als hostnaam voor dit doel te gebruiken. Klik op een poort om een poort te gebruiken.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Certificaat",
    "certificateStatusAutoRefreshHint": "Status ververst automatisch.",
    "loading": "Bezig met laden",
+    "loadingEllipsis": "Bezig met laden...",
    "loadingAnalytics": "Laden van Analytics",
    "restart": "Herstarten",
    "domains": "Domeinen",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Beheer je abonnement voor betaalde zelf gehoste licentiesleutels",
    "billingCurrentKeys": "Huidige toetsen",
    "billingModifyCurrentPlan": "Huidig plan wijzigen",
+    "billingManageLicenseSubscriptionDescription": "Beheer uw abonnement voor betaalde zelf-gehoste licentiesleutels en download facturen.",
    "billingConfirmUpgrade": "Bevestig Upgrade",
    "billingConfirmDowngrade": "Downgraden bevestigen",
    "billingConfirmUpgradeDescription": "U staat op het punt uw abonnement te upgraden. Controleer de nieuwe limieten en prijzen hieronder.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Tijd is in seconden",
    "requireDeviceApproval": "Vereist goedkeuring van apparaat",
    "requireDeviceApprovalDescription": "Gebruikers met deze rol hebben nieuwe apparaten nodig die door een beheerder zijn goedgekeurd voordat ze verbinding kunnen maken met bronnen en deze kunnen gebruiken.",
-    "sshAccess": "SSH toegang",
+    "sshSettings": "SSH-instellingen",
+    "rdpSettings": "RDP-instellingen",
+    "vncSettings": "VNC-instellingen",
+    "sshServer": "SSH-server",
+    "rdpServer": "RDP-server",
+    "vncServer": "VNC-server",
+    "sshServerDescription": "Stel de authenticatiemethode, demoonlocatie en serverbestemming in",
+    "rdpServerDescription": "Configureer de bestemming en poort van de RDP-server",
+    "vncServerDescription": "Configureer de bestemming en poort van de VNC-server",
+    "sshServerMode": "Modus",
+    "sshServerModeStandard": "Standaard SSH-server",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Opdrachten over netwerk routeren naar een SSH-server zoals OpenSSH.",
+    "sshServerModeNative": "Natuurlijke SSH-server",
+    "sshServerModeNativeDescription": "Voert rechtstreeks opdrachten uit op de host via de Siteconnector. Geen netwerkconfiguratie vereist.",
+    "sshAuthenticationMethod": "Authenticatiemethode",
+    "sshAuthMethodManual": "Handmatige authenticatie",
+    "sshAuthMethodManualDescription": "Vereist bestaande hostreferenties. Omzeilt automatische voorziening.",
+    "sshAuthMethodAutomated": "Automatische voorziening",
+    "sshAuthMethodAutomatedDescription": "Creëert automatisch gebruikers, groepen en sudo-rechten op host.",
+    "sshAuthDaemonLocation": "Auth Daemon Locatie",
+    "sshDaemonLocationSiteDescription": "Wordt lokaal uitgevoerd op de machine die de siteconnector host.",
+    "sshDaemonLocationRemote": "Op Remote Host",
+    "sshDaemonLocationRemoteDescription": "Wordt uitgevoerd op een aparte doelmachine in hetzelfde netwerk.",
+    "sshDaemonDisclaimer": "Zorg ervoor dat uw doelhost goed is geconfigureerd om de auth daemon uit te voeren voordat u deze configuratie voltooit, anders zal de voorziening mislukken.",
+    "sshDaemonPort": "Demonpoort",
+    "sshServerDestination": "Serverbestemming",
+    "sshServerDestinationDescription": "Configureer de bestemming en poort van de SSH-server",
+    "destination": "Bestemming",
+    "bgTargetMultiSiteDisclaimer": "Het selecteren van meerdere sites maakt veerkrachtige routering mogelijk en failover voor hoge beschikbaarheid.",
    "roleAllowSsh": "SSH toestaan",
    "roleAllowSshAllow": "Toestaan",
    "roleAllowSshDisallow": "Weigeren",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Gebruiker kan alleen de opgegeven commando's uitvoeren met de sudo.",
    "sshSudo": "sudo toestaan",
    "sshSudoCommands": "Sudo Commando's",
-    "sshSudoCommandsDescription": "Komma's gescheiden lijst van commando's waar de gebruiker een sudo mee mag uitvoeren.",
+    "sshSudoCommandsDescription": "Commagescheiden lijst van commando's die de gebruiker met sudo mag uitvoeren. Absolute paden moeten worden gebruikt.",
    "sshCreateHomeDir": "Maak Home Directory",
    "sshUnixGroups": "Unix groepen",
    "sshUnixGroupsDescription": "Door komma's gescheiden Unix-groepen om de gebruiker toe te voegen aan de doelhost.",
@@ -2051,7 +2182,7 @@
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schema",
-    "editInternalResourceDialogEnableSsl": "TLS inschakelen",
+    "editInternalResourceDialogEnableSsl": "Schakel TLS in",
    "editInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
    "editInternalResourceDialogDestination": "Bestemming",
    "editInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
@@ -2102,7 +2233,7 @@
    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schema",
    "createInternalResourceDialogScheme": "Schema",
-    "createInternalResourceDialogEnableSsl": "TLS inschakelen",
+    "createInternalResourceDialogEnableSsl": "Schakel TLS in",
    "createInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
    "createInternalResourceDialogDestination": "Bestemming",
    "createInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
@@ -2235,7 +2366,7 @@
        "description": "betrouwbaardere en slecht onderhouden Pangolin server met extra klokken en klokkenluiders",
        "introTitle": "Beheerde zelfgehoste pangolin",
        "introDescription": "is een implementatieoptie ontworpen voor mensen die eenvoud en extra betrouwbaarheid willen, terwijl hun gegevens privé en zelf georganiseerd blijven.",
-        "introDetail": "Met deze optie beheert u nog steeds uw eigen Pangolin node - uw tunnels, TLS-verbinding en verkeer alles op uw server. Het verschil is dat beheer en monitoring worden behandeld via onze cloud dashboard, wat een aantal voordelen oplevert:",
+        "introDetail": "Met deze optie beheert u nog steeds uw eigen Pangolin-node - uw tunnels, TLS-terminatie en verkeer blijven allemaal op uw server. Het verschil is dat beheer en monitoring worden afgehandeld via ons cloud-dashboard, wat een aantal voordelen oplevert:",
        "benefitSimplerOperations": {
            "title": "Simpler operaties",
            "description": "Je hoeft geen eigen mailserver te draaien of complexe waarschuwingen in te stellen. Je krijgt gezondheidscontroles en downtime meldingen uit de box."
@@ -2939,7 +3070,7 @@
    "learnMore": "Meer informatie",
    "backToHome": "Ga terug naar startpagina",
    "needToSignInToOrg": "Moet u de identiteit provider van uw organisatie gebruiken?",
-    "maintenanceMode": "Onderhoudsmodus",
+    "maintenanceMode": "Onderhoudspagina",
    "maintenanceModeDescription": "Toon een onderhoudspagina aan bezoekers",
    "maintenanceModeType": "Type onderhoudsmodus",
    "showMaintenancePage": "Toon een onderhoudspagina aan bezoekers",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Geschatte voltooiing:",
    "createInternalResourceDialogDestinationRequired": "Bestemming is vereist",
    "available": "Beschikbaar",
+    "disabledResourceDescription": "Wanneer uitgeschakeld, zal de bron voor iedereen ontoegankelijk zijn.",
    "archived": "Gearchiveerd",
    "noArchivedDevices": "Geen gearchiveerde apparaten gevonden",
    "deviceArchived": "Apparaat gearchiveerd",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Bron Uitgeschakeld",
    "memberPortalShowingResources": "Toont {start}-{end} van {total} bronnen",
    "memberPortalPrevious": "Vorige",
-    "memberPortalNext": "Volgende"
+    "memberPortalNext": "Volgende",
+    "httpSettings": "HTTP-instellingen",
+    "tcpSettings": "TCP-instellingen",
+    "udpSettings": "UDP-instellingen",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Veilige verbinding tot stand brengen…",
+    "sshConnecting": "Verbinding maken…",
+    "sshInitializing": "Initialiseren…",
+    "sshSignInTitle": "Meld u aan bij SSH",
+    "sshSignInDescription": "Voer uw SSH-referenties in",
+    "sshPasswordTab": "Wachtwoord",
+    "sshPrivateKeyTab": "Privésleutel",
+    "sshPrivateKeyField": "Privésleutel",
+    "sshPrivateKeyDisclaimer": "Uw privésleutel wordt niet opgeslagen of zichtbaar gemaakt voor Pangolin. U kunt ook gebruik maken van kortlopende certificaten voor naadloze authenticatie met uw bestaande Pangolin-identiteit.",
+    "sshLearnMore": "Meer informatie",
+    "sshPrivateKeyFile": "Bestand met privésleutel",
+    "sshAuthenticate": "Authenticeren",
+    "sshTerminate": "Beëindigen",
+    "sshPoweredBy": "Aangeboden door",
+    "sshErrorNoTarget": "Geen doelwit gespecificeerd",
+    "sshErrorWebSocket": "WebSocket-verbinding is mislukt",
+    "sshErrorAuthFailed": "Authenticatie mislukt",
+    "sshErrorConnectionClosed": "Verbinding gesloten voordat authenticatie was voltooid"
 }
--- a/messages/pl-PL.json
+++ b/messages/pl-PL.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Wystąpił błąd podczas tworzenia linku udostępniania",
    "shareCreateDescription": "Każdy z tym linkiem może uzyskać dostęp do zasobu",
    "shareTitleOptional": "Tytuł (opcjonalnie)",
+    "sharePathOptional": "Ścieżka (opcjonalnie)",
    "expireIn": "Wygasa za",
    "neverExpire": "Nigdy nie wygasa",
    "shareExpireDescription": "Czas wygaśnięcia to jak długo link będzie mógł być użyty i zapewni dostęp do zasobu. Po tym czasie link nie będzie już działał, a użytkownicy, którzy użyli tego linku, utracą dostęp do zasobu.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Szukaj zasobów...",
    "resourceAdd": "Dodaj zasób",
    "resourceErrorDelte": "Błąd podczas usuwania zasobu",
+    "resourcePoliciesTitle": "Zarządzaj politykami zasobów",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Dołączone zasoby",
+    "resourcePoliciesAttachedResources": "{count} zasób(y)",
+    "resourcePoliciesAttachedResourcesEmpty": "brak zasobów",
+    "resourcePoliciesDescription": "Twórz i zarządzaj politykami uwierzytelniania, aby kontrolować dostęp do swoich zasobów",
+    "resourcePoliciesSearch": "Szukaj polityk...",
+    "resourcePoliciesAdd": "Dodaj politykę",
+    "resourcePoliciesDefaultBadgeText": "Domyślna polityka",
+    "resourcePoliciesCreate": "Utwórz politykę zasobu",
+    "resourcePoliciesCreateDescription": "Wykonaj poniższe kroki, aby utworzyć nową politykę",
+    "resourcePolicyName": "Nazwa polityki",
+    "resourcePolicyNameDescription": "Nadaj tej polityce nazwę, aby można ją było zidentyfikować w całych zasobach",
+    "resourcePolicyNamePlaceholder": "np. Polityka Dostępu Wewnętrznego",
+    "resourcePoliciesSeeAll": "Zobacz wszystkie polityki",
+    "resourcePolicyAuthMethodAdd": "Dodaj metodę uwierzytelniania",
+    "resourcePolicyOtpEmailAdd": "Dodaj OTP e-maile",
+    "resourcePolicyRulesAdd": "Dodaj zasady",
+    "resourcePolicyAuthMethodsDescription": "Zezwól na dostęp do zasobu poprzez dodatkowe metody uwierzytelniania",
+    "resourcePolicyUsersRolesDescription": "Skonfiguruj, którzy użytkownicy i role mogą odwiedzać powiązane zasoby",
+    "rulesResourcePolicyDescription": "Skonfiguruj zasady, aby kontrolować zasoby dostępne w ramach tej polityki",
    "authentication": "Uwierzytelnianie",
    "protected": "Chronione",
    "notProtected": "Niechronione",
    "resourceMessageRemove": "Po usunięciu zasób nie będzie już dostępny. Wszystkie cele związane z zasobem zostaną również usunięte.",
    "resourceQuestionRemove": "Czy na pewno chcesz usunąć zasób z organizacji?",
+    "resourcePolicyMessageRemove": "Po usunięciu polityka zasobów nie będzie już dostępna. Wszystkie zasoby połączone z zasobem zostaną odłączone i pozostawione bez uwierzytelniania.",
+    "resourcePolicyQuestionRemove": "Czy na pewno chcesz usunąć politykę zasobu z organizacji?",
    "resourceHTTP": "Zasób HTTPS",
    "resourceHTTPDescription": "Proxy zapytań przez HTTPS przy użyciu w pełni kwalifikowanej nazwy domeny.",
    "resourceRaw": "Surowy zasób TCP/UDP",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Żądania proxy nad surowym TCP/UDP przy użyciu numeru portu. Wymaga stron aby połączyć się ze zdalnym węzłem.",
    "resourceCreate": "Utwórz zasób",
    "resourceCreateDescription": "Wykonaj poniższe kroki, aby utworzyć nowy zasób",
+    "resourceCreateGeneralDescription": "Skonfiguruj podstawowe ustawienia zasobu, w tym nazwę i typ",
    "resourceSeeAll": "Zobacz wszystkie zasoby",
-    "resourceInfo": "Informacje o zasobach",
+    "resourceCreateGeneral": "Ogólny",
    "resourceNameDescription": "To jest wyświetlana nazwa zasobu.",
    "siteSelect": "Wybierz witrynę",
    "siteSearch": "Szukaj witryny",
@@ -231,12 +255,15 @@
    "noCountryFound": "Nie znaleziono kraju.",
    "siteSelectionDescription": "Ta strona zapewni połączenie z celem.",
    "resourceType": "Typ zasobu",
-    "resourceTypeDescription": "Określ jak uzyskać dostęp do zasobu",
+    "resourceTypeDescription": "To kontroluje protokół zasobu i sposób jego renderowania w przeglądarce. Później nie można tego zmienić.",
+    "resourceDomainDescription": "Zasób będzie udostępniany pod tym w pełni kwalifikowanym adresem domenowym.",
    "resourceHTTPSSettings": "Ustawienia HTTPS",
    "resourceHTTPSSettingsDescription": "Skonfiguruj jak zasób będzie dostępny przez HTTPS",
+    "resourcePortDescription": "Zewnętrzny port na instancji lub węźle Pangolina, gdzie zasób będzie dostępny.",
    "domainType": "Typ domeny",
    "subdomain": "Poddomena",
    "baseDomain": "Bazowa domena",
+    "configure": "Konfiguracja",
    "subdomnainDescription": "Poddomena, w której zasób będzie dostępny.",
    "resourceRawSettings": "Ustawienia TCP/UDP",
    "resourceRawSettingsDescription": "Skonfiguruj jak zasób będzie dostępny przez TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Dowiedz się, jak skonfigurować zasoby TCP/UDP",
    "resourceBack": "Powrót do zasobów",
    "resourceGoTo": "Przejdź do zasobu",
+    "resourcePolicyDelete": "Usuń politykę zasobu",
+    "resourcePolicyDeleteConfirm": "Potwierdź usunięcie polityki zasobu",
    "resourceDelete": "Usuń zasób",
    "resourceDeleteConfirm": "Potwierdź usunięcie zasobu",
+    "labelDelete": "Usuń etykietę",
+    "labelAdd": "Dodaj etykietę",
+    "labelCreateSuccessMessage": "Etykieta została utworzona pomyślnie",
+    "labelEditSuccessMessage": "Etykieta została pomyślnie zmodyfikowana",
+    "labelNameField": "Nazwa etykiety",
+    "labelColorField": "Kolor etykiety",
+    "labelPlaceholder": "Np.: homelab",
+    "labelCreate": "Utwórz etykietę",
+    "createLabelDialogTitle": "Utwórz etykietę",
+    "createLabelDialogDescription": "Utwórz nową etykietę, która może być przypisana do tej organizacji",
+    "labelEdit": "Edytuj etykietę",
+    "editLabelDialogTitle": "Aktualizuj etykietę",
+    "editLabelDialogDescription": "Edytuj nową etykietę, która może być przypisana do tej organizacji",
+    "labelDeleteConfirm": "Potwierdź usunięcie etykiety",
+    "labelErrorDelete": "Nie udało się usunąć etykiety",
+    "labelMessageRemove": "To działanie jest nieodwracalne. Wszystkie strony, zasoby i klienci oznaczeni tą etykietą zostaną odznaczeni.",
+    "labelQuestionRemove": "Czy na pewno chcesz usunąć etykietę z organizacji?",
    "visibility": "Widoczność",
    "enabled": "Włączone",
    "disabled": "Wyłączone",
@@ -265,6 +311,8 @@
    "rules": "Regulamin",
    "resourceSettingDescription": "Skonfiguruj ustawienia zasobu",
    "resourceSetting": "Ustawienia {resourceName}",
+    "resourcePolicySettingDescription": "Skonfiguruj ustawienia w polityce zasobów",
+    "resourcePolicySetting": "Ustawienia {policyName}",
    "alwaysAllow": "Omijanie uwierzytelniania",
    "alwaysDeny": "Blokuj dostęp",
    "passToAuth": "Przekaż do Autoryzacji",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Brak reguł. Dodaj regułę używając formularza.",
    "rulesOrder": "Reguły są oceniane według priorytetu w kolejności rosnącej.",
    "rulesSubmit": "Zapisz reguły",
+    "policyErrorCreate": "Błąd przy tworzeniu polityki",
+    "policyErrorCreateDescription": "Wystąpił błąd podczas tworzenia polityki",
+    "policyErrorCreateMessageDescription": "Wystąpił nieoczekiwany błąd",
+    "policyErrorUpdate": "Błąd przy aktualizacji polityki",
+    "policyErrorUpdateDescription": "Wystąpił błąd podczas aktualizacji polityki",
+    "policyErrorUpdateMessageDescription": "Wystąpił nieoczekiwany błąd",
+    "policyCreatedSuccess": "Polityka zasobów została pomyślnie utworzona",
+    "policyUpdatedSuccess": "Polityka zasobów została pomyślnie zaktualizowana",
+    "authMethodsSave": "Zapisz metody uwierzytelniania",
+    "rulesSave": "Zapisz zasady",
    "resourceErrorCreate": "Błąd podczas tworzenia zasobu",
    "resourceErrorCreateDescription": "Wystąpił błąd podczas tworzenia zasobu",
    "resourceErrorCreateMessage": "Błąd podczas tworzenia zasobu:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Dodaj kod PIN",
    "pincodeRemove": "Usuń kod PIN",
    "resourceAuthMethods": "Metody uwierzytelniania",
+    "resourcePolicyAuthMethodsEmpty": "Brak metody uwierzytelniania",
+    "resourcePolicyOtpEmpty": "Brak jednorazowego hasła",
+    "resourcePolicyReadOnly": "Ta polityka jest tylko do odczytu",
+    "resourcePolicyReadOnlyDescription": "Ta polityka zasobów jest dzielona pomiędzy wieloma zasobami, nie możesz jej edytować na tej stronie.",
+    "editSharedPolicy": "Edytuj Dzieleną Politykę",
+    "resourcePolicyTypeSave": "Zapisz typ zasobu",
+    "resourcePolicySelect": "Wybierz politykę zasobów",
+    "resourcePolicySelectError": "Wybierz politykę zasobów",
+    "resourcePolicyNotFound": "Nie znaleziono polityki",
+    "resourcePolicySearch": "Szukaj polityki",
+    "resourcePolicyRulesEmpty": "Brak zasad uwierzytelniania",
    "resourceAuthMethodsDescriptions": "Zezwól na dostęp do zasobu przez dodatkowe metody uwierzytelniania",
    "resourceAuthSettingsSave": "Zapisano pomyślnie",
    "resourceAuthSettingsSaveDescription": "Ustawienia uwierzytelniania zostały zapisane",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Ustaw kod PIN",
    "resourcePincodeSetupTitleDescription": "Ustaw kod PIN, aby chronić ten zasób",
    "resourceRoleDescription": "Administratorzy zawsze mają dostęp do tego zasobu.",
+    "resourcePolicySelectTitle": "Polityka dostępu do zasobów",
+    "resourcePolicySelectDescription": "Wybierz typ polityki zasobów do uwierzytelniania",
+    "resourcePolicyInline": "Warunkowa polityka zasobów",
+    "resourcePolicyInlineDescription": "Polityka dostępu tylko do tego zasobu",
+    "resourcePolicyShared": "Dzielona polityka zasobów",
+    "resourcePolicySharedDescription": "Ten zasób korzysta z dzielonej polityki. Ustawienia na poziomie polityki (metody uwierzytelniania, biała lista e-maili) są zablokowane. Możesz dodać zasady specyficzne dla zasobów, role i użytkowników poniżej.",
    "resourceUsersRoles": "Kontrola dostępu",
    "resourceUsersRolesDescription": "Skonfiguruj, którzy użytkownicy i role mogą odwiedzać ten zasób",
    "resourceUsersRolesSubmit": "Zapisz kontrole dostępu",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Wystąpił problem z połączeniem z {name}. Skontaktuj się z administratorem.",
    "idpErrorNotFound": "Nie znaleziono IdP",
    "inviteInvalid": "Nieprawidłowe zaproszenie",
+    "labels": "Etykiety",
+    "orgLabelsDescription": "Zarządzaj etykietami w tej organizacji.",
+    "addLabels": "Dodaj etykiety",
+    "siteLabelsTab": "Etykiety",
+    "siteLabelsDescription": "Zarządzaj etykietami powiązanymi z tą stroną.",
+    "labelsNotFound": "Nie znaleziono etykiet",
+    "labelSearch": "Szukaj etykiet",
+    "accessLabelFilterCount": "{count, plural, one {# etykieta} few {# etykiety} many {# etykiet} other {# etykiet}}",
+    "labelOverflowCount": "+{count, plural, one {# etykieta} few {# etykiety} many {# etykiet} other {# etykiet}}",
+    "accessLabelFilterClear": "Wyczyść filtry etykiet",
+    "selectColor": "Wybierz kolor",
+    "createNewLabel": "Utwórz nową etykietę org \"{label}\"",
    "inviteInvalidDescription": "Link zapraszający jest nieprawidłowy.",
    "inviteErrorWrongUser": "Zaproszenie nie jest dla tego użytkownika",
    "inviteErrorUserNotExists": "Użytkownik nie istnieje. Najpierw utwórz konto.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Zasoby",
    "sidebarProxyResources": "Publiczne",
    "sidebarClientResources": "Prywatny",
+    "sidebarPolicies": "Polityki",
+    "sidebarResourcePolicies": "Zasoby",
    "sidebarAccessControl": "Kontrola dostępu",
    "sidebarLogsAndAnalytics": "Logi i Analityki",
    "sidebarTeam": "Drużyna",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Witryna {id}",
    "standaloneHcFilterResourceIdFallback": "Zasób {id}",
    "blueprints": "Schematy",
-    "blueprintsDescription": "Zastosuj konfiguracje deklaracyjne i wyświetl poprzednie operacje",
+    "blueprintsLog": "Dziennik szablonów",
+    "blueprintsDescription": "Zobacz wcześniejsze zastosowania szablonów i ich wyniki",
    "blueprintAdd": "Dodaj schemat",
    "blueprintGoBack": "Zobacz wszystkie schematy",
    "blueprintCreate": "Utwórz schemat",
@@ -1575,7 +1665,17 @@
    "contents": "Treść",
    "parsedContents": "Przetworzona zawartość (tylko do odczytu)",
    "enableDockerSocket": "Włącz schemat dokera",
-    "enableDockerSocketDescription": "Włącz etykietowanie kieszeni dokującej dla etykiet schematów. Ścieżka do gniazda musi być dostarczona do Newt.",
+    "enableDockerSocketDescription": "Włącz etykietowanie gniazda dokera dla etykiet szablonów. Ścieżka do gniazda musi być dostarczona do łącznika strony. Przeczytaj zarówno jak to działa w <docsLink>dokumentacji</docsLink>.",
+    "newtAutoUpdate": "Włącz automatyczną aktualizację witryny",
+    "newtAutoUpdateDescription": "Kiedy włączone, łączniki witryn będą się automatycznie aktualizować do najnowszej wersji, gdy dostępne będzie nowe wydanie.",
+    "siteAutoUpdate": "Automatyczna aktualizacja strony",
+    "siteAutoUpdateLabel": "Włącz aktualizacje automatyczne",
+    "siteAutoUpdateDescription": "Kontroluj czy łącznik tej strony automatycznie pobiera najnowszą wersję.",
+    "siteAutoUpdateOrgDefault": "Domyślnie dla organizacji: {state}",
+    "siteAutoUpdateOverriding": "Nadpisywanie ustawień organizacji",
+    "siteAutoUpdateResetToOrg": "Zresetuj do domyślnych ustawień organizacji",
+    "siteAutoUpdateEnabled": "włączone",
+    "siteAutoUpdateDisabled": "wyłączone",
    "viewDockerContainers": "Zobacz kontenery dokujące",
    "containersIn": "Pojemniki w {siteName}",
    "selectContainerDescription": "Wybierz dowolny kontener do użycia jako nazwa hosta dla tego celu. Kliknij port, aby użyć portu.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Certyfikat",
    "certificateStatusAutoRefreshHint": "Status odświeża się automatycznie.",
    "loading": "Ładowanie",
+    "loadingEllipsis": "Ładowanie...",
    "loadingAnalytics": "Ładowanie Analityki",
    "restart": "Uruchom ponownie",
    "domains": "Domeny",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Zarządzaj subskrypcją płatnych własnych kluczy licencyjnych",
    "billingCurrentKeys": "Bieżące klucze",
    "billingModifyCurrentPlan": "Modyfikuj bieżący plan",
+    "billingManageLicenseSubscriptionDescription": "Zarządzaj swoją subskrypcją dla płatnych kluczy licencyjnych na samoobsługowy hosting i pobieraj faktury.",
    "billingConfirmUpgrade": "Potwierdź aktualizację",
    "billingConfirmDowngrade": "Potwierdź obniżenie",
    "billingConfirmUpgradeDescription": "Zamierzasz ulepszyć swój plan. Przejrzyj nowe limity i ceny poniżej.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Czas w sekundach",
    "requireDeviceApproval": "Wymagaj zatwierdzenia urządzenia",
    "requireDeviceApprovalDescription": "Użytkownicy o tej roli potrzebują nowych urządzeń zatwierdzonych przez administratora, zanim będą mogli połączyć się i uzyskać dostęp do zasobów.",
-    "sshAccess": "Dostęp SSH",
+    "sshSettings": "Ustawienia SSH",
+    "rdpSettings": "Ustawienia RDP",
+    "vncSettings": "Ustawienia VNC",
+    "sshServer": "Serwer SSH",
+    "rdpServer": "Serwer RDP",
+    "vncServer": "Serwer VNC",
+    "sshServerDescription": "Skonfiguruj metodę uwierzytelniania, lokalizację demona i miejsce docelowe serwera",
+    "rdpServerDescription": "Skonfiguruj miejsce docelowe i port serwera RDP",
+    "vncServerDescription": "Skonfiguruj miejsce docelowe i port serwera VNC",
+    "sshServerMode": "Tryb",
+    "sshServerModeStandard": "Standardowy Serwer SSH",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Przesyła polecenia przez sieć do serwera SSH takiego jak OpenSSH.",
+    "sshServerModeNative": "Natywny Serwer SSH",
+    "sshServerModeNativeDescription": "Wykonuje polecenia bezpośrednio na hoście za pomocą łącznika strony. Nie wymaga konfiguracji sieci.",
+    "sshAuthenticationMethod": "Metoda uwierzytelniania",
+    "sshAuthMethodManual": "Ręczne uwierzytelnianie",
+    "sshAuthMethodManualDescription": "Wymaga istniejących poświadczeń hosta. Omiija automatyczne provisioning.",
+    "sshAuthMethodAutomated": "Automatyczne Provisioning",
+    "sshAuthMethodAutomatedDescription": "Automatycznie tworzy użytkowników, grupy i uprawnienia sudo na hoście.",
+    "sshAuthDaemonLocation": "Lokalizacja Demona Uwierzytelniania",
+    "sshDaemonLocationSiteDescription": "Wykonuje lokalnie na maszynie hostującej łącznik strony.",
+    "sshDaemonLocationRemote": "Na Zdalnym Hoście",
+    "sshDaemonLocationRemoteDescription": "Wykonuje się na innej maszynie docelowej w tej samej sieci.",
+    "sshDaemonDisclaimer": "Upewnij się, że Twoja maszyna docelowa jest poprawnie skonfigurowana do uruchamiania demona uwierzytelniania zanim ukończysz tę konfigurację, w przeciwnym razie provisioning zakończy się niepowodzeniem.",
+    "sshDaemonPort": "Port Demona",
+    "sshServerDestination": "Miejsce docelowe serwera",
+    "sshServerDestinationDescription": "Skonfiguruj miejsce docelowe i port serwera SSH",
+    "destination": "Miejsce docelowe",
+    "bgTargetMultiSiteDisclaimer": "Wybór wielu stron umożliwia odporność trasowania i zmienioność dla wysokiej dostępności.",
    "roleAllowSsh": "Zezwalaj na SSH",
    "roleAllowSshAllow": "Zezwól",
    "roleAllowSshDisallow": "Nie zezwalaj",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Użytkownik może uruchamiać tylko określone polecenia z sudo.",
    "sshSudo": "Zezwól na sudo",
    "sshSudoCommands": "Komendy Sudo",
-    "sshSudoCommandsDescription": "Lista poleceń oddzielonych przecinkami, które użytkownik może uruchamiać z sudo.",
+    "sshSudoCommandsDescription": "Lista rozdzielona przecinkami poleceń, które użytkownik może uruchomić z sudo. Należy używać ścieżek bezwzględnych.",
    "sshCreateHomeDir": "Utwórz katalog domowy",
    "sshUnixGroups": "Grupy Unix",
    "sshUnixGroupsDescription": "Oddzielone przecinkami grupy Unix, aby dodać użytkownika do docelowego hosta.",
@@ -2939,7 +3070,7 @@
    "learnMore": "Dowiedz się więcej",
    "backToHome": "Wróć do strony głównej",
    "needToSignInToOrg": "Czy potrzebujesz użyć dostawcy tożsamości organizacji?",
-    "maintenanceMode": "Tryb konserwacji",
+    "maintenanceMode": "Strona konserwacji",
    "maintenanceModeDescription": "Wyświetl stronę konserwacyjną odwiedzającym",
    "maintenanceModeType": "Typ trybu konserwacji",
    "showMaintenancePage": "Pokaż odwiedzającym stronę konserwacji",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Szacowane zakończenie:",
    "createInternalResourceDialogDestinationRequired": "Miejsce docelowe jest wymagane",
    "available": "Dostępny",
+    "disabledResourceDescription": "Kiedy wyłączone, zasób będzie niedostępny dla wszystkich.",
    "archived": "Zarchiwizowane",
    "noArchivedDevices": "Nie znaleziono zarchiwizowanych urządzeń",
    "deviceArchived": "Urządzenie zarchiwizowane",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Zasób wyłączony",
    "memberPortalShowingResources": "Wyświetlanie zasobów od {start} do {end} z {total}",
    "memberPortalPrevious": "Poprzedni",
-    "memberPortalNext": "Następny"
+    "memberPortalNext": "Następny",
+    "httpSettings": "Ustawienia HTTP",
+    "tcpSettings": "Ustawienia TCP",
+    "udpSettings": "Ustawienia UDP",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Nawiązywanie bezpiecznego połączenia…",
+    "sshConnecting": "Łączenie…",
+    "sshInitializing": "Inicjalizacja…",
+    "sshSignInTitle": "Zaloguj się do SSH",
+    "sshSignInDescription": "Wprowadź swoje poświadczenia SSH",
+    "sshPasswordTab": "Hasło",
+    "sshPrivateKeyTab": "Klucz prywatny",
+    "sshPrivateKeyField": "Klucz prywatny",
+    "sshPrivateKeyDisclaimer": "Twój klucz prywatny nie jest przechowywany ani widoczny dla Pangolin. Alternatywnie, możesz używać certyfikatów krótkoterminowych do bezproblemowego uwierzytelniania za pomocą Twojej istniejącej tożsamości Pangolin.",
+    "sshLearnMore": "Dowiedz się więcej",
+    "sshPrivateKeyFile": "Plik klucza prywatnego",
+    "sshAuthenticate": "Uwierzytelnij",
+    "sshTerminate": "Zakończ",
+    "sshPoweredBy": "Obsługiwane przez",
+    "sshErrorNoTarget": "Nie określono celu",
+    "sshErrorWebSocket": "Połączenie WebSocket nie powiodło się",
+    "sshErrorAuthFailed": "Uwierzytelnianie nie powiodło się",
+    "sshErrorConnectionClosed": "Połączenie zamknięte przed ukończeniem uwierzytelniania"
 }
--- a/messages/pt-PT.json
+++ b/messages/pt-PT.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Ocorreu um erro ao criar o link de compartilhamento",
    "shareCreateDescription": "Qualquer um com este link pode aceder o recurso",
    "shareTitleOptional": "Título (opcional)",
+    "sharePathOptional": "Caminho (opcional)",
    "expireIn": "Expira em",
    "neverExpire": "Nunca expirar",
    "shareExpireDescription": "Tempo de expiração é quanto tempo o link será utilizável e oferecerá acesso ao recurso. Após este tempo, o link não funcionará mais, e os utilizadores que usaram este link perderão acesso ao recurso.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Procurar recursos...",
    "resourceAdd": "Adicionar Recurso",
    "resourceErrorDelte": "Erro ao apagar recurso",
+    "resourcePoliciesTitle": "Gerenciar Políticas de Recurso",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Recursos Anexados",
+    "resourcePoliciesAttachedResources": "{count} recurso(s)",
+    "resourcePoliciesAttachedResourcesEmpty": "sem recursos",
+    "resourcePoliciesDescription": "Crie e gerencie políticas de autenticação para controlar o acesso aos seus recursos",
+    "resourcePoliciesSearch": "Pesquisar políticas...",
+    "resourcePoliciesAdd": "Adicionar Política",
+    "resourcePoliciesDefaultBadgeText": "Política Padrão",
+    "resourcePoliciesCreate": "Criar Política de Recurso",
+    "resourcePoliciesCreateDescription": "Siga os passos abaixo para criar uma nova política",
+    "resourcePolicyName": "Nome da Política",
+    "resourcePolicyNameDescription": "Dê um nome a esta política para identificá-la em seus recursos",
+    "resourcePolicyNamePlaceholder": "ex.: Política de Acesso Interno",
+    "resourcePoliciesSeeAll": "Ver Todas as Políticas",
+    "resourcePolicyAuthMethodAdd": "Adicionar Método de Autenticação",
+    "resourcePolicyOtpEmailAdd": "Adicionar emails OTP",
+    "resourcePolicyRulesAdd": "Adicionar Regras",
+    "resourcePolicyAuthMethodsDescription": "Permitir acesso aos recursos via métodos de autenticação adicionais",
+    "resourcePolicyUsersRolesDescription": "Configure quais usuários e funções podem acessar os recursos associados",
+    "rulesResourcePolicyDescription": "Configure regras para controlar o acesso a recursos associados a esta política",
    "authentication": "Autenticação",
    "protected": "Protegido",
    "notProtected": "Não Protegido",
    "resourceMessageRemove": "Uma vez removido, o recurso não estará mais acessível. Todos os alvos associados ao recurso também serão removidos.",
    "resourceQuestionRemove": "Você tem certeza que deseja remover o recurso da organização?",
+    "resourcePolicyMessageRemove": "Uma vez removida, a política de recurso não estará mais acessível. Todos os recursos associados serão desvinculados e deixados sem autenticação.",
+    "resourcePolicyQuestionRemove": "Tem certeza de que deseja remover a política de recurso da organização?",
    "resourceHTTP": "Recurso HTTPS",
    "resourceHTTPDescription": "Proxies requests sobre HTTPS usando um nome de domínio totalmente qualificado.",
    "resourceRaw": "Recurso TCP/UDP bruto",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Proxy solicita por TCP/UDP bruto usando um número de porta. Requer que sites se conectem a um nó remoto.",
    "resourceCreate": "Criar Recurso",
    "resourceCreateDescription": "Siga os passos abaixo para criar um novo recurso",
+    "resourceCreateGeneralDescription": "Configure as configurações gerais do recurso, incluindo o nome e o tipo",
    "resourceSeeAll": "Ver todos os recursos",
-    "resourceInfo": "Informação do recurso",
+    "resourceCreateGeneral": "Gerais",
    "resourceNameDescription": "Este é o nome de exibição para o recurso.",
    "siteSelect": "Selecionar site",
    "siteSearch": "Procurar no site",
@@ -231,12 +255,15 @@
    "noCountryFound": "Nenhum país encontrado.",
    "siteSelectionDescription": "Este site fornecerá conectividade ao destino.",
    "resourceType": "Tipo de Recurso",
-    "resourceTypeDescription": "Determine como acessar o recurso",
+    "resourceTypeDescription": "Isso controla o protocolo do recurso e como ele será renderizado no navegador. Isso não pode ser alterado posteriormente.",
+    "resourceDomainDescription": "O recurso será servido neste nome de domínio totalmente qualificado.",
    "resourceHTTPSSettings": "Configurações de HTTPS",
    "resourceHTTPSSettingsDescription": "Configure como o recurso será acessado por HTTPS",
+    "resourcePortDescription": "A porta externa na instância ou nó Pangolin onde o recurso estará acessível.",
    "domainType": "Tipo de domínio",
    "subdomain": "Subdomínio",
    "baseDomain": "Domínio Base",
+    "configure": "Configurar",
    "subdomnainDescription": "O subdomínio onde o recurso será acessível.",
    "resourceRawSettings": "Configurações TCP/UDP",
    "resourceRawSettingsDescription": "Configurar como o recurso será acessado sobre TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Aprenda como configurar os recursos TCP/UDP",
    "resourceBack": "Voltar aos recursos",
    "resourceGoTo": "Ir para o Recurso",
+    "resourcePolicyDelete": "Excluir Política de Recurso",
+    "resourcePolicyDeleteConfirm": "Confirmar Exclusão da Política de Recurso",
    "resourceDelete": "Excluir Recurso",
    "resourceDeleteConfirm": "Confirmar que pretende apagar o  recurso",
+    "labelDelete": "Excluir Etiqueta",
+    "labelAdd": "Adicionar Etiqueta",
+    "labelCreateSuccessMessage": "Etiqueta Criada com Sucesso",
+    "labelEditSuccessMessage": "Etiqueta Modificada com Sucesso",
+    "labelNameField": "Nome da Etiqueta",
+    "labelColorField": "Cor da Etiqueta",
+    "labelPlaceholder": "Ex: homelab",
+    "labelCreate": "Criar Etiqueta",
+    "createLabelDialogTitle": "Criar Etiqueta",
+    "createLabelDialogDescription": "Crie uma nova etiqueta que pode ser anexada a esta organização",
+    "labelEdit": "Editar Etiqueta",
+    "editLabelDialogTitle": "Atualizar Etiqueta",
+    "editLabelDialogDescription": "Edite uma nova etiqueta que pode ser anexada a esta organização",
+    "labelDeleteConfirm": "Confirmar Exclusão da Etiqueta",
+    "labelErrorDelete": "Falha ao excluir a etiqueta",
+    "labelMessageRemove": "Esta ação é permanente. Todos os sites, recursos e clientes etiquetados com esta etiqueta serão desmarcados.",
+    "labelQuestionRemove": "Tem certeza de que deseja remover a etiqueta da organização?",
    "visibility": "Visibilidade",
    "enabled": "Ativado",
    "disabled": "Desabilitado",
@@ -265,6 +311,8 @@
    "rules": "Regras",
    "resourceSettingDescription": "Configure as configurações do recurso",
    "resourceSetting": "Configurações do {resourceName}",
+    "resourcePolicySettingDescription": "Configure as configurações na política de recurso",
+    "resourcePolicySetting": "Configurações de {policyName}",
    "alwaysAllow": "Autenticação de bypass",
    "alwaysDeny": "Bloquear Acesso",
    "passToAuth": "Passar para Autenticação",
@@ -630,7 +678,7 @@
    "createdAt": "Criado Em",
    "proxyErrorInvalidHeader": "Valor do cabeçalho Host personalizado inválido. Use o formato de nome de domínio ou salve vazio para remover o cabeçalho Host personalizado.",
    "proxyErrorTls": "Nome do Servidor TLS inválido. Use o formato de nome de domínio ou salve vazio para remover o Nome do Servidor TLS.",
-    "proxyEnableSSL": "Habilitar TLS",
+    "proxyEnableSSL": "Ativar TLS",
    "proxyEnableSSLDescription": "Habilitar criptografia SSL/TLS para conexões HTTPS seguras aos alvos.",
    "target": "Target",
    "configureTarget": "Configurar Alvos",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Sem regras. Adicione uma regra usando o formulário.",
    "rulesOrder": "As regras são avaliadas por prioridade em ordem ascendente.",
    "rulesSubmit": "Guardar Regras",
+    "policyErrorCreate": "Erro ao criar política",
+    "policyErrorCreateDescription": "Ocorreu um erro ao criar a política",
+    "policyErrorCreateMessageDescription": "Ocorreu um erro inesperado",
+    "policyErrorUpdate": "Erro ao atualizar política",
+    "policyErrorUpdateDescription": "Ocorreu um erro ao atualizar a política",
+    "policyErrorUpdateMessageDescription": "Ocorreu um erro inesperado",
+    "policyCreatedSuccess": "Política de recurso criada com sucesso",
+    "policyUpdatedSuccess": "Política de recurso atualizada com sucesso",
+    "authMethodsSave": "Salvar métodos de autenticação",
+    "rulesSave": "Guardar Regras",
    "resourceErrorCreate": "Erro ao criar recurso",
    "resourceErrorCreateDescription": "Ocorreu um erro ao criar o recurso",
    "resourceErrorCreateMessage": "Erro ao criar recurso:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Adicionar Código PIN",
    "pincodeRemove": "Remover Código PIN",
    "resourceAuthMethods": "Métodos de Autenticação",
+    "resourcePolicyAuthMethodsEmpty": "Nenhum método de autenticação",
+    "resourcePolicyOtpEmpty": "Sem senha única",
+    "resourcePolicyReadOnly": "Esta política é apenas leitura",
+    "resourcePolicyReadOnlyDescription": "Esta política de recurso é compartilhada entre vários recursos, você não pode editá-la nesta página.",
+    "editSharedPolicy": "Editar Política Compartilhada",
+    "resourcePolicyTypeSave": "Salvar Tipo de Recurso",
+    "resourcePolicySelect": "Selecionar política de recurso",
+    "resourcePolicySelectError": "Selecionar uma política de recurso",
+    "resourcePolicyNotFound": "Política não encontrada",
+    "resourcePolicySearch": "Pesquisar políticas",
+    "resourcePolicyRulesEmpty": "Nenhuma regra de autenticação",
    "resourceAuthMethodsDescriptions": "Permitir acesso ao recurso via métodos de autenticação adicionais",
    "resourceAuthSettingsSave": "Salvo com sucesso",
    "resourceAuthSettingsSaveDescription": "As configurações de autenticação foram salvas",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Definir Código PIN",
    "resourcePincodeSetupTitleDescription": "Defina um código PIN para proteger este recurso",
    "resourceRoleDescription": "Administradores sempre podem aceder este recurso.",
+    "resourcePolicySelectTitle": "Política de Acesso ao Recurso",
+    "resourcePolicySelectDescription": "Selecione o tipo de política de recurso para autenticação",
+    "resourcePolicyInline": "Política de Recurso Inline",
+    "resourcePolicyInlineDescription": "Política de Acesso abrange apenas este recurso",
+    "resourcePolicyShared": "Política de Recurso Compartilhada",
+    "resourcePolicySharedDescription": "Este recurso usa uma política compartilhada. As configurações a nível de política (métodos de autenticação, lista de emails permitidos) estão bloqueadas. Você pode adicionar regras, funções e usuários específicos ao recurso abaixo.",
    "resourceUsersRoles": "Controlos de Acesso",
    "resourceUsersRolesDescription": "Configure quais utilizadores e funções podem visitar este recurso",
    "resourceUsersRolesSubmit": "Guardar Controlos de Acesso",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Ocorreu um problema ao ligar a {name}. Por favor, contacte o seu administrador.",
    "idpErrorNotFound": "IdP não encontrado",
    "inviteInvalid": "Convite Inválido",
+    "labels": "Etiquetas",
+    "orgLabelsDescription": "Gerencie etiquetas nesta organização.",
+    "addLabels": "Adicionar etiquetas",
+    "siteLabelsTab": "Etiquetas",
+    "siteLabelsDescription": "Gerencie etiquetas associadas a este site.",
+    "labelsNotFound": "Etiquetas não encontradas",
+    "labelSearch": "Pesquisar etiquetas",
+    "accessLabelFilterCount": "{count, plural, one {# etiqueta} other {# etiquetas}}",
+    "labelOverflowCount": "+{count, plural, one {# etiqueta} other {# etiquetas}}",
+    "accessLabelFilterClear": "Limpar filtros de etiquetas",
+    "selectColor": "Selecionar cor",
+    "createNewLabel": "Criar nova etiqueta na organização \"{label}\"",
    "inviteInvalidDescription": "O link do convite é inválido.",
    "inviteErrorWrongUser": "O convite não é para este utilizador",
    "inviteErrorUserNotExists": "O utilizador não existe. Por favor, crie uma conta primeiro.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Recursos",
    "sidebarProxyResources": "Público",
    "sidebarClientResources": "Privado",
+    "sidebarPolicies": "Políticas",
+    "sidebarResourcePolicies": "Recursos",
    "sidebarAccessControl": "Controle de Acesso",
    "sidebarLogsAndAnalytics": "Registros e Análises",
    "sidebarTeam": "Equipe",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Site {id}",
    "standaloneHcFilterResourceIdFallback": "Recurso {id}",
    "blueprints": "Diagramas",
-    "blueprintsDescription": "Aplicar configurações declarativas e ver execuções anteriores",
+    "blueprintsLog": "Registo dos Blueprint",
+    "blueprintsDescription": "Ver aplicações de blueprint passadas e seus resultados",
    "blueprintAdd": "Adicionar Diagrama",
    "blueprintGoBack": "Ver todos os Diagramas",
    "blueprintCreate": "Criar Diagrama",
@@ -1575,7 +1665,17 @@
    "contents": "Conteúdo",
    "parsedContents": "Conteúdo analisado (Somente Leitura)",
    "enableDockerSocket": "Habilitar o Diagrama Docker",
-    "enableDockerSocketDescription": "Ativar a scraping de rótulo Docker para rótulos de diagramas. Caminho de Socket deve ser fornecido para Newt.",
+    "enableDockerSocketDescription": "Ative a raspagem de etiquetas do Docker Socket para etiquetas de modelo. O caminho do Socket deve ser fornecido ao conector do site. Leia sobre como isso funciona na <docsLink>documentação</docsLink>.",
+    "newtAutoUpdate": "Ativar Atualização Automática do Site",
+    "newtAutoUpdateDescription": "Quando ativado, os conectores de site atualizarão automaticamente para a versão mais recente quando uma nova versão estiver disponível.",
+    "siteAutoUpdate": "Atualização Automática do Site",
+    "siteAutoUpdateLabel": "Ativar Atualização Automática",
+    "siteAutoUpdateDescription": "Controle se o conector deste site baixa automaticamente a versão mais recente.",
+    "siteAutoUpdateOrgDefault": "Padrão da organização: {state}",
+    "siteAutoUpdateOverriding": "Substituindo configuração da organização",
+    "siteAutoUpdateResetToOrg": "Redefinir para Padrão da Organização",
+    "siteAutoUpdateEnabled": "ativado",
+    "siteAutoUpdateDisabled": "desabilitado",
    "viewDockerContainers": "Ver contêineres Docker",
    "containersIn": "Contêineres em {siteName}",
    "selectContainerDescription": "Selecione qualquer contêiner para usar como hostname para este alvo. Clique em uma porta para usar uma porta.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Certificado",
    "certificateStatusAutoRefreshHint": "Status atualiza automaticamente.",
    "loading": "Carregando",
+    "loadingEllipsis": "Carregando...",
    "loadingAnalytics": "Carregando Analytics",
    "restart": "Reiniciar",
    "domains": "Domínios",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Gerencie sua assinatura para as chaves de licenças auto-hospedadas pagas",
    "billingCurrentKeys": "Chaves atuais",
    "billingModifyCurrentPlan": "Modificar o Plano Atual",
+    "billingManageLicenseSubscriptionDescription": "Gerencie sua assinatura de chaves de licença auto-hospedadas pagas e baixe faturas.",
    "billingConfirmUpgrade": "Confirmar a atualização",
    "billingConfirmDowngrade": "Confirmar downgrade",
    "billingConfirmUpgradeDescription": "Você está prestes a atualizar seu plano. Revise os novos limites e preços abaixo.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "O tempo está em segundos",
    "requireDeviceApproval": "Exigir aprovação do dispositivo",
    "requireDeviceApprovalDescription": "Usuários com esta função precisam de novos dispositivos aprovados por um administrador antes que eles possam se conectar e acessar recursos.",
-    "sshAccess": "Acesso SSH",
+    "sshSettings": "Configurações SSH",
+    "rdpSettings": "Configurações RDP",
+    "vncSettings": "Configurações VNC",
+    "sshServer": "Servidor SSH",
+    "rdpServer": "Servidor RDP",
+    "vncServer": "Servidor VNC",
+    "sshServerDescription": "Configure o método de autenticação, localização do daemon e destino do servidor",
+    "rdpServerDescription": "Configure o destino e a porta do servidor RDP",
+    "vncServerDescription": "Configure o destino e a porta do servidor VNC",
+    "sshServerMode": "Modo",
+    "sshServerModeStandard": "Servidor SSH Padrão",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Roteia comandos pela rede para um servidor SSH como o OpenSSH.",
+    "sshServerModeNative": "Servidor SSH Nativo",
+    "sshServerModeNativeDescription": "Executa comandos diretamente no host via Site Connector. Não é necessária configuração de rede.",
+    "sshAuthenticationMethod": "Método de Autenticação",
+    "sshAuthMethodManual": "Autenticação Manual",
+    "sshAuthMethodManualDescription": "Requer credenciais de host existentes. Ignora provisionamento automático.",
+    "sshAuthMethodAutomated": "Provisionamento Automatizado",
+    "sshAuthMethodAutomatedDescription": "Cria automaticamente usuários, grupos e permissões sudo no host.",
+    "sshAuthDaemonLocation": "Localização do Daemon de Autenticação",
+    "sshDaemonLocationSiteDescription": "Executa locais na máquina que hospeda o conector do site.",
+    "sshDaemonLocationRemote": "Em Host Remoto",
+    "sshDaemonLocationRemoteDescription": "Executa em uma máquina de destino separada na mesma rede.",
+    "sshDaemonDisclaimer": "Certifique-se de que seu host de destino está devidamente configurado para executar o daemon de autenticação antes de concluir esta configuração, ou o provisionamento falhará.",
+    "sshDaemonPort": "Porta do Daemon",
+    "sshServerDestination": "Destino do Servidor",
+    "sshServerDestinationDescription": "Configure o destino e a porta do servidor SSH",
+    "destination": "Destino",
+    "bgTargetMultiSiteDisclaimer": "Selecionar vários sites permite roteamento resiliente e failover para alta disponibilidade.",
    "roleAllowSsh": "Permitir SSH",
    "roleAllowSshAllow": "Autorizar",
    "roleAllowSshDisallow": "Anular",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Usuário só pode executar os comandos especificados com sudo.",
    "sshSudo": "Permitir sudo",
    "sshSudoCommands": "Comandos Sudo",
-    "sshSudoCommandsDescription": "Lista separada por vírgulas de comandos que o usuário pode executar com sudo.",
+    "sshSudoCommandsDescription": "Lista separada por vírgulas de comandos que o usuário pode executar com sudo. Caminhos absolutos devem ser usados.",
    "sshCreateHomeDir": "Criar Diretório Inicial",
    "sshUnixGroups": "Grupos Unix",
    "sshUnixGroupsDescription": "Grupos Unix separados por vírgulas para adicionar o usuário no host alvo.",
@@ -2235,7 +2366,7 @@
        "description": "Servidor Pangolin auto-hospedado mais confiável e com baixa manutenção com sinos extras e assobiamentos",
        "introTitle": "Pangolin Auto-Hospedado Gerenciado",
        "introDescription": "é uma opção de implantação projetada para pessoas que querem simplicidade e confiança adicional, mantendo os seus dados privados e auto-hospedados.",
-        "introDetail": "Com esta opção, você ainda roda seu próprio nó Pangolin - seus túneis, terminação TLS e tráfego todos permanecem no seu servidor. A diferença é que a gestão e a monitorização são geridos através do nosso painel de nuvem, que desbloqueia vários benefícios:",
+        "introDetail": "Com esta opção, você ainda roda seu próprio nó Pangolin - seus túneis, terminação TLS e tráfego permanecem no seu servidor. A diferença é que a gestão e a monitorização são feitas através do nosso painel de nuvem, que desbloqueia uma série de benefícios:",
        "benefitSimplerOperations": {
            "title": "Operações simples",
            "description": "Não é necessário executar o seu próprio servidor de e-mail ou configurar um alerta complexo. Você receberá fora de caixa verificações de saúde e alertas de tempo de inatividade."
@@ -2939,7 +3070,7 @@
    "learnMore": "Saiba mais",
    "backToHome": "Voltar para a página inicial",
    "needToSignInToOrg": "Precisa usar o provedor de identidade da sua organização?",
-    "maintenanceMode": "Modo de Manutenção",
+    "maintenanceMode": "Página de Manutenção",
    "maintenanceModeDescription": "Exibir uma página de manutenção para os visitantes",
    "maintenanceModeType": "Tipo de Modo de Manutenção",
    "showMaintenancePage": "Mostrar uma página de manutenção para os visitantes",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Conclusão Estimada:",
    "createInternalResourceDialogDestinationRequired": "Destino é obrigatório",
    "available": "Disponível",
+    "disabledResourceDescription": "Quando desativado, o recurso ficará inacessível para todos.",
    "archived": "Arquivado",
    "noArchivedDevices": "Nenhum dispositivo arquivado encontrado",
    "deviceArchived": "Dispositivo arquivado",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Recurso Desativado",
    "memberPortalShowingResources": "Mostrando {start}-{end} de {total} recursos",
    "memberPortalPrevious": "Anterior",
-    "memberPortalNext": "Próximo"
+    "memberPortalNext": "Próximo",
+    "httpSettings": "Configurações HTTP",
+    "tcpSettings": "Configurações TCP",
+    "udpSettings": "Configurações UDP",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Estabelecendo uma conexão segura…",
+    "sshConnecting": "A conectar…",
+    "sshInitializing": "A iniciar…",
+    "sshSignInTitle": "Entrar no SSH",
+    "sshSignInDescription": "Insira suas credenciais SSH",
+    "sshPasswordTab": "Palavra-passe",
+    "sshPrivateKeyTab": "Chave Privada",
+    "sshPrivateKeyField": "Chave Privada",
+    "sshPrivateKeyDisclaimer": "Sua chave privada não é armazenada ou visível para Pangolin. Alternativamente, você pode usar certificados de curta duração para autenticação perfeita usando sua identidade Pangolin existente.",
+    "sshLearnMore": "Saiba mais",
+    "sshPrivateKeyFile": "Arquivo de Chave Privada",
+    "sshAuthenticate": "Autenticar",
+    "sshTerminate": "Terminar",
+    "sshPoweredBy": "Desenvolvido por",
+    "sshErrorNoTarget": "Nenhum alvo especificado",
+    "sshErrorWebSocket": "Falha na conexão WebSocket",
+    "sshErrorAuthFailed": "Falha na autenticação",
+    "sshErrorConnectionClosed": "Conexão encerrada antes de concluir a autenticação"
 }
--- a/messages/ru-RU.json
+++ b/messages/ru-RU.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Произошла ошибка при создании общей ссылки",
    "shareCreateDescription": "Любой, у кого есть эта ссылка, может получить доступ к ресурсу",
    "shareTitleOptional": "Заголовок (необязательно)",
+    "sharePathOptional": "Путь (необязательно)",
    "expireIn": "Срок действия",
    "neverExpire": "Бессрочный доступ",
    "shareExpireDescription": "Срок действия - это период, в течение которого ссылка будет работать и предоставлять доступ к ресурсу. После этого времени ссылка перестанет работать, и пользователи, использовавшие эту ссылку, потеряют доступ к ресурсу.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Поиск ресурсов...",
    "resourceAdd": "Добавить ресурс",
    "resourceErrorDelte": "Ошибка при удалении ресурса",
+    "resourcePoliciesTitle": "Управление политиками ресурсов",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Прикрепленные ресурсы",
+    "resourcePoliciesAttachedResources": "{count} ресурс(ов)",
+    "resourcePoliciesAttachedResourcesEmpty": "нет ресурсов",
+    "resourcePoliciesDescription": "Создавайте и управляйте политиками аутентификации для контроля доступа к вашим ресурсам",
+    "resourcePoliciesSearch": "Поиск политик...",
+    "resourcePoliciesAdd": "Добавить политику",
+    "resourcePoliciesDefaultBadgeText": "Политика по умолчанию",
+    "resourcePoliciesCreate": "Создать политику ресурса",
+    "resourcePoliciesCreateDescription": "Следуйте шагам ниже, чтобы создать новую политику",
+    "resourcePolicyName": "Имя политики",
+    "resourcePolicyNameDescription": "Дайте этой политике имя для идентификации ее в ваших ресурсах",
+    "resourcePolicyNamePlaceholder": "например, Политика внутреннего доступа",
+    "resourcePoliciesSeeAll": "Просмотреть все политики",
+    "resourcePolicyAuthMethodAdd": "Добавить метод аутентификации",
+    "resourcePolicyOtpEmailAdd": "Добавить OTP на email",
+    "resourcePolicyRulesAdd": "Добавить правила",
+    "resourcePolicyAuthMethodsDescription": "Разрешить доступ к ресурсам через дополнительные методы аутентификации",
+    "resourcePolicyUsersRolesDescription": "Настройте, какие пользователи и роли могут посещать связанные ресурсы",
+    "rulesResourcePolicyDescription": "Настройте правила для управления доступом к ресурсам, связанным с этой политикой",
    "authentication": "Аутентификация",
    "protected": "Защищён",
    "notProtected": "Не защищён",
    "resourceMessageRemove": "После удаления ресурс больше не будет доступен. Все целевые узлы, связанные с ресурсом, также будут удалены.",
    "resourceQuestionRemove": "Вы уверены, что хотите удалить ресурс из организации?",
+    "resourcePolicyMessageRemove": "После удаления политика ресурса больше не будет доступна. Все ресурсы, связанные с ресурсом, будут отключены и останутся без аутентификации.",
+    "resourcePolicyQuestionRemove": "Вы уверены, что хотите удалить политику ресурса из организации?",
    "resourceHTTP": "HTTPS-ресурс",
    "resourceHTTPDescription": "Проксировать запросы через HTTPS с использованием полного доменного имени.",
    "resourceRaw": "Сырой TCP/UDP-ресурс",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Прокси запросы через необработанный TCP/UDP с использованием номера порта. Требуется подключение сайтов к удаленному узлу.",
    "resourceCreate": "Создание ресурса",
    "resourceCreateDescription": "Следуйте инструкциям ниже для создания нового ресурса",
+    "resourceCreateGeneralDescription": "Настройте основные параметры ресурса, включая его имя и тип",
    "resourceSeeAll": "Посмотреть все ресурсы",
-    "resourceInfo": "Информация о ресурсе",
+    "resourceCreateGeneral": "Общие",
    "resourceNameDescription": "Отображаемое имя ресурса.",
    "siteSelect": "Выберите сайт",
    "siteSearch": "Поиск сайта",
@@ -231,12 +255,15 @@
    "noCountryFound": "Страна не найдена.",
    "siteSelectionDescription": "Этот сайт предоставит подключение к цели.",
    "resourceType": "Тип ресурса",
-    "resourceTypeDescription": "Определить как получить доступ к ресурсу",
+    "resourceTypeDescription": "Это контролирует протокол ресурса и то, как он будет отображаться в браузере. Это нельзя изменить позже.",
+    "resourceDomainDescription": "Ресурс будет предоставлен по этому полностью определенному доменному имени.",
    "resourceHTTPSSettings": "Настройки HTTPS",
    "resourceHTTPSSettingsDescription": "Настройка доступа к ресурсу по HTTPS",
+    "resourcePortDescription": "Внешний порт на экземпляре или узле Pangolin, где ресурс будет доступен.",
    "domainType": "Тип домена",
    "subdomain": "Поддомен",
    "baseDomain": "Базовый домен",
+    "configure": "Настроить",
    "subdomnainDescription": "Поддомен, в котором ресурс будет доступен.",
    "resourceRawSettings": "Настройки TCP/UDP",
    "resourceRawSettingsDescription": "Настройка доступа к ресурсу по TCP/UDP",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "Узнайте, как настроить TCP/UDP-ресурсы",
    "resourceBack": "Назад к ресурсам",
    "resourceGoTo": "Перейти к ресурсу",
+    "resourcePolicyDelete": "Удалить политику ресурса",
+    "resourcePolicyDeleteConfirm": "Подтвердите удаление политики ресурса",
    "resourceDelete": "Удалить ресурс",
    "resourceDeleteConfirm": "Подтвердить удаление",
+    "labelDelete": "Удалить метку",
+    "labelAdd": "Добавить метку",
+    "labelCreateSuccessMessage": "Метка успешно создана",
+    "labelEditSuccessMessage": "Метка успешно изменена",
+    "labelNameField": "Название метки",
+    "labelColorField": "Цвет метки",
+    "labelPlaceholder": "Напр.: homelab",
+    "labelCreate": "Создать метку",
+    "createLabelDialogTitle": "Создать метку",
+    "createLabelDialogDescription": "Создайте новую метку, которая может быть прикреплена к этой организации",
+    "labelEdit": "Редактировать метку",
+    "editLabelDialogTitle": "Обновить метку",
+    "editLabelDialogDescription": "Измените новую метку, которую можно прикрепить к этой организации",
+    "labelDeleteConfirm": "Подтвердите удаление метки",
+    "labelErrorDelete": "Не удалось удалить метку",
+    "labelMessageRemove": "Это действие необратимо. Все сайты, ресурсы и клиенты, помеченные этой меткой, будут разметены.",
+    "labelQuestionRemove": "Вы уверены, что хотите удалить метку из организации?",
    "visibility": "Видимость",
    "enabled": "Включено",
    "disabled": "Отключено",
@@ -265,6 +311,8 @@
    "rules": "Правила",
    "resourceSettingDescription": "Настройка параметров ресурса",
    "resourceSetting": "Настройки {resourceName}",
+    "resourcePolicySettingDescription": "Настройка параметров политики ресурса",
+    "resourcePolicySetting": "Настройки {policyName}",
    "alwaysAllow": "Авторизация байпасса",
    "alwaysDeny": "Блокировать доступ",
    "passToAuth": "Переход к аутентификации",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Нет правил. Добавьте правило с помощью формы.",
    "rulesOrder": "Правила оцениваются по приоритету в возрастающем порядке.",
    "rulesSubmit": "Сохранить правила",
+    "policyErrorCreate": "Ошибка создания политики",
+    "policyErrorCreateDescription": "Произошла ошибка при создании политики",
+    "policyErrorCreateMessageDescription": "Произошла неожиданная ошибка",
+    "policyErrorUpdate": "Ошибка обновления политики",
+    "policyErrorUpdateDescription": "Произошла ошибка при обновлении политики",
+    "policyErrorUpdateMessageDescription": "Произошла неожиданная ошибка",
+    "policyCreatedSuccess": "Политика ресурса успешно создана",
+    "policyUpdatedSuccess": "Политика ресурса успешно обновлена",
+    "authMethodsSave": "Сохранить методы аутентификации",
+    "rulesSave": "Сохранить правила",
    "resourceErrorCreate": "Ошибка при создании ресурса",
    "resourceErrorCreateDescription": "Произошла ошибка при создании ресурса",
    "resourceErrorCreateMessage": "Ошибка создания ресурса:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "Добавить PIN-код",
    "pincodeRemove": "Удалить PIN-код",
    "resourceAuthMethods": "Методы аутентификации",
+    "resourcePolicyAuthMethodsEmpty": "Нет метода аутентификации",
+    "resourcePolicyOtpEmpty": "Нет одноразового пароля",
+    "resourcePolicyReadOnly": "Эта политика только для чтения",
+    "resourcePolicyReadOnlyDescription": "Эта политика ресурса разделяется между несколькими ресурсами, вы не можете улучшить ее на этой странице.",
+    "editSharedPolicy": "Редактировать общую политику",
+    "resourcePolicyTypeSave": "Сохранить тип ресурса",
+    "resourcePolicySelect": "Выберите политику ресурса",
+    "resourcePolicySelectError": "Выберите политику ресурса",
+    "resourcePolicyNotFound": "Политика не найдена",
+    "resourcePolicySearch": "Поиск политик",
+    "resourcePolicyRulesEmpty": "Нет правил аутентификации",
    "resourceAuthMethodsDescriptions": "Разрешить доступ к ресурсу через дополнительные методы аутентификации",
    "resourceAuthSettingsSave": "Успешно сохранено",
    "resourceAuthSettingsSaveDescription": "Настройки аутентификации сохранены",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Установить PIN-код",
    "resourcePincodeSetupTitleDescription": "Установите PIN-код для защиты этого ресурса",
    "resourceRoleDescription": "Администраторы всегда имеют доступ к этому ресурсу.",
+    "resourcePolicySelectTitle": "Политика доступа к ресурсам",
+    "resourcePolicySelectDescription": "Выберите тип политики ресурса для аутентификации",
+    "resourcePolicyInline": "Политика ресурса на месте",
+    "resourcePolicyInlineDescription": "Политика доступа ограничена только этим ресурсом",
+    "resourcePolicyShared": "Общая политика ресурса",
+    "resourcePolicySharedDescription": "Этот ресурс использует общую политику. Настройки уровня политики (методы аутентификации, список разрешенных email) заблокированы. Вы можете добавить правила, роли и пользователей, специфичные для ресурса, ниже.",
    "resourceUsersRoles": "Контроль доступа",
    "resourceUsersRolesDescription": "Выберите пользователей и роли с доступом к этому ресурсу",
    "resourceUsersRolesSubmit": "Сохранить контроль доступа",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "Возникла проблема при подключении к {name}. Пожалуйста, свяжитесь с вашим администратором.",
    "idpErrorNotFound": "IdP не найден",
    "inviteInvalid": "Недействительное приглашение",
+    "labels": "Метки",
+    "orgLabelsDescription": "Управление метками в этой организации.",
+    "addLabels": "Добавить метки",
+    "siteLabelsTab": "Метки",
+    "siteLabelsDescription": "Управляйте метками, связанными с этим сайтом.",
+    "labelsNotFound": "Метки не найдены",
+    "labelSearch": "Поиск меток",
+    "accessLabelFilterCount": "{count, plural, one {# метка} few {# метки} many {# меток} other {# меток}}",
+    "labelOverflowCount": "+{count, plural, one {# метка} few {# метки} many {# меток} other {# меток}}",
+    "accessLabelFilterClear": "Очистить фильтры меток",
+    "selectColor": "Выберите цвет",
+    "createNewLabel": "Создать новую метку организации \"{label}\"",
    "inviteInvalidDescription": "Ссылка на приглашение недействительна.",
    "inviteErrorWrongUser": "Приглашение не для этого пользователя",
    "inviteErrorUserNotExists": "Пользователь не существует. Пожалуйста, сначала создайте учетную запись.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Ресурсы",
    "sidebarProxyResources": "Публичный",
    "sidebarClientResources": "Приватный",
+    "sidebarPolicies": "Политики",
+    "sidebarResourcePolicies": "Ресурсы",
    "sidebarAccessControl": "Контроль доступа",
    "sidebarLogsAndAnalytics": "Журналы и аналитика",
    "sidebarTeam": "Команда",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Сайт {id}",
    "standaloneHcFilterResourceIdFallback": "Ресурс {id}",
    "blueprints": "Чертежи",
-    "blueprintsDescription": "Применить декларирующие конфигурации и просмотреть предыдущие запуски",
+    "blueprintsLog": "Журнал чертежей",
+    "blueprintsDescription": "Просмотр прошлых применений чертежа и их результатов",
    "blueprintAdd": "Добавить чертёж",
    "blueprintGoBack": "Посмотреть все чертежи",
    "blueprintCreate": "Создать чертёж",
@@ -1575,7 +1665,17 @@
    "contents": "Содержание",
    "parsedContents": "Переработанное содержимое (только для чтения)",
    "enableDockerSocket": "Включить чертёж Docker",
-    "enableDockerSocketDescription": "Включить scraping ярлыка Docker Socket для ярлыков чертежей. Путь к сокету должен быть предоставлен в Newt.",
+    "enableDockerSocketDescription": "Включить сбор меток Docker Socket для чертежей. Путь сокета должен быть предоставлен подключателю сайта. Прочтите о том, как это работает, в <docsLink>документации</docsLink>.",
+    "newtAutoUpdate": "Включить автообновление сайта",
+    "newtAutoUpdateDescription": "При включении, коннекторы сайта будут автоматически обновляться до последней версии, когда доступен новый выпуск.",
+    "siteAutoUpdate": "Автообновление сайта",
+    "siteAutoUpdateLabel": "Включить автообновление",
+    "siteAutoUpdateDescription": "Контролировать, будет ли коннектор этого сайта автоматически загружать последнюю версию.",
+    "siteAutoUpdateOrgDefault": "Значение по умолчанию для организации: {state}",
+    "siteAutoUpdateOverriding": "Переопределение настройки организации",
+    "siteAutoUpdateResetToOrg": "Сброс до значения по умолчанию для организации",
+    "siteAutoUpdateEnabled": "включено",
+    "siteAutoUpdateDisabled": "отключено",
    "viewDockerContainers": "Просмотр контейнеров Docker",
    "containersIn": "Контейнеры в {siteName}",
    "selectContainerDescription": "Выберите любой контейнер для использования в качестве имени хоста для этой цели. Нажмите на порт, чтобы использовать порт.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Сертификат",
    "certificateStatusAutoRefreshHint": "Статус обновляется автоматически.",
    "loading": "Загрузка",
+    "loadingEllipsis": "Загрузка...",
    "loadingAnalytics": "Загрузка аналитики",
    "restart": "Перезагрузка",
    "domains": "Домены",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Управление подпиской на платные лицензионные ключи собственного хостинга",
    "billingCurrentKeys": "Текущие ключи",
    "billingModifyCurrentPlan": "Изменить текущий план",
+    "billingManageLicenseSubscriptionDescription": "Управление вашей подпиской на платные ключи лицензии для самостоятельной установки и загрузка счетов.",
    "billingConfirmUpgrade": "Подтвердить обновление",
    "billingConfirmDowngrade": "Подтверждение понижения",
    "billingConfirmUpgradeDescription": "Вы собираетесь обновить тарифный план. Проверьте новые лимиты и цены ниже.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Время указано в секундах",
    "requireDeviceApproval": "Требовать подтверждения устройства",
    "requireDeviceApprovalDescription": "Пользователям с этой ролью нужны новые устройства, одобренные администратором, прежде чем они смогут подключаться и получать доступ к ресурсам.",
-    "sshAccess": "SSH доступ",
+    "sshSettings": "Настройки SSH",
+    "rdpSettings": "Настройки RDP",
+    "vncSettings": "Настройки VNC",
+    "sshServer": "SSH сервер",
+    "rdpServer": "RDP сервер",
+    "vncServer": "VNC сервер",
+    "sshServerDescription": "Настройка метода аутентификации, местоположения демона и пункта назначения сервера",
+    "rdpServerDescription": "Настройте пункт назначения и порт RDP-сервера",
+    "vncServerDescription": "Настройте пункт назначения и порт VNC-сервера",
+    "sshServerMode": "Режим",
+    "sshServerModeStandard": "Стандартный SSH-сервер",
+    "sshServerModePangolin": "SSH Pangolin",
+    "sshServerModeStandardDescription": "Маршрутизация команд по сети к SSH-серверу, такому как OpenSSH.",
+    "sshServerModeNative": "Родной SSH-сервер",
+    "sshServerModeNativeDescription": "Выполняет команды напрямую на хосте через сайт-коннектор. Настройка сети не требуется.",
+    "sshAuthenticationMethod": "Метод аутентификации",
+    "sshAuthMethodManual": "Ручная аутентификация",
+    "sshAuthMethodManualDescription": "Требуется наличие существующих учетных данных хоста. Обходит автоматическое предоставление.",
+    "sshAuthMethodAutomated": "Автоматизированное предоставление",
+    "sshAuthMethodAutomatedDescription": "Автоматически создает пользователей, группы и разрешения sudo на хосте.",
+    "sshAuthDaemonLocation": "Местоположение демона аутентификации",
+    "sshDaemonLocationSiteDescription": "Выполняется локально на машине, размещающей сайт-коннектор.",
+    "sshDaemonLocationRemote": "На удаленном хосте",
+    "sshDaemonLocationRemoteDescription": "Выполняется на отдельной целевой машине в той же сети.",
+    "sshDaemonDisclaimer": "Убедитесь, что целевой хост правильно настроен для запуска демона аутентификации перед завершением этой настройки, иначе предоставление не удастся.",
+    "sshDaemonPort": "Порт демона",
+    "sshServerDestination": "Пункт назначения сервера",
+    "sshServerDestinationDescription": "Настройте пункт назначения и порт SSH-сервера",
+    "destination": "Пункт назначения",
+    "bgTargetMultiSiteDisclaimer": "Выбор нескольких сайтов включает в себя устойчивую маршрутизацию и автоматический отказ для обеспечения высокой доступности.",
    "roleAllowSsh": "Разрешить SSH",
    "roleAllowSshAllow": "Разрешить",
    "roleAllowSshDisallow": "Запретить",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Пользователь может запускать только указанные команды с помощью sudo.",
    "sshSudo": "Разрешить sudo",
    "sshSudoCommands": "Sudo Команды",
-    "sshSudoCommandsDescription": "Список команд, разделенных запятыми, которые пользователю разрешено запускать с помощью sudo.",
+    "sshSudoCommandsDescription": "Список команд, которые пользователь может выполнять с sudo, через запятую. Должны использоваться абсолютные пути.",
    "sshCreateHomeDir": "Создать домашний каталог",
    "sshUnixGroups": "Unix группы",
    "sshUnixGroupsDescription": "Группы Unix через запятую, чтобы добавить пользователя на целевой хост.",
@@ -2235,7 +2366,7 @@
        "description": "Более надежный и низко обслуживаемый сервер Pangolin с дополнительными колокольнями и свистками",
        "introTitle": "Управляемый Само-Хост Панголина",
        "introDescription": "- это вариант развертывания, предназначенный для людей, которые хотят простоты и надёжности, сохраняя при этом свои данные конфиденциальными и самостоятельными.",
-        "introDetail": "С помощью этой опции вы по-прежнему используете узел Pangolin - туннели, TLS, и весь остающийся на вашем сервере. Разница заключается в том, что управление и мониторинг осуществляются через нашу панель инструментов из облака, которая открывает ряд преимуществ:",
+        "introDetail": "С помощью этой опции вы по-прежнему используете узел Pangolin - ваши туннели, завершение TLS и трафик остаются на вашем сервере. Разница заключается в том, что управление и мониторинг осуществляются через наш облачный интерфейс, что открывает ряд преимуществ:",
        "benefitSimplerOperations": {
            "title": "Более простые операции",
            "description": "Не нужно запускать свой собственный почтовый сервер или настроить комплексное оповещение. Вы будете получать проверки состояния здоровья и оповещения о неисправностях из коробки."
@@ -2939,7 +3070,7 @@
    "learnMore": "Узнать больше",
    "backToHome": "Вернуться домой",
    "needToSignInToOrg": "Нужно использовать провайдера идентификаций вашей организации?",
-    "maintenanceMode": "Режим обслуживания",
+    "maintenanceMode": "Страница обслуживания",
    "maintenanceModeDescription": "Показать страницу обслуживания посетителям",
    "maintenanceModeType": "Тип режима обслуживания",
    "showMaintenancePage": "Показать страницу обслуживания посетителям",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Предполагаемое завершение:",
    "createInternalResourceDialogDestinationRequired": "Укажите адрес назначения. Это может быть имя хоста или IP-адрес.",
    "available": "Доступно",
+    "disabledResourceDescription": "Когда отключено, ресурс будет недоступен для всех.",
    "archived": "Архивировано",
    "noArchivedDevices": "Архивные устройства не найдены",
    "deviceArchived": "Устройство архивировано",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Ресурс отключён",
    "memberPortalShowingResources": "Показаны {start}-{end} из {total} ресурсов",
    "memberPortalPrevious": "Предыдущий",
-    "memberPortalNext": "Следующий"
+    "memberPortalNext": "Следующий",
+    "httpSettings": "Настройки HTTP",
+    "tcpSettings": "Настройки TCP",
+    "udpSettings": "Настройки UDP",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Установление защищенного соединения…",
+    "sshConnecting": "Подключение…",
+    "sshInitializing": "Инициализация…",
+    "sshSignInTitle": "Вход в SSH",
+    "sshSignInDescription": "Введите свои учетные данные SSH",
+    "sshPasswordTab": "Пароль",
+    "sshPrivateKeyTab": "Закрытый ключ",
+    "sshPrivateKeyField": "Закрытый ключ",
+    "sshPrivateKeyDisclaimer": "Ваш закрытый ключ не хранится и не виден для Pangolin. Вместо этого вы можете использовать краткосрочные сертификаты для бесшовной аутентификации с использованием вашей текущей идентификации Pangolin.",
+    "sshLearnMore": "Узнать больше",
+    "sshPrivateKeyFile": "Файл закрытого ключа",
+    "sshAuthenticate": "Аутентификация",
+    "sshTerminate": "Завершить",
+    "sshPoweredBy": "Разработано",
+    "sshErrorNoTarget": "Цель не указана",
+    "sshErrorWebSocket": "Подключение WebSocket не удалось",
+    "sshErrorAuthFailed": "Ошибка аутентификации",
+    "sshErrorConnectionClosed": "Подключение закрыто до завершения аутентификации"
 }
--- a/messages/tr-TR.json
+++ b/messages/tr-TR.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "Paylaşım bağlantısı oluşturulurken bir hata oluştu",
    "shareCreateDescription": "Bu bağlantıya sahip olan herkes kaynağa erişebilir",
    "shareTitleOptional": "Başlık (isteğe bağlı)",
+    "sharePathOptional": "Yol (isteğe bağlı)",
    "expireIn": "Süresi Dolacak",
    "neverExpire": "Hiçbir Zaman Sona Ermez",
    "shareExpireDescription": "Son kullanma süresi, bağlantının kullanılabilir ve kaynağa erişim sağlayacak süresidir. Bu süreden sonra bağlantı çalışmayı durduracak ve bu bağlantıyı kullanan kullanıcılar kaynağa erişimini kaybedecektir.",
@@ -208,11 +209,33 @@
    "resourcesSearch": "Kaynakları ara...",
    "resourceAdd": "Kaynak Ekle",
    "resourceErrorDelte": "Kaynak silinirken hata",
+    "resourcePoliciesTitle": "Kaynak Politikalarını Yönet",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Ekteki kaynaklar",
+    "resourcePoliciesAttachedResources": "{count} kaynak",
+    "resourcePoliciesAttachedResourcesEmpty": "hiçbir kaynak",
+    "resourcePoliciesDescription": "Kaynaklarınıza erişimi kontrol etmek için kimlik doğrulama politikaları oluşturun ve yönetin",
+    "resourcePoliciesSearch": "Politikaları ara...",
+    "resourcePoliciesAdd": "Politika Ekle",
+    "resourcePoliciesDefaultBadgeText": "Varsayılan politika",
+    "resourcePoliciesCreate": "Kaynak Politikası Oluştur",
+    "resourcePoliciesCreateDescription": "Yeni bir politika oluşturmak için aşağıdaki adımları izleyin",
+    "resourcePolicyName": "Politika Adı",
+    "resourcePolicyNameDescription": "Bu politikaya kaynaklarınız arasında kolayca tanımlayabilmek için bir ad verin",
+    "resourcePolicyNamePlaceholder": "örneğin: İç Erişim Politikası",
+    "resourcePoliciesSeeAll": "Tüm Politikaları Gör",
+    "resourcePolicyAuthMethodAdd": "Kimlik Doğrulama Yöntemi Ekle",
+    "resourcePolicyOtpEmailAdd": "OTP e-postaları ekle",
+    "resourcePolicyRulesAdd": "Kurallar Ekle",
+    "resourcePolicyAuthMethodsDescription": "Ek kimlik doğrulama yöntemleri aracılığıyla kaynaklara erişime izin verin",
+    "resourcePolicyUsersRolesDescription": "Hangi kullanıcılar ve rollerin ilgili kaynakları ziyaret edebileceğini yapılandırın",
+    "rulesResourcePolicyDescription": "Bu politikayla ilişkilendirilmiş erişim kaynaklarını kontrol etmek için kuralları yapılandırın",
    "authentication": "Kimlik Doğrulama",
    "protected": "Korunan",
    "notProtected": "Korunmayan",
    "resourceMessageRemove": "Kaldırıldıktan sonra kaynak artık erişilebilir olmayacaktır. Kaynakla ilişkili tüm hedefler de kaldırılacaktır.",
    "resourceQuestionRemove": "Kaynağı organizasyondan kaldırmak istediğinizden emin misiniz?",
+    "resourcePolicyMessageRemove": "Kaldırıldıktan sonra kaynak politikası artık erişilebilir olmayacak. Kaynakla ilişkili tüm öğeler bağlantıları koparılacak ve kimlik doğrulaması olmadan bırakılacaktır.",
+    "resourcePolicyQuestionRemove": "Kaynak politikasını organizasyondan kaldırmak istediğinizden emin misiniz?",
    "resourceHTTP": "HTTPS Kaynağı",
    "resourceHTTPDescription": "Tam nitelikli bir etki alanı adı kullanarak HTTPS üzerinden proxy isteklerini yönlendirin.",
    "resourceRaw": "Ham TCP/UDP Kaynağı",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "Proxy isteklerini bir port numarası kullanarak ham TCP/UDP üzerinden yapın. Sitelerin uzak bir düğüme bağlanması gereklidir.",
    "resourceCreate": "Kaynak Oluştur",
    "resourceCreateDescription": "Yeni bir kaynak oluşturmak için aşağıdaki adımları izleyin",
+    "resourceCreateGeneralDescription": "Adı ve türü dahil temel kaynak ayarlarını yapılandırın",
    "resourceSeeAll": "Tüm Kaynakları Gör",
-    "resourceInfo": "Kaynak Bilgilendirmesi",
+    "resourceCreateGeneral": "Genel",
    "resourceNameDescription": "Bu, kaynak için görünen addır.",
    "siteSelect": "Site seç",
    "siteSearch": "Site ara",
@@ -231,12 +255,15 @@
    "noCountryFound": "Ülke bulunamadı.",
    "siteSelectionDescription": "Bu site hedefe bağlantı sağlayacaktır.",
    "resourceType": "Kaynak Türü",
-    "resourceTypeDescription": "Kaynağınıza nasıl erişmek istediğinizi belirleyin",
+    "resourceTypeDescription": "Bu, kaynak protokolünü ve tarayıcıda nasıl görüntüleneceğini kontrol eder. Bu daha sonra değiştirilemez.",
+    "resourceDomainDescription": "Kaynak bu tam etki alanı adıyla sunulacak.",
    "resourceHTTPSSettings": "HTTPS Ayarları",
    "resourceHTTPSSettingsDescription": "Kaynağınıza HTTPS üzerinden erişimin nasıl sağlanacağını yapılandırın",
+    "resourcePortDescription": "Kaynağa erişilebilecek Pangolin örneği veya düğüm üzerindeki harici bağlantı noktası.",
    "domainType": "Alan Türü",
    "subdomain": "Alt Alan Adı",
    "baseDomain": "Temel Alan Adı",
+    "configure": "Yapılandır",
    "subdomnainDescription": "Kaynağınızın erişilebileceği alt alan adı.",
    "resourceRawSettings": "TCP/UDP Ayarları",
    "resourceRawSettingsDescription": "Kaynaklara TCP/UDP üzerinden nasıl erişileceğini yapılandırın",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "TCP/UDP kaynaklarını nasıl yapılandıracağınızı öğrenin",
    "resourceBack": "Kaynaklara Geri Dön",
    "resourceGoTo": "Kaynağa Git",
+    "resourcePolicyDelete": "Kaynak Politikasını Sil",
+    "resourcePolicyDeleteConfirm": "Kaynak Politikasının Silinmesini Onayla",
    "resourceDelete": "Kaynağı Sil",
    "resourceDeleteConfirm": "Kaynak Silmeyi Onayla",
+    "labelDelete": "Etiketi Sil",
+    "labelAdd": "Etiket Ekle",
+    "labelCreateSuccessMessage": "Etiket Başarıyla Oluşturuldu",
+    "labelEditSuccessMessage": "Etiket Başarıyla Değiştirildi",
+    "labelNameField": "Etiket Adı",
+    "labelColorField": "Etiket Rengi",
+    "labelPlaceholder": "Örn: homelab",
+    "labelCreate": "Etiket Oluştur",
+    "createLabelDialogTitle": "Etiket Oluştur",
+    "createLabelDialogDescription": "Bu kuruluşa eklenebilecek yeni bir etiket oluşturun",
+    "labelEdit": "Etiketi Düzenle",
+    "editLabelDialogTitle": "Etiketi Güncelle",
+    "editLabelDialogDescription": "Bu kuruluşa eklenebilecek yeni bir etiketi düzenleyin",
+    "labelDeleteConfirm": "Etiketi Silmeyi Onayla",
+    "labelErrorDelete": "Etiket silinirken hata oluştu",
+    "labelMessageRemove": "Bu işlem kalıcıdır. Bu etiket ile etiketlenmiş tüm siteler, kaynaklar ve kullanıcılar etiketsiz kalacaktır.",
+    "labelQuestionRemove": "Etiketi organizasyondan kaldırmak istediğinizden emin misiniz?",
    "visibility": "Görünürlük",
    "enabled": "Etkin",
    "disabled": "Devre Dışı",
@@ -265,6 +311,8 @@
    "rules": "Kurallar",
    "resourceSettingDescription": "Kaynağınızdaki ayarları yapılandırın",
    "resourceSetting": "{resourceName} Ayarları",
+    "resourcePolicySettingDescription": "Kaynak politikası üzerindeki ayarları yapılandır",
+    "resourcePolicySetting": "{policyName} Ayarları",
    "alwaysAllow": "Kimlik Doğrulamayı Atla",
    "alwaysDeny": "Erişimi Engelle",
    "passToAuth": "Kimlik Doğrulamasına Geç",
@@ -630,7 +678,7 @@
    "createdAt": "Oluşturulma Tarihi",
    "proxyErrorInvalidHeader": "Geçersiz özel Ana Bilgisayar Başlığı değeri. Alan adı formatını kullanın veya özel Ana Bilgisayar Başlığını ayarlamak için boş bırakın.",
    "proxyErrorTls": "Geçersiz TLS Sunucu Adı. Alan adı formatını kullanın veya TLS Sunucu Adını kaldırmak için boş bırakılsın.",
-    "proxyEnableSSL": "TLS Etkinleştir",
+    "proxyEnableSSL": "TLS'yi Etkinleştir",
    "proxyEnableSSLDescription": "Hedeflere güvenli HTTPS bağlantıları için SSL/TLS şifrelemesini etkinleştirin.",
    "target": "Hedef",
    "configureTarget": "Hedefleri Yapılandır",
@@ -747,6 +795,16 @@
    "rulesNoOne": "Kural yok. Formu kullanarak bir kural ekleyin.",
    "rulesOrder": "Kurallar, artan öncelik sırasına göre değerlendirilir.",
    "rulesSubmit": "Kuralları Kaydet",
+    "policyErrorCreate": "Politika oluşturulurken hata oluştu",
+    "policyErrorCreateDescription": "Politikayı oluştururken bir hata oluştu",
+    "policyErrorCreateMessageDescription": "Beklenmeyen bir hata oluştu",
+    "policyErrorUpdate": "Politika güncellenirken hata oluştu",
+    "policyErrorUpdateDescription": "Policayı güncellerken bir hata oluştu",
+    "policyErrorUpdateMessageDescription": "Beklenmeyen bir hata oluştu",
+    "policyCreatedSuccess": "Kaynak politikası başarıyla oluşturuldu",
+    "policyUpdatedSuccess": "Kaynak politikası başarıyla güncellendi",
+    "authMethodsSave": "Kimlik doğrulama yöntemlerini kaydet",
+    "rulesSave": "Kuralları Kaydet",
    "resourceErrorCreate": "Kaynak oluşturma hatası",
    "resourceErrorCreateDescription": "Kaynak oluşturulurken bir hata oluştu",
    "resourceErrorCreateMessage": "Kaynak oluşturma hatası:",
@@ -810,6 +868,17 @@
    "pincodeAdd": "PIN Kodu Ekle",
    "pincodeRemove": "PIN Kodu Kaldır",
    "resourceAuthMethods": "Kimlik Doğrulama Yöntemleri",
+    "resourcePolicyAuthMethodsEmpty": "Kimlik doğrulama yöntemi yok",
+    "resourcePolicyOtpEmpty": "Tek seferlik parola yok",
+    "resourcePolicyReadOnly": "Bu politika yalnızca okumalıdır",
+    "resourcePolicyReadOnlyDescription": "Bu kaynak politikası birden fazla kaynakla paylaşılmaktadır, bu sayfada düzenleyemezsiniz.",
+    "editSharedPolicy": "Paylaşılan Politikayı Düzenle",
+    "resourcePolicyTypeSave": "Kaynak türünü kaydet",
+    "resourcePolicySelect": "Kaynak politikasını seçin",
+    "resourcePolicySelectError": "Bir kaynak politikası seçin",
+    "resourcePolicyNotFound": "Politika bulunamadı",
+    "resourcePolicySearch": "Politikaları ara",
+    "resourcePolicyRulesEmpty": "Kimlik doğrulama kuralı yok",
    "resourceAuthMethodsDescriptions": "Ek kimlik doğrulama yöntemleriyle kaynağa erişime izin verin",
    "resourceAuthSettingsSave": "Başarıyla kaydedildi",
    "resourceAuthSettingsSaveDescription": "Kimlik doğrulama ayarları kaydedildi",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "Pincode Ayarla",
    "resourcePincodeSetupTitleDescription": "Bu kaynağı korumak için bir pincode ayarlayın",
    "resourceRoleDescription": "Yöneticiler her zaman bu kaynağa erişebilir.",
+    "resourcePolicySelectTitle": "Kaynak Erişim Politikası",
+    "resourcePolicySelectDescription": "Kimlik doğrulama için kaynak politika türünü seçin",
+    "resourcePolicyInline": "Satır İçi Kaynak Politikası",
+    "resourcePolicyInlineDescription": "Erişim Politikası sadece bu kaynağa yönelik",
+    "resourcePolicyShared": "Paylaşılan Kaynak Politikası",
+    "resourcePolicySharedDescription": "Bu kaynak paylaşılan bir politika kullanır. Politika düzeyindeki ayarlar (kimlik doğrulama yöntemleri, e-posta beyaz listesi) kilitlidir. Aşağıda, kaynakla ilgili özel kurallar, roller ve kullanıcılar ekleyebilirsiniz.",
    "resourceUsersRoles": "Erişim Kontrolleri",
    "resourceUsersRolesDescription": "Bu kaynağı kimlerin ziyaret edebileceği kullanıcıları ve rolleri yapılandırın",
    "resourceUsersRolesSubmit": "Erişim Kontrollerini Kaydet",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "{name} ile bağlantı kurarken bir sorun meydana geldi. Lütfen yöneticiye danışın.",
    "idpErrorNotFound": "IdP bulunamadı",
    "inviteInvalid": "Geçersiz Davet",
+    "labels": "Etiketler",
+    "orgLabelsDescription": "Bu organizasyondaki etiketleri yönetin.",
+    "addLabels": "Etiketler ekle",
+    "siteLabelsTab": "Etiketler",
+    "siteLabelsDescription": "Bu siteyle ilişkili etiketleri yönetin.",
+    "labelsNotFound": "Etiketler bulunamadı",
+    "labelSearch": "Etiket ara",
+    "accessLabelFilterCount": "{count, plural, one {# etiket} other {# etiketler}}",
+    "labelOverflowCount": "+{count, plural, one {# etiket} other {# etiketler}}",
+    "accessLabelFilterClear": "Etiket filtrelerini temizle",
+    "selectColor": "Renk seç",
+    "createNewLabel": "Yeni kuruluş etiketi \"{label}\" oluştur",
    "inviteInvalidDescription": "Davet bağlantısı geçersiz.",
    "inviteErrorWrongUser": "Davet bu kullanıcı için değil",
    "inviteErrorUserNotExists": "Kullanıcı mevcut değil. Lütfen önce bir hesap oluşturun.",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "Kaynaklar",
    "sidebarProxyResources": "Herkese Açık",
    "sidebarClientResources": "Özel",
+    "sidebarPolicies": "Politikalar",
+    "sidebarResourcePolicies": "Kaynaklar",
    "sidebarAccessControl": "Erişim Kontrolü",
    "sidebarLogsAndAnalytics": "Kayıtlar & Analitik",
    "sidebarTeam": "Ekip",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "Site {id}",
    "standaloneHcFilterResourceIdFallback": "Kaynak {id}",
    "blueprints": "Planlar",
-    "blueprintsDescription": "Deklaratif yapılandırmaları uygulayın ve önceki çalışmaları görüntüleyin",
+    "blueprintsLog": "Şablonlar Günlüğü",
+    "blueprintsDescription": "Geçmiş şablon uygulamalarını ve sonuçlarını görüntüleyin",
    "blueprintAdd": "Plan Ekle",
    "blueprintGoBack": "Tüm Planları Gör",
    "blueprintCreate": "Plan Oluştur",
@@ -1575,7 +1665,17 @@
    "contents": "İçerik",
    "parsedContents": "Verilerin Ayrıştırılmış İçeriği (Salt Okunur)",
    "enableDockerSocket": "Docker Soketini Etkinleştir",
-    "enableDockerSocketDescription": "Plan etiketleri için Docker Socket etiket toplamasını etkinleştirin. Newt'e soket yolu sağlanmalıdır.",
+    "enableDockerSocketDescription": "Plan etiketleri için Docker Socket etiket toplamasını etkinleştirin. Site bağlantısına soket yolu sağlanmalıdır. Bunun nasıl çalıştığını <docsLink>belgelemede</docsLink> okuyun.",
+    "newtAutoUpdate": "Site Otomatik-Güncellemesini Etkinleştir",
+    "newtAutoUpdateDescription": "Etkinleştirildiğinde, site bağdaştırıcıları yeni sürüm mevcut olduğunda otomatik olarak en son sürüme güncellenecek.",
+    "siteAutoUpdate": "Site Otomatik-Güncellemesi",
+    "siteAutoUpdateLabel": "Otomatik Güncellemeyi Etkinleştir",
+    "siteAutoUpdateDescription": "Bu sitenin bağdaştırıcısının en son sürümü otomatik olarak indirip indirmeyeceğini kontrol edin.",
+    "siteAutoUpdateOrgDefault": "Kuruluş varsayılanı: {state}",
+    "siteAutoUpdateOverriding": "Kuruluş ayarını geçersiz kılıyor",
+    "siteAutoUpdateResetToOrg": "Kuruluş Varsayılanına Sıfırla",
+    "siteAutoUpdateEnabled": "etkin",
+    "siteAutoUpdateDisabled": "devre dışı",
    "viewDockerContainers": "Docker Konteynerlerini Görüntüle",
    "containersIn": "{siteName} içindeki konteynerler",
    "selectContainerDescription": "Bu hedef için bir ana bilgisayar adı olarak kullanmak üzere herhangi bir konteyner seçin. Bir bağlantı noktası kullanmak için bir bağlantı noktasına tıklayın.",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "Sertifika",
    "certificateStatusAutoRefreshHint": "Durum otomatik olarak yenilenir.",
    "loading": "Yükleniyor",
+    "loadingEllipsis": "Yükleniyor...",
    "loadingAnalytics": "Analiz Yükleniyor",
    "restart": "Yeniden Başlat",
    "domains": "Alan Adları",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "Kendi barındırdığınız ücretli lisans anahtarları için aboneliğinizi yönetin",
    "billingCurrentKeys": "Mevcut Anahtarlar",
    "billingModifyCurrentPlan": "Mevcut Planı Düzenle",
+    "billingManageLicenseSubscriptionDescription": "Ücretli kendi barındırdığı lisans anahtarları için aboneliğinizi yönetin ve faturaları indirin.",
    "billingConfirmUpgrade": "Yükseltmeyi Onayla",
    "billingConfirmDowngrade": "Düşürmeyi Onayla",
    "billingConfirmUpgradeDescription": "Planınızı yükseltmek üzeresiniz. Yeni limitleri ve fiyatları aşağıda inceleyin.",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "Zaman saniye cinsindendir",
    "requireDeviceApproval": "Cihaz Onaylarını Gerektir",
    "requireDeviceApprovalDescription": "Bu role sahip kullanıcıların yeni cihazlarının bağlanabilmesi ve kaynaklara erişebilmesi için bir yönetici tarafından onaylanması gerekiyor.",
-    "sshAccess": "SSH Erişimi",
+    "sshSettings": "SSH Ayarları",
+    "rdpSettings": "RDP Ayarları",
+    "vncSettings": "VNC Ayarları",
+    "sshServer": "SSH Sunucusu",
+    "rdpServer": "RDP Sunucusu",
+    "vncServer": "VNC Sunucusu",
+    "sshServerDescription": "Kimlik doğrulama yöntemi, daemon konumu ve sunucu hedefini ayarlayın",
+    "rdpServerDescription": "RDP sunucusunun hedefini ve bağlantı noktasını yapılandırın",
+    "vncServerDescription": "VNC sunucusunun hedefini ve bağlantı noktasını yapılandırın",
+    "sshServerMode": "Mod",
+    "sshServerModeStandard": "Standart SSH Sunucusu",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Ağ üzerinden OpenSSH gibi bir SSH sunucusuna komutlar gönderir.",
+    "sshServerModeNative": "Yerel SSH Sunucusu",
+    "sshServerModeNativeDescription": "Site Bağlayıcısı üzerinden doğrudan ana bilgisayarda komutları çalıştırır. Ağ yapılandırması gerekmez.",
+    "sshAuthenticationMethod": "Kimlik Doğrulama Yöntemi",
+    "sshAuthMethodManual": "Manuel Kimlik Doğrulama",
+    "sshAuthMethodManualDescription": "Mevcut ana bilgisayar kimlik bilgileri gerektiriyor. Otomatik sağlama işlemini atlar.",
+    "sshAuthMethodAutomated": "Otomatik Sağlama",
+    "sshAuthMethodAutomatedDescription": "Ana bilgisayarda otomatik olarak kullanıcılar, gruplar ve sudo izinleri oluşturur.",
+    "sshAuthDaemonLocation": "Kimlik Doğrulama Daemon Konumu",
+    "sshDaemonLocationSiteDescription": "Site bağdaştırıcısını misafir eden makinada yerel olarak çalıştırır.",
+    "sshDaemonLocationRemote": "Uzak Ana Bilgisayarda",
+    "sshDaemonLocationRemoteDescription": "Aynı ağda ayrı bir hedef makinede çalıştırır.",
+    "sshDaemonDisclaimer": "Bu kurulumu tamamlamadan önce hedef ana bilgisayarınızın kimlik doğrulama daemonunu çalıştıracak şekilde düzgün yapılandırıldığından emin olun, aksi takdirde sağlama başarısız olur.",
+    "sshDaemonPort": "Daemon Bağlantı Noktası",
+    "sshServerDestination": "Sunucu Hedefi",
+    "sshServerDestinationDescription": "SSH sunucusunun hedefini ve bağlantı noktasını yapılandırın",
+    "destination": "Hedef",
+    "bgTargetMultiSiteDisclaimer": "Birden fazla site seçmek, yüksek erişilebilirlik için dayanıklı yönlendirme ve failover sağlar.",
    "roleAllowSsh": "SSH'a İzin Ver",
    "roleAllowSshAllow": "İzin Ver",
    "roleAllowSshDisallow": "İzin Verme",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "Kullanıcı sadece belirtilen komutları sudo ile çalıştırabilir.",
    "sshSudo": "Sudo'ya izin ver",
    "sshSudoCommands": "Sudo Komutları",
-    "sshSudoCommandsDescription": "Kullanıcının sudo ile çalıştırmasına izin verilen komutların virgülle ayrılmış listesi.",
+    "sshSudoCommandsDescription": "Kullanıcının sudo ile çalıştırmasına izin verilen komutların virgülle ayrılmış listesi. Mutlak yollar kullanılmalıdır.",
    "sshCreateHomeDir": "Ev Dizini Oluştur",
    "sshUnixGroups": "Unix Grupları",
    "sshUnixGroupsDescription": "Hedef konakta kullanıcıya eklenecek Unix gruplarının virgülle ayrılmış listesi.",
@@ -2051,7 +2182,7 @@
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Şema",
-    "editInternalResourceDialogEnableSsl": "TLS Etkinleştir",
+    "editInternalResourceDialogEnableSsl": "TLS'yi Etkinleştir",
    "editInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
    "editInternalResourceDialogDestination": "Hedef",
    "editInternalResourceDialogDestinationHostDescription": "Site ağındaki kaynağın IP adresi veya ana bilgisayar adı.",
@@ -2939,7 +3070,7 @@
    "learnMore": "Daha fazla bilgi",
    "backToHome": "Ana sayfaya geri dön",
    "needToSignInToOrg": "Kuruluşunuzun kimlik sağlayıcısını kullanmanız mı gerekiyor?",
-    "maintenanceMode": "Bakım Modu",
+    "maintenanceMode": "Bakım Sayfası",
    "maintenanceModeDescription": "Ziyaretçilere bir bakım sayfası gösterin",
    "maintenanceModeType": "Bakım Modu Türü",
    "showMaintenancePage": "Ziyaretçilere bir bakım sayfası gösterin",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "Tahmini Tamamlama:",
    "createInternalResourceDialogDestinationRequired": "Hedef gereklidir",
    "available": "Mevcut",
+    "disabledResourceDescription": "Devre dışı bırakıldığında, kaynağa herkes erişemez.",
    "archived": "Arşivlenmiş",
    "noArchivedDevices": "Arşivlenmiş cihaz bulunamadı",
    "deviceArchived": "Cihaz arşivlendi",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "Kaynak Devre Dışı",
    "memberPortalShowingResources": "{total} kaynaktan {start}-{end} gösteriliyor",
    "memberPortalPrevious": "Önceki",
-    "memberPortalNext": "Sonraki"
+    "memberPortalNext": "Sonraki",
+    "httpSettings": "HTTP Ayarları",
+    "tcpSettings": "TCP Ayarları",
+    "udpSettings": "UDP Ayarları",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "Güvenli bir bağlantı kuruluyor…",
+    "sshConnecting": "Bağlanılıyor…",
+    "sshInitializing": "Başlatılıyor…",
+    "sshSignInTitle": "SSH'a Giriş Yap",
+    "sshSignInDescription": "SSH kimlik bilgilerinizi girin",
+    "sshPasswordTab": "Şifre",
+    "sshPrivateKeyTab": "Özel Anahtar",
+    "sshPrivateKeyField": "Özel Anahtar",
+    "sshPrivateKeyDisclaimer": "Özel anahtarınız Pangolin'de saklanmaz veya görünmez. Alternatif olarak, mevcut Pangolin kimliğinizle sorunsuz kimlik doğrulama için kısa ömürlü sertifikalar kullanabilirsiniz.",
+    "sshLearnMore": "Daha fazla bilgi",
+    "sshPrivateKeyFile": "Özel Anahtar Dosyası",
+    "sshAuthenticate": "Kimlik Doğrulama",
+    "sshTerminate": "Sonlandır",
+    "sshPoweredBy": "Tarafından sağlanmaktadır",
+    "sshErrorNoTarget": "Belirtilen hedef yok",
+    "sshErrorWebSocket": "WebSocket bağlantısı başarısız oldu",
+    "sshErrorAuthFailed": "Kimlik doğrulama başarısız",
+    "sshErrorConnectionClosed": "Kimlik doğrulama tamamlanmadan bağlantı kapandı"
 }
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -176,6 +176,7 @@
    "shareErrorCreateDescription": "创建共享链接时出错",
    "shareCreateDescription": "任何具有此链接的人都可以访问资源",
    "shareTitleOptional": "标题 (可选)",
+    "sharePathOptional": "路径（可选）",
    "expireIn": "过期时间",
    "neverExpire": "永不过期",
    "shareExpireDescription": "过期时间是链接可以使用并提供对资源的访问时间。 此时间后，链接将不再工作，使用此链接的用户将失去对资源的访问。",
@@ -208,11 +209,33 @@
    "resourcesSearch": "搜索资源...",
    "resourceAdd": "添加资源",
    "resourceErrorDelte": "删除资源时出错",
+    "resourcePoliciesTitle": "管理资源策略",
+    "resourcePoliciesAttachedResourcesColumnTitle": "附加资源",
+    "resourcePoliciesAttachedResources": "{count} 个资源",
+    "resourcePoliciesAttachedResourcesEmpty": "没有资源",
+    "resourcePoliciesDescription": "创建和管理身份验证策略以控制对资源的访问",
+    "resourcePoliciesSearch": "搜索策略……",
+    "resourcePoliciesAdd": "添加策略",
+    "resourcePoliciesDefaultBadgeText": "默认策略",
+    "resourcePoliciesCreate": "创建资源策略",
+    "resourcePoliciesCreateDescription": "按照以下步骤创建新策略",
+    "resourcePolicyName": "策略名称",
+    "resourcePolicyNameDescription": "给此策略命名，以便在您的资源中识别它",
+    "resourcePolicyNamePlaceholder": "例如：内部访问策略",
+    "resourcePoliciesSeeAll": "查看所有策略",
+    "resourcePolicyAuthMethodAdd": "添加身份验证方法",
+    "resourcePolicyOtpEmailAdd": "添加 OTP 电子邮件",
+    "resourcePolicyRulesAdd": "添加规则",
+    "resourcePolicyAuthMethodsDescription": "通过额外的认证方法允许访问资源",
+    "resourcePolicyUsersRolesDescription": "配置哪些用户和角色可以访问关联的资源",
+    "rulesResourcePolicyDescription": "配置规则以控制与此策略关联的访问资源",
    "authentication": "认证",
    "protected": "受到保护",
    "notProtected": "未受到保护",
    "resourceMessageRemove": "一旦删除，资源将不再可访问。与该资源相关的所有目标也将被删除。",
    "resourceQuestionRemove": "您确定要从组织中删除资源吗？",
+    "resourcePolicyMessageRemove": "一旦删除，资源策略将不再可访问。所有与资源关联的资源将取消关联，并且没有身份验证。",
+    "resourcePolicyQuestionRemove": "您确定要从组织中删除资源策略吗？",
    "resourceHTTP": "HTTPS 资源",
    "resourceHTTPDescription": "通过使用完全限定的域名的HTTPS代理请求。",
    "resourceRaw": "TCP/UDP 资源",
@@ -220,8 +243,9 @@
    "resourceRawDescriptionCloud": "正在使用端口号使用 TCP/UDP 代理请求。需要站点连接到远程节点。",
    "resourceCreate": "创建资源",
    "resourceCreateDescription": "按照下面的步骤创建新资源",
+    "resourceCreateGeneralDescription": "配置基本资源设置，包括名称和类型",
    "resourceSeeAll": "查看所有资源",
-    "resourceInfo": "资源信息",
+    "resourceCreateGeneral": "概览",
    "resourceNameDescription": "这是资源的显示名称。",
    "siteSelect": "选择站点",
    "siteSearch": "搜索站点",
@@ -231,12 +255,15 @@
    "noCountryFound": "找不到国家。",
    "siteSelectionDescription": "此站点将为目标提供连接。",
    "resourceType": "资源类型",
-    "resourceTypeDescription": "确定如何访问资源",
+    "resourceTypeDescription": "这会控制资源协议及其在浏览器中的渲染方式。之后不能更改。",
+    "resourceDomainDescription": "资源将在此完全限定的域名上提供。",
    "resourceHTTPSSettings": "HTTPS 设置",
    "resourceHTTPSSettingsDescription": "配置如何通过 HTTPS 访问资源",
+    "resourcePortDescription": "在 Pangolin 实例或节点上资源可访问的外部端口。",
    "domainType": "域类型",
    "subdomain": "子域名",
    "baseDomain": "根域名",
+    "configure": "配置",
    "subdomnainDescription": "可访问资源的子域。",
    "resourceRawSettings": "TCP/UDP 设置",
    "resourceRawSettingsDescription": "配置如何通过 TCP/UDP 访问资源",
@@ -253,8 +280,27 @@
    "resourceLearnRaw": "学习如何配置 TCP/UDP 资源",
    "resourceBack": "返回资源",
    "resourceGoTo": "转到资源",
+    "resourcePolicyDelete": "删除资源策略",
+    "resourcePolicyDeleteConfirm": "确认删除资源策略",
    "resourceDelete": "删除资源",
    "resourceDeleteConfirm": "确认删除资源",
+    "labelDelete": "删除标签",
+    "labelAdd": "添加标签",
+    "labelCreateSuccessMessage": "标签创建成功",
+    "labelEditSuccessMessage": "标签修改成功",
+    "labelNameField": "标签名称",
+    "labelColorField": "标签颜色",
+    "labelPlaceholder": "例：homelab",
+    "labelCreate": "创建标签",
+    "createLabelDialogTitle": "创建标签",
+    "createLabelDialogDescription": "创建一个可以附加到此组织的新标签",
+    "labelEdit": "编辑标签",
+    "editLabelDialogTitle": "更新标签",
+    "editLabelDialogDescription": "编辑一个可以附加到此组织的标签",
+    "labelDeleteConfirm": "确认删除标签",
+    "labelErrorDelete": "删除标签失败",
+    "labelMessageRemove": "此操作是永久性的。所有用此标签标记的网站、资源和客户端将取消标记。",
+    "labelQuestionRemove": "您确定要将标签从组织中移除吗？",
    "visibility": "可见性",
    "enabled": "已启用",
    "disabled": "已禁用",
@@ -265,6 +311,8 @@
    "rules": "规则",
    "resourceSettingDescription": "配置资源上的设置",
    "resourceSetting": "{resourceName} 设置",
+    "resourcePolicySettingDescription": "配置资源策略上的设置",
+    "resourcePolicySetting": "{policyName} 设置",
    "alwaysAllow": "旁路认证",
    "alwaysDeny": "屏蔽访问",
    "passToAuth": "传递至认证",
@@ -747,6 +795,16 @@
    "rulesNoOne": "没有规则。使用表单添加规则。",
    "rulesOrder": "规则按优先顺序评定。",
    "rulesSubmit": "保存规则",
+    "policyErrorCreate": "创建策略时出错",
+    "policyErrorCreateDescription": "创建策略时发生错误",
+    "policyErrorCreateMessageDescription": "发生意外错误",
+    "policyErrorUpdate": "更新策略时出错",
+    "policyErrorUpdateDescription": "更新策略时发生错误",
+    "policyErrorUpdateMessageDescription": "发生意外错误",
+    "policyCreatedSuccess": "资源策略创建成功",
+    "policyUpdatedSuccess": "资源策略更新成功",
+    "authMethodsSave": "保存身份验证方法",
+    "rulesSave": "保存规则",
    "resourceErrorCreate": "创建资源时出错",
    "resourceErrorCreateDescription": "创建资源时出错",
    "resourceErrorCreateMessage": "创建资源时发生错误：",
@@ -810,6 +868,17 @@
    "pincodeAdd": "添加 PIN 码",
    "pincodeRemove": "移除 PIN 码",
    "resourceAuthMethods": "身份验证方法",
+    "resourcePolicyAuthMethodsEmpty": "无身份验证方法",
+    "resourcePolicyOtpEmpty": "没有一次性密码",
+    "resourcePolicyReadOnly": "此策略是只读的",
+    "resourcePolicyReadOnlyDescription": "此资源策略跨多个资源共享，您无法在此页面上编辑。",
+    "editSharedPolicy": "编辑共享策略",
+    "resourcePolicyTypeSave": "保存资源类型",
+    "resourcePolicySelect": "选择资源策略",
+    "resourcePolicySelectError": "选择资源策略",
+    "resourcePolicyNotFound": "找不到策略",
+    "resourcePolicySearch": "搜索策略",
+    "resourcePolicyRulesEmpty": "无身份验证规则",
    "resourceAuthMethodsDescriptions": "允许通过额外的认证方法访问资源",
    "resourceAuthSettingsSave": "保存成功",
    "resourceAuthSettingsSaveDescription": "已保存身份验证设置",
@@ -845,6 +914,12 @@
    "resourcePincodeSetupTitle": "设置 PIN 码",
    "resourcePincodeSetupTitleDescription": "设置 PIN 码来保护此资源",
    "resourceRoleDescription": "管理员总是可以访问此资源。",
+    "resourcePolicySelectTitle": "资源访问策略",
+    "resourcePolicySelectDescription": "选择用于认证的资源策略类型",
+    "resourcePolicyInline": "内联资源策略",
+    "resourcePolicyInlineDescription": "仅限于此资源的访问策略",
+    "resourcePolicyShared": "共享资源策略",
+    "resourcePolicySharedDescription": "此资源使用共享策略。策略级设置（身份验证方法、电子邮件白名单）被锁定。您可以在下方添加特定资源的规则、角色和用户。",
    "resourceUsersRoles": "访问控制",
    "resourceUsersRolesDescription": "配置用户和角色可以访问此资源",
    "resourceUsersRolesSubmit": "保存访问控制",
@@ -1140,6 +1215,18 @@
    "idpErrorConnectingTo": "无法连接到 {name}，请联系管理员协助处理。",
    "idpErrorNotFound": "找不到 IdP",
    "inviteInvalid": "无效邀请",
+    "labels": "标签",
+    "orgLabelsDescription": "管理此组织的标签。",
+    "addLabels": "添加标签",
+    "siteLabelsTab": "标签",
+    "siteLabelsDescription": "管理与此网站相关的标签。",
+    "labelsNotFound": "找不到标签",
+    "labelSearch": "搜索标签",
+    "accessLabelFilterCount": "{count, plural, other {# 标签}}",
+    "labelOverflowCount": "+{count, plural, other {# 标签}}",
+    "accessLabelFilterClear": "清除标签过滤器",
+    "selectColor": "选择颜色",
+    "createNewLabel": "创建新的组织标签 \"{label}\"",
    "inviteInvalidDescription": "邀请链接无效。",
    "inviteErrorWrongUser": "邀请不是该用户的",
    "inviteErrorUserNotExists": "用户不存在。请先创建帐户。",
@@ -1374,6 +1461,8 @@
    "sidebarResources": "资源",
    "sidebarProxyResources": "公开的",
    "sidebarClientResources": "非公开的",
+    "sidebarPolicies": "策略",
+    "sidebarResourcePolicies": "资源",
    "sidebarAccessControl": "访问控制",
    "sidebarLogsAndAnalytics": "日志与分析",
    "sidebarTeam": "团队",
@@ -1557,7 +1646,8 @@
    "standaloneHcFilterSiteIdFallback": "站点 {id}",
    "standaloneHcFilterResourceIdFallback": "资源 {id}",
    "blueprints": "蓝图",
-    "blueprintsDescription": "应用声明配置并查看先前运行的",
+    "blueprintsLog": "蓝图日志",
+    "blueprintsDescription": "查看过去的蓝图应用及其结果",
    "blueprintAdd": "添加蓝图",
    "blueprintGoBack": "查看所有蓝图",
    "blueprintCreate": "创建蓝图",
@@ -1575,7 +1665,17 @@
    "contents": "目录",
    "parsedContents": "解析内容 (只读)",
    "enableDockerSocket": "启用 Docker 蓝图",
-    "enableDockerSocketDescription": "启用 Docker Socket 标签擦除蓝图标签。套接字路径必须提供给新的。",
+    "enableDockerSocketDescription": "启用用于蓝图标签的 Docker 套接字标签擦除。必须为站点连接器提供套接字路径。阅读<docsLink>文档</docsLink>以了解相关工作原理。",
+    "newtAutoUpdate": "启用站点自动更新",
+    "newtAutoUpdateDescription": "启用时，站点连接器将在有新版本发布时自动更新到最新版本。",
+    "siteAutoUpdate": "站点自动更新",
+    "siteAutoUpdateLabel": "启用自动更新",
+    "siteAutoUpdateDescription": "控制此站点连接器是否自动下载最新版本。",
+    "siteAutoUpdateOrgDefault": "组织默认设置：{state}",
+    "siteAutoUpdateOverriding": "覆盖组织设置",
+    "siteAutoUpdateResetToOrg": "重置为组织默认设置",
+    "siteAutoUpdateEnabled": "已启用",
+    "siteAutoUpdateDisabled": "已禁用",
    "viewDockerContainers": "查看停靠容器",
    "containersIn": "{siteName} 中的容器",
    "selectContainerDescription": "选择任何容器作为目标的主机名。点击端口使用端口。",
@@ -1620,6 +1720,7 @@
    "certificateStatus": "证书",
    "certificateStatusAutoRefreshHint": "状态自动刷新。",
    "loading": "加载中",
+    "loadingEllipsis": "加载中……",
    "loadingAnalytics": "加载分析",
    "restart": "重启",
    "domains": "域",
@@ -1846,6 +1947,7 @@
    "billingManageLicenseSubscription": "管理您对付费的自托管许可证密钥的订阅",
    "billingCurrentKeys": "当前密钥",
    "billingModifyCurrentPlan": "修改当前计划",
+    "billingManageLicenseSubscriptionDescription": "管理付费的自托管许可证密钥订阅并下载发票。",
    "billingConfirmUpgrade": "确认升级",
    "billingConfirmDowngrade": "确认降级",
    "billingConfirmUpgradeDescription": "您即将升级您的计划。请检查下面的新限额和定价。",
@@ -1943,7 +2045,36 @@
    "timeIsInSeconds": "时间以秒为单位",
    "requireDeviceApproval": "需要设备批准",
    "requireDeviceApprovalDescription": "具有此角色的用户需要管理员批准的新设备才能连接和访问资源。",
-    "sshAccess": "SSH 访问",
+    "sshSettings": "SSH 设置",
+    "rdpSettings": "RDP 设置",
+    "vncSettings": "VNC 设置",
+    "sshServer": "SSH 服务器",
+    "rdpServer": "RDP 服务器",
+    "vncServer": "VNC 服务器",
+    "sshServerDescription": "设置身份验证方法、守护程序位置和服务器目标",
+    "rdpServerDescription": "配置 RDP 服务器的目标和端口",
+    "vncServerDescription": "配置 VNC 服务器的目标和端口",
+    "sshServerMode": "模式",
+    "sshServerModeStandard": "标准 SSH 服务器",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "将命令通过网络路由到 SSH 服务器，例如 OpenSSH。",
+    "sshServerModeNative": "本地 SSH 服务器",
+    "sshServerModeNativeDescription": "通过站点连接器直接在主机上执行命令。无需网络配置。",
+    "sshAuthenticationMethod": "身份验证方法",
+    "sshAuthMethodManual": "手动身份验证",
+    "sshAuthMethodManualDescription": "需要现有的主机凭据。绕过自动配置。",
+    "sshAuthMethodAutomated": "自动配置",
+    "sshAuthMethodAutomatedDescription": "在主机上自动创建用户、组和sudo权限。",
+    "sshAuthDaemonLocation": "认证守护程序位置",
+    "sshDaemonLocationSiteDescription": "在托管站点连接器的机器上本地执行。",
+    "sshDaemonLocationRemote": "在远程主机上",
+    "sshDaemonLocationRemoteDescription": "在同一网络的独立目标机器上执行。",
+    "sshDaemonDisclaimer": "在完成本设置之前，请确保您的目标主机已经正确配置以运行身份验证守护程序，否则配置将失败。",
+    "sshDaemonPort": "守护程序端口",
+    "sshServerDestination": "服务器目标",
+    "sshServerDestinationDescription": "配置 SSH 服务器的目标和端口",
+    "destination": "目标",
+    "bgTargetMultiSiteDisclaimer": "选择多个站点可实现高可用性的弹性路由和故障转移。",
    "roleAllowSsh": "允许 SSH",
    "roleAllowSshAllow": "允许",
    "roleAllowSshDisallow": "不允许",
@@ -1957,7 +2088,7 @@
    "sshSudoModeCommandsDescription": "用户只能用 sudo 运行指定的命令。",
    "sshSudo": "允许Sudo",
    "sshSudoCommands": "Sudo 命令",
-    "sshSudoCommandsDescription": "逗号分隔的用户允许使用 sudo 运行的命令列表。",
+    "sshSudoCommandsDescription": "逗号分隔的命令列表，用户可以通过sudo运行。必须使用绝对路径。",
    "sshCreateHomeDir": "创建主目录",
    "sshUnixGroups": "Unix 组",
    "sshUnixGroupsDescription": "用逗号分隔了Unix组，将用户添加到目标主机上。",
@@ -2235,7 +2366,7 @@
        "description": "更可靠和低维护自我托管的 Pangolin 服务器，带有额外的铃声和告密器",
        "introTitle": "托管自托管的潘戈林公司",
        "introDescription": "这是一种部署选择，为那些希望简洁和额外可靠的人设计，同时仍然保持他们的数据的私密性和自我托管性。",
-        "introDetail": "通过此选项，您仍然运行您自己的 Pangolin 节点 - - 您的隧道、TLS 终止，并且流量在您的服务器上保持所有状态。 不同之处在于，管理和监测是通过我们的云层仪表板进行的，该仪表板开启了一些好处：",
+        "introDetail": "通过此选项，您仍然运行您自己的 Pangolin 节点 - 您的隧道、TLS 终止，并且流量在您的服务器上保持所有状态。不同之处在于，管理和监测是通过我们的云层仪表板进行的，该仪表板开启了一些好处：",
        "benefitSimplerOperations": {
            "title": "简单的操作",
            "description": "无需运行您自己的邮件服务器或设置复杂的警报。您将从方框中获得健康检查和下限提醒。"
@@ -2939,7 +3070,7 @@
    "learnMore": "了解更多",
    "backToHome": "返回首页",
    "needToSignInToOrg": "需要使用您组织的身份提供商吗？",
-    "maintenanceMode": "维护模式",
+    "maintenanceMode": "维护页面",
    "maintenanceModeDescription": "向访客显示维护页面",
    "maintenanceModeType": "维护模式类型",
    "showMaintenancePage": "只在所有后端目标都故障或不健康时显示维护页面。只要至少一个目标健康，您的资源将正常工作。",
@@ -2969,6 +3100,7 @@
    "maintenanceScreenEstimatedCompletion": "预计完成时间：",
    "createInternalResourceDialogDestinationRequired": "需要目标地址",
    "available": "可用",
+    "disabledResourceDescription": "禁用后，所有人都不可访问此资源。",
    "archived": "已存档",
    "noArchivedDevices": "未找到存档设备",
    "deviceArchived": "设备已存档",
@@ -3298,5 +3430,27 @@
    "memberPortalResourceDisabled": "资源已禁用",
    "memberPortalShowingResources": "显示 {start}-{end} 共 {total} 个资源",
    "memberPortalPrevious": "上一页",
-    "memberPortalNext": "下一页"
+    "memberPortalNext": "下一页",
+    "httpSettings": "HTTP 设置",
+    "tcpSettings": "TCP 设置",
+    "udpSettings": "UDP 设置",
+    "sshTitle": "SSH",
+    "sshConnectingDescription": "正在建立安全连接…",
+    "sshConnecting": "正在连接…",
+    "sshInitializing": "初始化中…",
+    "sshSignInTitle": "登录 SSH",
+    "sshSignInDescription": "输入您的 SSH 凭据",
+    "sshPasswordTab": "密码",
+    "sshPrivateKeyTab": "私钥",
+    "sshPrivateKeyField": "私钥",
+    "sshPrivateKeyDisclaimer": "您的私钥不会被 Pangolin 存储或显示。或者，您可以使用短期证书，使用您现有的 Pangolin 身份无缝认证。",
+    "sshLearnMore": "了解更多",
+    "sshPrivateKeyFile": "私钥文件",
+    "sshAuthenticate": "验证",
+    "sshTerminate": "终止",
+    "sshPoweredBy": "支持者",
+    "sshErrorNoTarget": "未指定目标",
+    "sshErrorWebSocket": "WebSocket 连接失败",
+    "sshErrorAuthFailed": "身份验证失败",
+    "sshErrorConnectionClosed": "认证完成前连接已关闭"
 }
--- a/server/db/pg/schema/privateSchema.ts
+++ b/server/db/pg/schema/privateSchema.ts
@@ -2,7 +2,6 @@ import {
    pgTable,
    serial,
    varchar,
-    unique,
    boolean,
    integer,
    bigint,
@@ -20,13 +19,12 @@ import {
    roles,
    users,
    exitNodes,
+    sessions,
+    clients,
    resources,
    siteResources,
    targetHealthCheck,
-    sites,
-    clients,
-    sessions,
-    labels
+    sites
 } from "./schema";

 export const certificates = pgTable("certificates", {
@@ -199,42 +197,6 @@ export const remoteExitNodes = pgTable("remoteExitNode", {
    })
 });

-export const remoteExitNodeResources = pgTable("remoteExitNodeResources", {
-    remoteExitNodeResourceId: serial("remoteExitNodeResourceId").primaryKey(),
-    remoteExitNodeId: varchar("remoteExitNodeId")
-        .notNull()
-        .references(() => remoteExitNodes.remoteExitNodeId, {
-            onDelete: "cascade"
-        }),
-    destination: varchar("destination").notNull() // a cidr range
-});
-
-export const remoteExitNodePreferenceLabels = pgTable(
-    // this controls what sites are enforced to connect to this node
-    "remoteExitNodePreferenceLabels",
-    {
-        remoteExitNodePreferenceLabelId: serial(
-            "remoteExitNodePreferenceLabelId"
-        ).primaryKey(),
-        remoteExitNode: integer("remoteExitNode")
-            .references(() => remoteExitNodes.remoteExitNodeId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [
-        unique("remote_exit_node_preference_label_uniq").on(
-            t.remoteExitNode,
-            t.labelId
-        )
-    ]
-);
-
 export const remoteExitNodeSessions = pgTable("remoteExitNodeSession", {
    sessionId: varchar("id").primaryKey(),
    remoteExitNodeId: varchar("remoteExitNodeId")
--- a/server/db/sqlite/schema/privateSchema.ts
+++ b/server/db/sqlite/schema/privateSchema.ts
@@ -12,7 +12,6 @@ import {
    clients,
    domains,
    exitNodes,
-    labels,
    orgs,
    resources,
    roles,
@@ -22,6 +21,9 @@ import {
    targetHealthCheck,
    users
 } from "./schema";
+import { serial, varchar } from "drizzle-orm/mysql-core";
+import { pgTable } from "drizzle-orm/pg-core";
+import { bigint } from "zod";

 export const certificates = sqliteTable("certificates", {
    certId: integer("certId").primaryKey({ autoIncrement: true }),
@@ -193,44 +195,6 @@ export const remoteExitNodes = sqliteTable("remoteExitNode", {
    })
 });

-export const remoteExitNodeResources = sqliteTable("remoteExitNodeResources", {
-    remoteExitNodeResourceId: integer("remoteExitNodeResourceId").primaryKey({
-        autoIncrement: true
-    }),
-    remoteExitNodeId: text("remoteExitNodeId")
-        .notNull()
-        .references(() => remoteExitNodes.remoteExitNodeId, {
-            onDelete: "cascade"
-        }),
-    destination: text("destination").notNull() // a cidr range
-});
-
-export const remoteExitNodePreferenceLabels = sqliteTable(
-    // this controls what sites are enforced to connect to this node
-    "remoteExitNodePreferenceLabels",
-    {
-        remoteExitNodePreferenceLabelId: integer(
-            "remoteExitNodePreferenceLabelId"
-        ).primaryKey({ autoIncrement: true }),
-        remoteExitNodeId: text("remoteExitNodeId")
-            .references(() => remoteExitNodes.remoteExitNodeId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [
-        uniqueIndex("remote_exit_node_preference_label_uniq").on(
-            t.remoteExitNodeId,
-            t.labelId
-        )
-    ]
-);
-
 export const remoteExitNodeSessions = sqliteTable("remoteExitNodeSession", {
    sessionId: text("id").primaryKey(),
    remoteExitNodeId: text("remoteExitNodeId")
--- a/server/lib/billing/usageService.ts
+++ b/server/lib/billing/usageService.ts
@@ -22,6 +22,7 @@ export function noop() {
 }

 export class UsageService {
+
    constructor() {
        if (noop()) {
            return;
@@ -56,10 +57,7 @@ export class UsageService {
            try {
                let usage;
                if (transaction) {
-                    const orgIdToUse = await this.getBillingOrg(
-                        orgId,
-                        transaction
-                    );
+                    const orgIdToUse = await this.getBillingOrg(orgId, transaction);
                    usage = await this.internalAddUsage(
                        orgIdToUse,
                        featureId,
@@ -276,12 +274,11 @@ export class UsageService {
            return null;
        }

-        let orgIdToUse = orgId;
+        const orgIdToUse = await this.getBillingOrg(orgId, trx);
+
+        const usageId = `${orgIdToUse}-${featureId}`;
+
        try {
-            orgIdToUse = await this.getBillingOrg(orgId, trx);
-
-            const usageId = `${orgIdToUse}-${featureId}`;
-
            const [result] = await trx
                .select()
                .from(usage)
@@ -341,12 +338,8 @@ export class UsageService {
                `Failed to get usage for ${orgIdToUse}/${featureId}:`,
                error
            );
-            if (process.env.NODE_ENV !== "development") {
-                throw error;
-            }
+            throw error;
        }
-
-        return null;
    }

    public async getBillingOrg(
@@ -389,13 +382,13 @@ export class UsageService {
            return false;
        }

+        const orgIdToUse = await this.getBillingOrg(orgId, trx);
+
        // This method should check the current usage against the limits set for the organization
        // and kick out all of the sites on the org
        let hasExceededLimits = false;
-        let orgIdToUse = orgId;
-        try {
-            orgIdToUse = await this.getBillingOrg(orgId, trx);

+        try {
            let orgLimits: Limit[] = [];
            if (featureId) {
                // Get all limits set for this organization
--- a/server/lib/ip.ts
+++ b/server/lib/ip.ts
@@ -665,7 +665,7 @@ export async function generateSubnetProxyTargetV2(
        return;
    }

-    let targets: SubnetProxyTargetV2[] = [];
+    const targets: SubnetProxyTargetV2[] = [];

    const portRange = [
        ...parsePortRangeString(siteResource.tcpPortRangeString, "tcp"),
--- a/server/lib/traefik/getTraefikConfig.ts
+++ b/server/lib/traefik/getTraefikConfig.ts
@@ -44,7 +44,8 @@ export async function getTraefikConfig(
    filterOutNamespaceDomains = false, // UNUSED BUT USED IN PRIVATE
    generateLoginPageRouters = false, // UNUSED BUT USED IN PRIVATE
    allowRawResources = true,
-    allowMaintenancePage = true // UNUSED BUT USED IN PRIVATE
+    allowMaintenancePage = true, // UNUSED BUT USED IN PRIVATE
+    allowBrowserGatewayResources = true
 ): Promise<any> {
    // Get resources with their targets and sites in a single optimized query
    // Start from sites on this exit node, then join to targets and resources
@@ -240,7 +241,7 @@ export async function getTraefikConfig(
            continue;
        }

-        if (resource.http) {
+        if (resource.mode === "http") {
            if (!resource.domainId || !resource.fullDomain) {
                continue;
            }
@@ -572,7 +573,7 @@ export async function getTraefikConfig(
                    serviceName
                ].loadBalancer.serversTransport = transportName;
            }
-        } else {
+        } else if (resource.mode === "tcp" || resource.mode === "udp") {
            // Non-HTTP (TCP/UDP) configuration
            if (!resource.enableProxy || !resource.proxyPort) {
                continue;
--- a/server/middlewares/verifySiteAccess.test.ts
+++ b/server/middlewares/verifySiteAccess.test.ts
@@ -0,0 +1,322 @@
+import { assertEquals } from "@test/assert";
+
+/**
+ * Tests for the cross-organization site binding prevention in verifySiteAccess.
+ *
+ * verifySiteAccess now includes a check: if req.userOrgId is already set by a
+ * previous middleware (e.g. verifyResourceAccess or verifyTargetAccess), and the
+ * loaded site's orgId differs from req.userOrgId, the request is rejected with
+ * 403 Forbidden.
+ *
+ * Route stacks after fix:
+ *   PUT /resource/:resourceId/target
+ *     → verifyResourceAccess → verifySiteAccess → verifyLimits → ...
+ *   POST /target/:targetId
+ *     → verifyTargetAccess → verifySiteAccess → verifyLimits → ...
+ *
+ * verifyResourceAccess sets req.userOrgId to the resource's org.
+ * verifyTargetAccess sets req.userOrgId to the target's resource org.
+ * verifySiteAccess then checks site.orgId against req.userOrgId before
+ * overwriting it with the site's org.
+ */
+
+// --- Core org-matching logic (mirrors the check in verifySiteAccess) ---
+function siteOrgMatchesExpectedOrg(
+    siteOrgId: string | null | undefined,
+    expectedOrgId: string | null | undefined
+): boolean {
+    if (!siteOrgId || !expectedOrgId) {
+        return false;
+    }
+    return siteOrgId === expectedOrgId;
+}
+
+// Simulates the condition check in verifySiteAccess:
+//   if (req.userOrgId && site.orgId !== req.userOrgId) { reject }
+function shouldRejectCrossOrgSite(
+    siteOrgId: string,
+    reqUserOrgId: string | undefined
+): boolean {
+    // The actual check in verifySiteAccess is:
+    //   if (req.userOrgId && site.orgId !== req.userOrgId) { reject }
+    return !!(reqUserOrgId && siteOrgId !== reqUserOrgId);
+}
+
+// --- Tests ---
+
+function testSiteOrgMatchLogic() {
+    console.log("Running verifySiteAccess org-match logic tests...");
+
+    // Test 1: Same org — should match
+    {
+        const result = siteOrgMatchesExpectedOrg(
+            "org-attacker",
+            "org-attacker"
+        );
+        assertEquals(result, true, "Same org should match");
+    }
+
+    // Test 2: Different org — should NOT match (cross-org bypass scenario)
+    {
+        const result = siteOrgMatchesExpectedOrg("org-victim", "org-attacker");
+        assertEquals(
+            result,
+            false,
+            "Cross-org site should NOT match expected org"
+        );
+    }
+
+    // Test 3: Site orgId is null — should NOT match
+    {
+        const result = siteOrgMatchesExpectedOrg(null, "org-attacker");
+        assertEquals(result, false, "Null site orgId should NOT match");
+    }
+
+    // Test 4: Expected orgId is null — should NOT match
+    {
+        const result = siteOrgMatchesExpectedOrg("org-attacker", null);
+        assertEquals(result, false, "Null expected orgId should NOT match");
+    }
+
+    // Test 5: Both null — should NOT match
+    {
+        const result = siteOrgMatchesExpectedOrg(null, null);
+        assertEquals(result, false, "Both null should NOT match");
+    }
+
+    // Test 6: Empty string orgIds — should NOT match (empty string is falsy)
+    {
+        const result = siteOrgMatchesExpectedOrg("", "org-attacker");
+        assertEquals(result, false, "Empty site orgId should NOT match");
+    }
+
+    // Test 7: Undefined orgIds — should NOT match
+    {
+        const result = siteOrgMatchesExpectedOrg(undefined, "org-attacker");
+        assertEquals(result, false, "Undefined site orgId should NOT match");
+    }
+
+    console.log("All verifySiteAccess org-match logic tests passed.");
+}
+
+function testShouldRejectCrossOrgSite() {
+    console.log(
+        "Running shouldRejectCrossOrgSite tests (mirrors verifySiteAccess check)..."
+    );
+
+    // Test: No prior org context (undefined) — should NOT reject
+    // This is the normal case for site-only routes (e.g. PUT /site/:siteId)
+    // where verifySiteAccess runs without a prior verifyResourceAccess.
+    {
+        const shouldReject = shouldRejectCrossOrgSite("org-victim", undefined);
+        assertEquals(
+            shouldReject,
+            false,
+            "No prior org context should NOT reject (normal site routes)"
+        );
+    }
+
+    // Test: Same org — should NOT reject
+    {
+        const shouldReject = shouldRejectCrossOrgSite(
+            "org-attacker",
+            "org-attacker"
+        );
+        assertEquals(shouldReject, false, "Same org should NOT reject");
+    }
+
+    // Test: Different org — should reject
+    {
+        const shouldReject = shouldRejectCrossOrgSite(
+            "org-victim",
+            "org-attacker"
+        );
+        assertEquals(shouldReject, true, "Cross-org site should be rejected");
+    }
+
+    // Test: Empty string userOrgId — should NOT reject (falsy, check is skipped)
+    {
+        const shouldReject = shouldRejectCrossOrgSite("org-victim", "");
+        assertEquals(
+            shouldReject,
+            false,
+            "Empty string userOrgId should NOT reject (check is skipped)"
+        );
+    }
+
+    console.log("All shouldRejectCrossOrgSite tests passed.");
+}
+
+// --- Route stack validation tests ---
+
+function testRouteStackOrdering() {
+    console.log("Running route stack ordering tests...");
+
+    const createTargetStack = [
+        "verifyResourceAccess",
+        "verifySiteAccess",
+        "verifyLimits",
+        "verifyUserHasAction",
+        "logActionAudit",
+        "createTarget"
+    ];
+
+    const updateTargetStack = [
+        "verifyTargetAccess",
+        "verifySiteAccess",
+        "verifyLimits",
+        "verifyUserHasAction",
+        "logActionAudit",
+        "updateTarget"
+    ];
+
+    // Verify verifySiteAccess comes after resource/target access middleware
+    {
+        const siteAccessIndex = createTargetStack.indexOf("verifySiteAccess");
+        const resourceAccessIndex = createTargetStack.indexOf(
+            "verifyResourceAccess"
+        );
+        assertEquals(
+            siteAccessIndex > resourceAccessIndex,
+            true,
+            "verifySiteAccess must come after verifyResourceAccess in create target stack"
+        );
+    }
+
+    {
+        const siteAccessIndex = updateTargetStack.indexOf("verifySiteAccess");
+        const targetAccessIndex =
+            updateTargetStack.indexOf("verifyTargetAccess");
+        assertEquals(
+            siteAccessIndex > targetAccessIndex,
+            true,
+            "verifySiteAccess must come after verifyTargetAccess in update target stack"
+        );
+    }
+
+    // Verify verifySiteAccess comes before the handler
+    {
+        const siteAccessIndex = createTargetStack.indexOf("verifySiteAccess");
+        const handlerIndex = createTargetStack.indexOf("createTarget");
+        assertEquals(
+            siteAccessIndex < handlerIndex,
+            true,
+            "verifySiteAccess must come before createTarget handler"
+        );
+    }
+
+    {
+        const siteAccessIndex = updateTargetStack.indexOf("verifySiteAccess");
+        const handlerIndex = updateTargetStack.indexOf("updateTarget");
+        assertEquals(
+            siteAccessIndex < handlerIndex,
+            true,
+            "verifySiteAccess must come before updateTarget handler"
+        );
+    }
+
+    console.log("All route stack ordering tests passed.");
+}
+
+// --- Security scenario tests ---
+
+function testSecurityScenarios() {
+    console.log("Running security scenario tests...");
+
+    // Scenario 1: Attacker has resource access in org_attacker, but tries to
+    // bind target to a site in org_victim.
+    // verifyResourceAccess passes (sets req.userOrgId = "org_attacker").
+    // verifySiteAccess loads site (org_victim), checks site.orgId !== req.userOrgId.
+    // Expected: 403 Forbidden.
+    {
+        const shouldReject = shouldRejectCrossOrgSite(
+            "org_victim",
+            "org_attacker"
+        );
+        assertEquals(
+            shouldReject,
+            true,
+            "Scenario 1: Cross-org site binding must be rejected"
+        );
+    }
+
+    // Scenario 2: Attacker has resource access AND site access in another org.
+    // Even though the user has site access, verifySiteAccess rejects because
+    // the org-match check runs before the site access check.
+    // Expected: 403 Forbidden (org mismatch caught before site access check).
+    {
+        const shouldReject = shouldRejectCrossOrgSite(
+            "org_victim",
+            "org_attacker"
+        );
+        assertEquals(
+            shouldReject,
+            true,
+            "Scenario 2: Cross-org site must be rejected even if user has site access"
+        );
+    }
+
+    // Scenario 3: Legitimate user creates target with site in same org.
+    // verifyResourceAccess passes, verifySiteAccess org-match passes (same org),
+    // verifySiteAccess site access passes.
+    // Expected: 201 Created.
+    {
+        const shouldReject = shouldRejectCrossOrgSite(
+            "org_attacker",
+            "org_attacker"
+        );
+        assertEquals(
+            shouldReject,
+            false,
+            "Scenario 3: Same-org site must be allowed"
+        );
+    }
+
+    // Scenario 4: WireGuard site in victim org — org mismatch is caught before
+    // any DB write, pickPort, addPeer, or addTargets side effect.
+    {
+        const shouldReject = shouldRejectCrossOrgSite(
+            "org_victim",
+            "org_attacker"
+        );
+        assertEquals(
+            shouldReject,
+            true,
+            "Scenario 4: WireGuard cross-org site must be rejected before addPeer"
+        );
+    }
+
+    // Scenario 5: Newt site in victim org — same as scenario 4 but for newt.
+    {
+        const shouldReject = shouldRejectCrossOrgSite(
+            "org_victim",
+            "org_attacker"
+        );
+        assertEquals(
+            shouldReject,
+            true,
+            "Scenario 5: Newt cross-org site must be rejected before addTargets"
+        );
+    }
+
+    // Scenario 6: Normal site-only route (e.g. PUT /site/:siteId) where
+    // verifySiteAccess runs without a prior verifyResourceAccess.
+    // req.userOrgId is undefined, so the org-match check is skipped.
+    // Normal site access verification proceeds.
+    {
+        const shouldReject = shouldRejectCrossOrgSite("org_victim", undefined);
+        assertEquals(
+            shouldReject,
+            false,
+            "Scenario 6: Site-only routes should skip org-match check"
+        );
+    }
+
+    console.log("All security scenario tests passed.");
+}
+
+// Run all tests
+testSiteOrgMatchLogic();
+testShouldRejectCrossOrgSite();
+testRouteStackOrdering();
+testSecurityScenarios();
--- a/server/middlewares/verifySiteAccess.ts
+++ b/server/middlewares/verifySiteAccess.ts
@@ -71,6 +71,15 @@ export async function verifySiteAccess(
            );
        }

+        if (req.userOrgId && site.orgId !== req.userOrgId) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have access to this site"
+                )
+            );
+        }
+
        if (!req.userOrg) {
            // Get user's role ID in the organization
            const userOrgRole = await db
@@ -128,10 +137,7 @@ export async function verifySiteAccess(
                      .where(
                          and(
                              eq(roleSites.siteId, site.siteId),
-                              inArray(
-                                  roleSites.roleId,
-                                  req.userOrgRoleIds!
-                              )
+                              inArray(roleSites.roleId, req.userOrgRoleIds!)
                          )
                      )
                      .limit(1)
--- a/server/private/lib/traefik/getTraefikConfig.ts
+++ b/server/private/lib/traefik/getTraefikConfig.ts
@@ -493,16 +493,29 @@ export async function getTraefikConfig(
        const transportName = `${key}-transport`;
        const headersMiddlewareName = `${key}-headers-middleware`;

+        logger.debug(
+            `Processing resource ${resource.name} with domain ${fullDomain} and ${targets.length} targets`
+        );
+
        if (!resource.enabled) {
+            logger.debug(
+                `Resource ${resource.name} is disabled, skipping Traefik config`
+            );
            continue;
        }

-        if (resource.http) {
+        if (resource.mode == "http") {
            if (!resource.domainId) {
+                logger.debug(
+                    `Resource ${resource.name} does not have a domainId, skipping Traefik config`
+                );
                continue;
            }

            if (!resource.fullDomain) {
+                logger.debug(
+                    `Resource ${resource.name} does not have a fullDomain, skipping Traefik config`
+                );
                continue;
            }

@@ -958,7 +971,7 @@ export async function getTraefikConfig(
                    serviceName
                ].loadBalancer.serversTransport = transportName;
            }
-        } else {
+        } else if (resource.mode == "tcp" || resource.mode == "udp") {
            // Non-HTTP (TCP/UDP) configuration
            if (!resource.enableProxy) {
                continue;
--- a/server/private/routers/external.ts
+++ b/server/private/routers/external.ts
@@ -330,44 +330,6 @@ authenticated.delete(
    remoteExitNode.deleteRemoteExitNode
 );

-authenticated.get(
-    "/org/:orgId/remote-exit-node/:remoteExitNodeId/resources",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyRemoteExitNodeAccess,
-    verifyUserHasAction(ActionsEnum.getRemoteExitNode),
-    remoteExitNode.listRemoteExitNodeResources
-);
-
-authenticated.post(
-    "/org/:orgId/remote-exit-node/:remoteExitNodeId/resources",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyRemoteExitNodeAccess,
-    verifyUserHasAction(ActionsEnum.updateRemoteExitNode),
-    logActionAudit(ActionsEnum.updateRemoteExitNode),
-    remoteExitNode.setRemoteExitNodeResources
-);
-
-authenticated.get(
-    "/org/:orgId/remote-exit-node/:remoteExitNodeId/preference-labels",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyRemoteExitNodeAccess,
-    verifyUserHasAction(ActionsEnum.getRemoteExitNode),
-    remoteExitNode.listRemoteExitNodePreferenceLabels
-);
-
-authenticated.post(
-    "/org/:orgId/remote-exit-node/:remoteExitNodeId/preference-labels",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyRemoteExitNodeAccess,
-    verifyUserHasAction(ActionsEnum.updateRemoteExitNode),
-    logActionAudit(ActionsEnum.updateRemoteExitNode),
-    remoteExitNode.setRemoteExitNodePreferenceLabels
-);
-
 authenticated.put(
    "/org/:orgId/login-page",
    verifyValidLicense,
--- a/server/private/routers/orgIdp/unassociateOrgIdp.ts
+++ b/server/private/routers/orgIdp/unassociateOrgIdp.ts
@@ -13,13 +13,15 @@

 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, idpOrg } from "@server/db";
+import { db, idpOrg, orgs, primaryDb, users, userOrgs } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { and, eq, sql } from "drizzle-orm";
+import { removeUserFromOrg } from "@server/lib/userOrg";
+import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsForOrgs";
 import { OpenAPITags, registry } from "@server/openApi";

 const paramsSchema = z
@@ -76,9 +78,55 @@ export async function unassociateOrgIdp(
            );
        }

-        await db
-            .delete(idpOrg)
-            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)));
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgId))
+            .limit(1);
+
+        if (!org) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Organization not found")
+            );
+        }
+
+        const orgUsersFromIdp = await db
+            .select({
+                userId: userOrgs.userId,
+                isOwner: userOrgs.isOwner
+            })
+            .from(userOrgs)
+            .innerJoin(users, eq(users.userId, userOrgs.userId))
+            .where(and(eq(userOrgs.orgId, orgId), eq(users.idpId, idpId)));
+
+        if (orgUsersFromIdp.some((u) => u.isOwner)) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Cannot unassociate identity provider while an organization owner uses it"
+                )
+            );
+        }
+
+        const userIdsToRemove = orgUsersFromIdp.map((u) => u.userId);
+
+        await db.transaction(async (trx) => {
+            for (const userId of userIdsToRemove) {
+                await removeUserFromOrg(org, userId, trx);
+            }
+
+            await trx
+                .delete(idpOrg)
+                .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)));
+        });
+
+        for (const userId of userIdsToRemove) {
+            calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+                logger.error(
+                    `Failed to calculate user clients after removing user ${userId} from org ${orgId} during IdP unassociation: ${e}`
+                );
+            });
+        }

        return response<null>(res, {
            data: null,
--- a/server/private/routers/remoteExitNode/index.ts
+++ b/server/private/routers/remoteExitNode/index.ts
@@ -22,7 +22,3 @@ export * from "./listRemoteExitNodes";
 export * from "./pickRemoteExitNodeDefaults";
 export * from "./quickStartRemoteExitNode";
 export * from "./offlineChecker";
-export * from "./listRemoteExitNodeResources";
-export * from "./setRemoteExitNodeResources";
-export * from "./listRemoteExitNodePreferenceLabels";
-export * from "./setRemoteExitNodePreferenceLabels";
--- a/server/private/routers/remoteExitNode/listRemoteExitNodePreferenceLabels.ts
+++ b/server/private/routers/remoteExitNode/listRemoteExitNodePreferenceLabels.ts
@@ -1,110 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { NextFunction, Request, Response } from "express";
-import { z } from "zod";
-import {
-    db,
-    labels,
-    remoteExitNodePreferenceLabels,
-    remoteExitNodes
-} from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().min(1),
-    remoteExitNodeId: z.string().min(1)
-});
-
-export type ListRemoteExitNodePreferenceLabelsResponse = {
-    labels: {
-        remoteExitNodePreferenceLabelId: number;
-        labelId: number;
-        name: string;
-        color: string;
-    }[];
-};
-
-export async function listRemoteExitNodePreferenceLabels(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { remoteExitNodeId } = parsedParams.data;
-
-        const [remoteExitNode] = await db
-            .select()
-            .from(remoteExitNodes)
-            .where(eq(remoteExitNodes.remoteExitNodeId, remoteExitNodeId))
-            .limit(1);
-
-        if (!remoteExitNode) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Remote exit node with ID ${remoteExitNodeId} not found`
-                )
-            );
-        }
-
-        const rows = await db
-            .select({
-                remoteExitNodePreferenceLabelId:
-                    remoteExitNodePreferenceLabels.remoteExitNodePreferenceLabelId,
-                labelId: remoteExitNodePreferenceLabels.labelId,
-                name: labels.name,
-                color: labels.color
-            })
-            .from(remoteExitNodePreferenceLabels)
-            .innerJoin(
-                labels,
-                eq(labels.labelId, remoteExitNodePreferenceLabels.labelId)
-            )
-            .where(
-                eq(
-                    remoteExitNodePreferenceLabels.remoteExitNodeId,
-                    remoteExitNodeId
-                )
-            );
-
-        return response<ListRemoteExitNodePreferenceLabelsResponse>(res, {
-            data: { labels: rows },
-            success: true,
-            error: false,
-            message:
-                "Remote exit node preference labels retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/private/routers/remoteExitNode/listRemoteExitNodeResources.ts
+++ b/server/private/routers/remoteExitNode/listRemoteExitNodeResources.ts
@@ -1,90 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { NextFunction, Request, Response } from "express";
-import { z } from "zod";
-import { db, remoteExitNodeResources, remoteExitNodes } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().min(1),
-    remoteExitNodeId: z.string().min(1)
-});
-
-export type ListRemoteExitNodeResourcesResponse = {
-    resources: {
-        remoteExitNodeResourceId: number;
-        remoteExitNodeId: string;
-        destination: string;
-    }[];
-};
-
-export async function listRemoteExitNodeResources(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { remoteExitNodeId } = parsedParams.data;
-
-        const [remoteExitNode] = await db
-            .select()
-            .from(remoteExitNodes)
-            .where(eq(remoteExitNodes.remoteExitNodeId, remoteExitNodeId))
-            .limit(1);
-
-        if (!remoteExitNode) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Remote exit node with ID ${remoteExitNodeId} not found`
-                )
-            );
-        }
-
-        const resources = await db
-            .select()
-            .from(remoteExitNodeResources)
-            .where(
-                eq(remoteExitNodeResources.remoteExitNodeId, remoteExitNodeId)
-            );
-
-        return response<ListRemoteExitNodeResourcesResponse>(res, {
-            data: { resources },
-            success: true,
-            error: false,
-            message: "Remote exit node resources retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/private/routers/remoteExitNode/setRemoteExitNodePreferenceLabels.ts
+++ b/server/private/routers/remoteExitNode/setRemoteExitNodePreferenceLabels.ts
@@ -1,168 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { NextFunction, Request, Response } from "express";
-import { z } from "zod";
-import {
-    db,
-    labels,
-    remoteExitNodePreferenceLabels,
-    remoteExitNodes
-} from "@server/db";
-import { and, eq, inArray } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().min(1),
-    remoteExitNodeId: z.string().min(1)
-});
-
-const bodySchema = z.strictObject({
-    labelIds: z.array(z.number().int().positive())
-});
-
-export type SetRemoteExitNodePreferenceLabelsBody = z.infer<typeof bodySchema>;
-
-export type SetRemoteExitNodePreferenceLabelsResponse = {
-    labels: {
-        remoteExitNodePreferenceLabelId: number;
-        labelId: number;
-        name: string;
-        color: string;
-    }[];
-};
-
-export async function setRemoteExitNodePreferenceLabels(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, remoteExitNodeId } = parsedParams.data;
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { labelIds } = parsedBody.data;
-
-        const [remoteExitNode] = await db
-            .select()
-            .from(remoteExitNodes)
-            .where(eq(remoteExitNodes.remoteExitNodeId, remoteExitNodeId))
-            .limit(1);
-
-        if (!remoteExitNode) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Remote exit node with ID ${remoteExitNodeId} not found`
-                )
-            );
-        }
-
-        // Validate all provided labelIds belong to this org
-        if (labelIds.length > 0) {
-            const existingLabels = await db
-                .select({ labelId: labels.labelId })
-                .from(labels)
-                .where(
-                    and(
-                        eq(labels.orgId, orgId),
-                        inArray(labels.labelId, labelIds)
-                    )
-                );
-
-            if (existingLabels.length !== labelIds.length) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "One or more label IDs are invalid or do not belong to this organization"
-                    )
-                );
-            }
-        }
-
-        // Replace all preference labels atomically
-        await db
-            .delete(remoteExitNodePreferenceLabels)
-            .where(
-                eq(
-                    remoteExitNodePreferenceLabels.remoteExitNodeId,
-                    remoteExitNodeId
-                )
-            );
-
-        if (labelIds.length > 0) {
-            await db.insert(remoteExitNodePreferenceLabels).values(
-                labelIds.map((labelId) => ({
-                    remoteExitNodeId,
-                    labelId
-                }))
-            );
-        }
-
-        const rows = await db
-            .select({
-                remoteExitNodePreferenceLabelId:
-                    remoteExitNodePreferenceLabels.remoteExitNodePreferenceLabelId,
-                labelId: remoteExitNodePreferenceLabels.labelId,
-                name: labels.name,
-                color: labels.color
-            })
-            .from(remoteExitNodePreferenceLabels)
-            .innerJoin(
-                labels,
-                eq(labels.labelId, remoteExitNodePreferenceLabels.labelId)
-            )
-            .where(
-                eq(
-                    remoteExitNodePreferenceLabels.remoteExitNodeId,
-                    remoteExitNodeId
-                )
-            );
-
-        return response<SetRemoteExitNodePreferenceLabelsResponse>(res, {
-            data: { labels: rows },
-            success: true,
-            error: false,
-            message: "Remote exit node preference labels updated successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/private/routers/remoteExitNode/setRemoteExitNodeResources.ts
+++ b/server/private/routers/remoteExitNode/setRemoteExitNodeResources.ts
@@ -1,129 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { NextFunction, Request, Response } from "express";
-import { z } from "zod";
-import { db, remoteExitNodeResources, remoteExitNodes } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().min(1),
-    remoteExitNodeId: z.string().min(1)
-});
-
-const cidrRegex =
-    /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$|^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]+|::(ffff(:0{1,4})?:)?((25[0-5]|(2[0-4]|1?[0-9])?[0-9])\.){3}(25[0-5]|(2[0-4]|1?[0-9])?[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1?[0-9])?[0-9])\.){3}(25[0-5]|(2[0-4]|1?[0-9])?[0-9]))(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))$/;
-
-const bodySchema = z.strictObject({
-    destinations: z.array(
-        z.string().regex(cidrRegex, "Must be a valid CIDR range")
-    )
-});
-
-export type SetRemoteExitNodeResourcesBody = z.infer<typeof bodySchema>;
-
-export type SetRemoteExitNodeResourcesResponse = {
-    resources: {
-        remoteExitNodeResourceId: number;
-        remoteExitNodeId: string;
-        destination: string;
-    }[];
-};
-
-export async function setRemoteExitNodeResources(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { remoteExitNodeId } = parsedParams.data;
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { destinations } = parsedBody.data;
-
-        const [remoteExitNode] = await db
-            .select()
-            .from(remoteExitNodes)
-            .where(eq(remoteExitNodes.remoteExitNodeId, remoteExitNodeId))
-            .limit(1);
-
-        if (!remoteExitNode) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Remote exit node with ID ${remoteExitNodeId} not found`
-                )
-            );
-        }
-
-        // Replace all resources atomically
-        await db
-            .delete(remoteExitNodeResources)
-            .where(
-                eq(remoteExitNodeResources.remoteExitNodeId, remoteExitNodeId)
-            );
-
-        if (destinations.length > 0) {
-            await db.insert(remoteExitNodeResources).values(
-                destinations.map((destination) => ({
-                    remoteExitNodeId,
-                    destination
-                }))
-            );
-        }
-
-        const resources = await db
-            .select()
-            .from(remoteExitNodeResources)
-            .where(
-                eq(remoteExitNodeResources.remoteExitNodeId, remoteExitNodeId)
-            );
-
-        return response<SetRemoteExitNodeResourcesResponse>(res, {
-            data: { resources },
-            success: true,
-            error: false,
-            message: "Remote exit node resources updated successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/private/routers/ssh/signSshKey.ts
+++ b/server/private/routers/ssh/signSshKey.ts
@@ -12,6 +12,7 @@
 */

 import { Request, Response, NextFunction } from "express";
+import { randomInt } from "crypto";
 import { z } from "zod";
 import {
    actionAuditLog,
@@ -392,7 +393,7 @@ export async function signSshKey(
                if (existingUserWithSameName) {
                    let foundUniqueUsername = false;
                    for (let attempt = 0; attempt < 20; attempt++) {
-                        const randomNum = Math.floor(Math.random() * 101); // 0 to 100
+                        const randomNum = randomInt(0, 101); // 0 to 100
                        const candidateUsername = `${usernameToUse}${randomNum}`;

                        const [existingUser] = await db
--- a/server/routers/external.ts
+++ b/server/routers/external.ts
@@ -561,6 +561,7 @@ authenticated.delete(
 authenticated.put(
    "/resource/:resourceId/target",
    verifyResourceAccess,
+    verifySiteAccess,
    verifyLimits,
    verifyUserHasAction(ActionsEnum.createTarget),
    logActionAudit(ActionsEnum.createTarget),
@@ -612,6 +613,7 @@ authenticated.get(
 authenticated.post(
    "/target/:targetId",
    verifyTargetAccess,
+    verifySiteAccess,
    verifyLimits,
    verifyUserHasAction(ActionsEnum.updateTarget),
    logActionAudit(ActionsEnum.updateTarget),
@@ -1234,7 +1236,8 @@ export const authRouter = Router();
 unauthenticated.use("/auth", authRouter);
 authRouter.use(
    rateLimit({
-        windowMs: config.getRawConfig().rate_limits.auth.window_minutes * 60 * 1000,
+        windowMs:
+            config.getRawConfig().rate_limits.auth.window_minutes * 60 * 1000,
        max: config.getRawConfig().rate_limits.auth.max_requests,
        keyGenerator: (req) =>
            `authRouterGlobal:${ipKeyGenerator(req.ip || "")}:${req.path}`,
--- a/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/layout.tsx
+++ b/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/layout.tsx
@@ -34,10 +34,6 @@ export default async function SettingsLayout(props: SettingsLayoutProps) {
    const t = await getTranslations();

    const navItems = [
-        {
-            title: "Networking",
-            href: "/{orgId}/settings/remote-exit-nodes/{remoteExitNodeId}/networking"
-        },
        {
            title: t("credentials"),
            href: "/{orgId}/settings/remote-exit-nodes/{remoteExitNodeId}/credentials"
--- a/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx
+++ b/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx
@@ -1,240 +0,0 @@
-"use client";
-
-import { useEffect, useMemo, useState } from "react";
-import {
-    SettingsContainer,
-    SettingsSection,
-    SettingsSectionBody,
-    SettingsSectionDescription,
-    SettingsSectionFooter,
-    SettingsSectionHeader,
-    SettingsSectionTitle
-} from "@app/components/Settings";
-import { Button } from "@app/components/ui/button";
-import { createApiClient, formatAxiosError } from "@app/lib/api";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { toast } from "@app/hooks/useToast";
-import { useParams } from "next/navigation";
-import { AxiosResponse } from "axios";
-import { useRemoteExitNodeContext } from "@app/hooks/useRemoteExitNodeContext";
-import { TagInput, type Tag } from "@app/components/tags/tag-input";
-import { MultiSelectTagInput } from "@app/components/multi-select/multi-select-tag-input";
-import type { TagValue } from "@app/components/multi-select/multi-select-content";
-import { orgQueries } from "@app/lib/queries";
-import { useQuery } from "@tanstack/react-query";
-import { useDebounce } from "use-debounce";
-import type { ListRemoteExitNodeResourcesResponse } from "@server/private/routers/remoteExitNode/listRemoteExitNodeResources";
-import type { SetRemoteExitNodeResourcesResponse } from "@server/private/routers/remoteExitNode/setRemoteExitNodeResources";
-import type { ListRemoteExitNodePreferenceLabelsResponse } from "@server/private/routers/remoteExitNode/listRemoteExitNodePreferenceLabels";
-import type { SetRemoteExitNodePreferenceLabelsResponse } from "@server/private/routers/remoteExitNode/setRemoteExitNodePreferenceLabels";
-
-const cidrRegex =
-    /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$|^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]+|::(ffff(:0{1,4})?:)?((25[0-5]|(2[0-4]|1?[0-9])?[0-9])\.){3}(25[0-5]|(2[0-4]|1?[0-9])?[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1?[0-9])?[0-9])\.){3}(25[0-5]|(2[0-4]|1?[0-9])?[0-9]))(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))$/;
-
-export default function NetworkingPage() {
-    const { env } = useEnvContext();
-    const api = createApiClient({ env });
-    const { orgId } = useParams<{
-        orgId: string;
-        remoteExitNodeId: string;
-    }>();
-    const { remoteExitNode } = useRemoteExitNodeContext();
-
-    // Subnets state
-    const [subnets, setSubnets] = useState<Tag[]>([]);
-    const [activeTagIndex, setActiveTagIndex] = useState<number | null>(null);
-    const [loadingSubnets, setLoadingSubnets] = useState(true);
-    const [savingSubnets, setSavingSubnets] = useState(false);
-
-    // Labels state
-    const [selectedLabels, setSelectedLabels] = useState<TagValue[]>([]);
-    const [labelSearchQuery, setLabelSearchQuery] = useState("");
-    const [loadingLabels, setLoadingLabels] = useState(true);
-    const [savingLabels, setSavingLabels] = useState(false);
-
-    const [debouncedLabelQuery] = useDebounce(labelSearchQuery, 150);
-
-    const { data: availableLabels = [] } = useQuery(
-        orgQueries.labels({ orgId, query: debouncedLabelQuery, perPage: 10 })
-    );
-
-    const labelsShown = useMemo<TagValue[]>(() => {
-        const base: TagValue[] = availableLabels.map((l) => ({
-            id: l.labelId.toString(),
-            text: l.name,
-            color: l.color
-        }));
-        if (debouncedLabelQuery.trim().length === 0) {
-            for (const sel of selectedLabels) {
-                if (!base.find((b) => b.id === sel.id)) {
-                    base.unshift(sel);
-                }
-            }
-        }
-        return base;
-    }, [availableLabels, selectedLabels, debouncedLabelQuery]);
-
-    useEffect(() => {
-        async function loadSubnets() {
-            try {
-                const res = await api.get<
-                    AxiosResponse<ListRemoteExitNodeResourcesResponse>
-                >(
-                    `/org/${orgId}/remote-exit-node/${remoteExitNode.remoteExitNodeId}/resources`
-                );
-                setSubnets(
-                    res.data.data.resources.map((r) => ({
-                        id: r.destination,
-                        text: r.destination
-                    }))
-                );
-            } catch (error) {
-                toast({
-                    variant: "destructive",
-                    title: "Error",
-                    description:
-                        formatAxiosError(error) || "Failed to load subnets"
-                });
-            } finally {
-                setLoadingSubnets(false);
-            }
-        }
-
-        async function loadLabels() {
-            try {
-                const res = await api.get<
-                    AxiosResponse<ListRemoteExitNodePreferenceLabelsResponse>
-                >(
-                    `/org/${orgId}/remote-exit-node/${remoteExitNode.remoteExitNodeId}/preference-labels`
-                );
-                setSelectedLabels(
-                    res.data.data.labels.map((l) => ({
-                        id: l.labelId.toString(),
-                        text: l.name,
-                        color: l.color
-                    }))
-                );
-            } catch (error) {
-                toast({
-                    variant: "destructive",
-                    title: "Error",
-                    description:
-                        formatAxiosError(error) || "Failed to load labels"
-                });
-            } finally {
-                setLoadingLabels(false);
-            }
-        }
-
-        loadSubnets();
-        loadLabels();
-    }, [remoteExitNode.remoteExitNodeId]);
-
-    const handleSaveSubnets = async () => {
-        setSavingSubnets(true);
-        try {
-            await api.post<AxiosResponse<SetRemoteExitNodeResourcesResponse>>(
-                `/org/${orgId}/remote-exit-node/${remoteExitNode.remoteExitNodeId}/resources`,
-                { destinations: subnets.map((s) => s.text) }
-            );
-            toast({
-                title: "Subnets saved",
-                description: "Remote subnets have been updated successfully."
-            });
-        } catch (error) {
-            toast({
-                variant: "destructive",
-                title: "Error",
-                description: formatAxiosError(error) || "Failed to save subnets"
-            });
-        } finally {
-            setSavingSubnets(false);
-        }
-    };
-
-    const handleSaveLabels = async () => {
-        setSavingLabels(true);
-        try {
-            await api.post<
-                AxiosResponse<SetRemoteExitNodePreferenceLabelsResponse>
-            >(
-                `/org/${orgId}/remote-exit-node/${remoteExitNode.remoteExitNodeId}/preference-labels`,
-                { labelIds: selectedLabels.map((l) => parseInt(l.id)) }
-            );
-            toast({
-                title: "Labels saved",
-                description: "Preference labels have been updated successfully."
-            });
-        } catch (error) {
-            toast({
-                variant: "destructive",
-                title: "Error",
-                description: formatAxiosError(error) || "Failed to save labels"
-            });
-        } finally {
-            setSavingLabels(false);
-        }
-    };
-
-    return (
-        <SettingsContainer>
-            <SettingsSection>
-                <SettingsSectionHeader>
-                    <SettingsSectionTitle>Remote Subnets</SettingsSectionTitle>
-                    <SettingsSectionDescription>
-                        Define the CIDR ranges that this remote exit node will
-                        route traffic to. Type a valid CIDR (e.g.{" "}
-                        <code>10.0.0.0/8</code>) and press Enter to add.
-                    </SettingsSectionDescription>
-                </SettingsSectionHeader>
-                <SettingsSectionBody>
-                    <TagInput
-                        tags={subnets}
-                        setTags={setSubnets}
-                        placeholder="Add a CIDR range (e.g. 10.0.0.0/8)"
-                        validateTag={(tag) => cidrRegex.test(tag.trim())}
-                        activeTagIndex={activeTagIndex}
-                        setActiveTagIndex={setActiveTagIndex}
-                        disabled={loadingSubnets}
-                        allowDuplicates={false}
-                        inlineTags={true}
-                    />
-                </SettingsSectionBody>
-                <SettingsSectionFooter>
-                    <Button onClick={handleSaveSubnets} loading={savingSubnets}>
-                        Save Subnets
-                    </Button>
-                </SettingsSectionFooter>
-            </SettingsSection>
-
-            <SettingsSection>
-                <SettingsSectionHeader>
-                    <SettingsSectionTitle>
-                        Preference Labels
-                    </SettingsSectionTitle>
-                    <SettingsSectionDescription>
-                        Sites with these labels will be enforced to connect
-                        through this remote exit node.
-                    </SettingsSectionDescription>
-                </SettingsSectionHeader>
-                <SettingsSectionBody>
-                    <MultiSelectTagInput
-                        value={selectedLabels}
-                        options={labelsShown}
-                        onChange={setSelectedLabels}
-                        onSearch={setLabelSearchQuery}
-                        searchQuery={labelSearchQuery}
-                        disabled={loadingLabels}
-                        buttonText="Select labels..."
-                        searchPlaceholder="Search labels..."
-                    />
-                </SettingsSectionBody>
-                <SettingsSectionFooter>
-                    <Button onClick={handleSaveLabels} loading={savingLabels}>
-                        Save Labels
-                    </Button>
-                </SettingsSectionFooter>
-            </SettingsSection>
-        </SettingsContainer>
-    );
-}
--- a/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/page.tsx
+++ b/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/page.tsx
@@ -10,6 +10,6 @@ export default async function RemoteExitNodePage(props: {
 }) {
    const params = await props.params;
    redirect(
-        `/${params.orgId}/settings/remote-exit-nodes/${params.remoteExitNodeId}/networking`
+        `/${params.orgId}/settings/remote-exit-nodes/${params.remoteExitNodeId}/credentials`
    );
 }
--- a/src/app/[orgId]/settings/(private)/remote-exit-nodes/create/page.tsx
+++ b/src/app/[orgId]/settings/(private)/remote-exit-nodes/create/page.tsx
@@ -35,6 +35,8 @@ import { toast } from "@app/hooks/useToast";
 import { AxiosResponse } from "axios";
 import { useParams, useRouter, useSearchParams } from "next/navigation";
 import { useTranslations } from "next-intl";
+import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
+import { InfoIcon } from "lucide-react";
 import HeaderTitle from "@app/components/SettingsSectionTitle";
 import { StrategySelect } from "@app/components/StrategySelect";

--- a/src/app/[orgId]/settings/access/users/create/page.tsx
+++ b/src/app/[orgId]/settings/access/users/create/page.tsx
@@ -13,7 +13,7 @@ import { StrategyOption, StrategySelect } from "@app/components/StrategySelect";
 import HeaderTitle from "@app/components/SettingsSectionTitle";
 import { Button } from "@app/components/ui/button";
 import { useParams, useRouter } from "next/navigation";
-import { useActionState, useState } from "react";
+import { useActionState, useRef, useState } from "react";
 import {
    Form,
    FormControl,
@@ -205,23 +205,7 @@ export default function Page() {
        }
    });

-    useEffect(() => {
-        if (selectedOption === "internal") {
-            setSendEmail(env.email.emailEnabled);
-            internalForm.reset();
-            setInviteLink(null);
-            setExpiresInDays(1);
-        } else if (selectedOption && selectedOption !== "internal") {
-            googleAzureForm.reset();
-            genericOidcForm.reset();
-        }
-    }, [
-        selectedOption,
-        env.email.emailEnabled,
-        internalForm,
-        googleAzureForm,
-        genericOidcForm
-    ]);
+    const prevSelectedOptionRef = useRef(selectedOption);

    useEffect(() => {
        if (!selectedOption) {
@@ -315,19 +299,10 @@ export default function Page() {
        onSubmitInternal,
        null
    );
-    const [, submitGoogleAzureAction, isSubmittingGoogleAzure] = useActionState(
-        onSubmitGoogleAzure,
-        null
-    );
-    const [, submitGenericOidcAction, isSubmittingGenericOidc] = useActionState(
-        onSubmitGenericOidc,
-        null
-    );
+    const [isSubmittingExternal, setIsSubmittingExternal] = useState(false);

    const loading =
-        isSubmittingInternal ||
-        isSubmittingGoogleAzure ||
-        isSubmittingGenericOidc;
+        isSubmittingInternal || isSubmittingExternal;

    async function onSubmitInternal() {
        const isValid = await internalForm.trigger();
@@ -378,17 +353,16 @@ export default function Page() {
        }
    }

-    async function onSubmitGoogleAzure() {
-        const isValid = await googleAzureForm.trigger();
-        if (!isValid) return;
-
-        const values = googleAzureForm.getValues();
-
+    async function onSubmitGoogleAzure(
+        values: z.infer<typeof googleAzureFormSchema>
+    ) {
        const selectedUserOption = userOptions.find(
            (opt) => opt.id === selectedOption
        );
        if (!selectedUserOption?.idpId) return;

+        setIsSubmittingExternal(true);
+
        const roleIds = values.roles.map((r) => parseInt(r.id, 10));

        const res = await api
@@ -419,19 +393,20 @@ export default function Page() {
            });
            router.push(`/${orgId}/settings/access/users`);
        }
+
+        setIsSubmittingExternal(false);
    }

-    async function onSubmitGenericOidc() {
-        const isValid = await genericOidcForm.trigger();
-        if (!isValid) return;
-
-        const values = genericOidcForm.getValues();
-
+    async function onSubmitGenericOidc(
+        values: z.infer<typeof genericOidcFormSchema>
+    ) {
        const selectedUserOption = userOptions.find(
            (opt) => opt.id === selectedOption
        );
        if (!selectedUserOption?.idpId) return;

+        setIsSubmittingExternal(true);
+
        const roleIds = values.roles.map((r) => parseInt(r.id, 10));

        const res = await api
@@ -462,6 +437,27 @@ export default function Page() {
            });
            router.push(`/${orgId}/settings/access/users`);
        }
+
+        setIsSubmittingExternal(false);
+    }
+
+    function handleUserTypeChange(value: string) {
+        if (prevSelectedOptionRef.current === value) {
+            return;
+        }
+
+        prevSelectedOptionRef.current = value;
+        setSelectedOption(value);
+
+        if (value === "internal") {
+            setSendEmail(env.email.emailEnabled);
+            internalForm.reset();
+            setInviteLink(null);
+            setExpiresInDays(1);
+        } else {
+            googleAzureForm.reset();
+            genericOidcForm.reset();
+        }
    }

    return (
@@ -496,16 +492,8 @@ export default function Page() {
                            <SettingsSectionBody>
                                <StrategySelect
                                    options={userOptions}
-                                    defaultValue={selectedOption || undefined}
-                                    onChange={(value) => {
-                                        setSelectedOption(value);
-                                        if (value === "internal") {
-                                            internalForm.reset();
-                                        } else {
-                                            googleAzureForm.reset();
-                                            genericOidcForm.reset();
-                                        }
-                                    }}
+                                    value={selectedOption}
+                                    onChange={handleUserTypeChange}
                                    cols={3}
                                />
                            </SettingsSectionBody>
@@ -714,9 +702,9 @@ export default function Page() {
                                        })() && (
                                            <Form {...googleAzureForm}>
                                                <form
-                                                    action={
-                                                        submitGoogleAzureAction
-                                                    }
+                                                    onSubmit={googleAzureForm.handleSubmit(
+                                                        onSubmitGoogleAzure
+                                                    )}
                                                    className="space-y-4"
                                                    id="create-user-form"
                                                >
@@ -797,9 +785,9 @@ export default function Page() {
                                        })() && (
                                            <Form {...genericOidcForm}>
                                                <form
-                                                    action={
-                                                        submitGenericOidcAction
-                                                    }
+                                                    onSubmit={genericOidcForm.handleSubmit(
+                                                        onSubmitGenericOidc
+                                                    )}
                                                    className="space-y-4"
                                                    id="create-user-form"
                                                >
--- a/src/app/[orgId]/settings/resources/public/ProxyResourceTargetsForm.tsx
+++ b/src/app/[orgId]/settings/resources/public/ProxyResourceTargetsForm.tsx
@@ -103,7 +103,7 @@ export function ProxyResourceTargetsForm({
    // Notify parent of changes (create mode)
    useEffect(() => {
        onChange?.(targets);
-    }, [targets]); // eslint-disable-line react-hooks/exhaustive-deps
+    }, [targets]);

    // Poll health status only in edit mode
    const { data: polledTargets } = useQuery({
--- a/src/app/page.tsx
+++ b/src/app/page.tsx
@@ -86,7 +86,7 @@ export default async function Page(props: {
        targetOrgId = lastOrgCookie;
    } else {
        let ownedOrg = orgs.find((org) => org.isOwner);
-        let primaryOrg = orgs.find((org) => org.isPrimaryOrg);
+        const primaryOrg = orgs.find((org) => org.isPrimaryOrg);
        if (!ownedOrg) {
            if (primaryOrg) {
                ownedOrg = primaryOrg;
--- a/src/app/private-maintenance-screen/page.tsx
+++ b/src/app/private-maintenance-screen/page.tsx
@@ -16,9 +16,9 @@ export const metadata: Metadata = {
 export default async function MaintenanceScreen() {
    const t = await getTranslations();

-    let title = t("privateMaintenanceScreenTitle");
-    let message = t("privateMaintenanceScreenMessage");
-    let steps = t("privateMaintenanceScreenSteps");
+    const title = t("privateMaintenanceScreenTitle");
+    const message = t("privateMaintenanceScreenMessage");
+    const steps = t("privateMaintenanceScreenSteps");

    return (
        <div className="min-h-screen flex items-center justify-center p-4">
--- a/src/app/rdp/page.tsx
+++ b/src/app/rdp/page.tsx
@@ -17,7 +17,7 @@ export default async function RdpPage() {
    const hostname = host.split(":")[0];

    let target: GetBrowserTargetResponse | null = null;
-    let error: string | null = null;
+    const error: string | null = null;

    try {
        const res = await priv.get<AxiosResponse<GetBrowserTargetResponse>>(
--- a/src/app/ssh/SshClient.tsx
+++ b/src/app/ssh/SshClient.tsx
@@ -180,7 +180,6 @@ export default function SshClient({
                certificate: signedKeyData.certificate
            });
        }
-        // eslint-disable-next-line react-hooks/exhaustive-deps
    }, []);

    function connect(override?: ConnectCredentials) {
--- a/src/app/vnc/VncClient.tsx
+++ b/src/app/vnc/VncClient.tsx
@@ -39,7 +39,6 @@ export default function VncClient({
    });

    const [connected, setConnected] = useState(false);
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
    const rfbRef = useRef<any>(null);
    const screenRef = useRef<HTMLDivElement>(null);

@@ -59,7 +58,7 @@ export default function VncClient({
    // Clean up on unmount.
    useEffect(() => {
        return () => disconnect();
-    }, []); // eslint-disable-line react-hooks/exhaustive-deps
+    }, []);

    const connect = async () => {
        if (!target) {
@@ -115,7 +114,6 @@ export default function VncClient({
            options.credentials = { password: form.password };
        }

-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
        const rfb: any = new RFB(screenRef.current, wsUrl, options);

        rfb.scaleViewport = true;
--- a/src/app/vnc/page.tsx
+++ b/src/app/vnc/page.tsx
@@ -17,7 +17,7 @@ export default async function VncPage() {
    const hostname = host.split(":")[0];

    let target: GetBrowserTargetResponse | null = null;
-    let error: string | null = null;
+    const error: string | null = null;

    try {
        const res = await priv.get<AxiosResponse<GetBrowserTargetResponse>>(
--- a/src/components/LoginForm.tsx
+++ b/src/components/LoginForm.tsx
@@ -345,6 +345,7 @@ export default function LoginForm({
                    error={error}
                    loading={loading}
                    formId="form"
+                    username={form.getValues("email")}
                />
            )}

--- a/src/components/LoginPasswordForm.tsx
+++ b/src/components/LoginPasswordForm.tsx
@@ -265,6 +265,7 @@ export default function LoginPasswordForm({
                }}
                error={error}
                loading={loading}
+                username={identifier}
            />
        );
    }
--- a/src/components/MfaInputForm.tsx
+++ b/src/components/MfaInputForm.tsx
@@ -1,6 +1,5 @@
 "use client";

-import { useEffect, useRef } from "react";
 import { UseFormReturn } from "react-hook-form";
 import { Button } from "@app/components/ui/button";
 import {
@@ -8,17 +7,15 @@ import {
    FormControl,
    FormField,
    FormItem,
+    FormLabel,
    FormMessage
 } from "@app/components/ui/form";
-import {
-    InputOTP,
-    InputOTPGroup,
-    InputOTPSlot
-} from "./ui/input-otp";
+import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
-import * as z from "zod";
+import { REGEXP_ONLY_DIGITS } from "input-otp";
+
+const MFA_OTP_INPUT_ID = "mfa-otp-code";

 type MfaInputFormProps = {
    form: UseFormReturn<{ code: string }>;
@@ -27,6 +24,7 @@ type MfaInputFormProps = {
    error?: string | null;
    loading?: boolean;
    formId?: string;
+    username?: string;
 };

 export default function MfaInputForm({
@@ -35,55 +33,10 @@ export default function MfaInputForm({
    onBack,
    error,
    loading = false,
-    formId = "mfaForm"
+    formId = "mfaForm",
+    username
 }: MfaInputFormProps) {
    const t = useTranslations();
-    const otpContainerRef = useRef<HTMLDivElement>(null);
-
-    // Auto-focus MFA input when component mounts
-    useEffect(() => {
-        const focusInput = () => {
-            // Try using the ref first
-            if (otpContainerRef.current) {
-                const hiddenInput = otpContainerRef.current.querySelector(
-                    "input"
-                ) as HTMLInputElement;
-                if (hiddenInput) {
-                    hiddenInput.focus();
-                    return;
-                }
-            }
-
-            // Fallback: query the DOM
-            const otpContainer = document.querySelector(
-                '[data-slot="input-otp"]'
-            );
-            if (!otpContainer) return;
-
-            const hiddenInput = otpContainer.querySelector(
-                "input"
-            ) as HTMLInputElement;
-            if (hiddenInput) {
-                hiddenInput.focus();
-                return;
-            }
-
-            // Last resort: click the first slot
-            const firstSlot = otpContainer.querySelector(
-                '[data-slot="input-otp-slot"]'
-            ) as HTMLElement;
-            if (firstSlot) {
-                firstSlot.click();
-            }
-        };
-
-        // Use requestAnimationFrame to wait for the next paint
-        requestAnimationFrame(() => {
-            requestAnimationFrame(() => {
-                focusInput();
-            });
-        });
-    }, []);

    return (
        <div className="space-y-4">
@@ -99,25 +52,45 @@ export default function MfaInputForm({
                    className="space-y-4"
                    id={formId}
                >
+                    {username ? (
+                        <input
+                            type="text"
+                            name="username"
+                            autoComplete="username"
+                            value={username}
+                            readOnly
+                            tabIndex={-1}
+                            aria-hidden="true"
+                            className="sr-only"
+                        />
+                    ) : null}
                    <FormField
                        control={form.control}
                        name="code"
                        render={({ field }) => (
                            <FormItem>
+                                <FormLabel
+                                    htmlFor={MFA_OTP_INPUT_ID}
+                                    className="sr-only"
+                                >
+                                    {t("otpAuth")}
+                                </FormLabel>
                                <FormControl>
-                                    <div
-                                        ref={otpContainerRef}
-                                        className="flex justify-center"
-                                    >
+                                    <div className="flex justify-center">
                                        <InputOTP
+                                            id={MFA_OTP_INPUT_ID}
                                            maxLength={6}
                                            {...field}
+                                            autoComplete="one-time-code"
+                                            inputMode="numeric"
                                            autoFocus
-                                            pattern={REGEXP_ONLY_DIGITS_AND_CHARS}
+                                            pattern={REGEXP_ONLY_DIGITS}
                                            onChange={(value: string) => {
                                                field.onChange(value);
                                                if (value.length === 6) {
-                                                    form.handleSubmit(onSubmit)();
+                                                    form.handleSubmit(
+                                                        onSubmit
+                                                    )();
                                                }
                                            }}
                                        >
--- a/src/components/OrgIdpTable.tsx
+++ b/src/components/OrgIdpTable.tsx
@@ -125,6 +125,13 @@ function IdpImportRowIcon({
    return <IdpTypeIcon type={type} variant={variant} size={20} />;
 }

+function isUserMemberOfIdp(
+    userIdpId: number | null | undefined,
+    idpId: number
+) {
+    return userIdpId != null && userIdpId === idpId;
+}
+
 type Props = {
    idps: IdpRow[];
    orgId: string;
@@ -362,9 +369,17 @@ export default function IdpTable({ idps, orgId }: Props) {
                            <p>{t("idpDeleteGlobalDescription")}</p>
                        </div>
                    }
-                    buttonText={t("idpConfirmDelete")}
+                    buttonText={
+                        isUserMemberOfIdp(user.idpId, selectedIdp.idpId)
+                            ? t("idpConfirmDeleteAndRemoveMeFromOrg")
+                            : t("idpConfirmDelete")
+                    }
                    onConfirm={async () => deleteIdp(selectedIdp.idpId)}
-                    string={selectedIdp.name}
+                    string={
+                        isUserMemberOfIdp(user.idpId, selectedIdp.idpId)
+                            ? t("idpConfirmDeleteAndRemoveMeFromOrg")
+                            : selectedIdp.name
+                    }
                    title={t("idpDelete")}
                />
            )}
@@ -381,11 +396,25 @@ export default function IdpTable({ idps, orgId }: Props) {
                            <p>{t("idpUnassociateDescription")}</p>
                        </div>
                    }
-                    buttonText={t("idpUnassociateConfirm")}
+                    buttonText={
+                        isUserMemberOfIdp(
+                            user.idpId,
+                            selectedUnassociateIdp.idpId
+                        )
+                            ? t("idpUnassociateAndRemoveMeFromOrg")
+                            : t("idpUnassociateConfirm")
+                    }
                    onConfirm={async () =>
                        unassociateIdp(selectedUnassociateIdp.idpId)
                    }
-                    string={selectedUnassociateIdp.name}
+                    string={
+                        isUserMemberOfIdp(
+                            user.idpId,
+                            selectedUnassociateIdp.idpId
+                        )
+                            ? t("idpUnassociateAndRemoveMeFromOrg")
+                            : selectedUnassociateIdp.name
+                    }
                    title={t("idpUnassociateTitle")}
                    warningText={t("idpUnassociateWarning")}
                />
--- a/src/components/multi-select/multi-select-content.tsx
+++ b/src/components/multi-select/multi-select-content.tsx
@@ -12,12 +12,7 @@ import { CheckIcon } from "lucide-react";
 import { useTranslations } from "next-intl";
 import { Checkbox } from "../ui/checkbox";

-export type TagValue = {
-    text: string;
-    id: string;
-    isAdmin?: boolean;
-    color?: string;
-};
+export type TagValue = { text: string; id: string; isAdmin?: boolean };

 export type MultiSelectTagsProps<T extends TagValue> = {
    emptyPlaceholder?: string;
@@ -82,14 +77,6 @@ export function MultiSelectContent<T extends TagValue>({
                                    aria-hidden
                                    tabIndex={-1}
                                />
-                                {option.color && (
-                                    <span
-                                        className="size-2 rounded-full flex-none"
-                                        style={{
-                                            backgroundColor: option.color
-                                        }}
-                                    />
-                                )}
                                {`${option.text}`}
                            </CommandItem>
                        );
--- a/src/components/multi-select/multi-select-tag-input.tsx
+++ b/src/components/multi-select/multi-select-tag-input.tsx
@@ -66,14 +66,6 @@ export function MultiSelectTagInput<T extends TagValue>({
                                    )}
                                    onClick={(e) => e.stopPropagation()}
                                >
-                                    {option.color && (
-                                        <span
-                                            className="size-2 rounded-full flex-none ml-1"
-                                            style={{
-                                                backgroundColor: option.color
-                                            }}
-                                        />
-                                    )}
                                    <span className="max-w-40 text-ellipsis overflow-hidden">
                                        {option.text}
                                    </span>
Author	SHA1	Message	Date
Owen Schwartz	7fa1180d10	Merge pull request #3221 from fosrl/dev 1.19.0-rc.1	2026-06-04 15:45:27 -07:00
Owen	769d36e289	Fix http resources not being pulled	2026-06-04 15:36:25 -07:00
Owen	a7a41b820e	Add missing sshAccess key	2026-06-04 15:20:52 -07:00
Owen Schwartz	8b50f1fb65	Merge pull request #3218 from fosrl/dev Fix installer	2026-06-04 11:21:59 -07:00
Owen	2d78a4b628	Fix installer	2026-06-04 11:21:40 -07:00
Owen Schwartz	527d4cc777	Merge pull request #3215 from fosrl/dev 1.19.0-rc.0	2026-06-04 10:34:20 -07:00
Owen Schwartz	01361884eb	Potential fix for pull request finding 'CodeQL / Insecure randomness' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	2026-06-04 10:33:15 -07:00
Owen	6c4cbcab5d	Fix eslint errors	2026-06-04 10:22:29 -07:00
Owen Schwartz	aac25f0a53	Merge pull request #3214 from marcschaeferger/dev Prevent cross-org site binding in target create/update	2026-06-04 10:11:53 -07:00
miloschwartz	4a3c201741	improve mfa autofill	2026-06-03 21:54:55 -07:00
miloschwartz	f5ab837cce	remove idp user if unassociate idp, warn, and fix create user form bug	2026-06-03 21:42:18 -07:00
Owen Schwartz	00ec7a5c66	Merge pull request #3211 from fosrl/crowdin_dev New Crowdin updates	2026-06-03 21:40:33 -07:00
Owen Schwartz	03df4d03ed	New translations en-us.json (Spanish) [ci skip]	2026-06-03 21:39:34 -07:00
Owen Schwartz	8488edd707	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-06-03 21:39:32 -07:00
Owen Schwartz	920dbba2a3	New translations en-us.json (Chinese Simplified) [ci skip]	2026-06-03 21:39:31 -07:00
Owen Schwartz	71e065a8bc	New translations en-us.json (Turkish) [ci skip]	2026-06-03 21:39:29 -07:00
Owen Schwartz	e125c762b2	New translations en-us.json (Russian) [ci skip]	2026-06-03 21:39:27 -07:00
Owen Schwartz	4f01f7c072	New translations en-us.json (Portuguese) [ci skip]	2026-06-03 21:39:25 -07:00
Owen Schwartz	9a5ee9d489	New translations en-us.json (Polish) [ci skip]	2026-06-03 21:39:24 -07:00
Owen Schwartz	665da931f1	New translations en-us.json (Dutch) [ci skip]	2026-06-03 21:39:22 -07:00
Owen Schwartz	7595cf7ac7	New translations en-us.json (Korean) [ci skip]	2026-06-03 21:39:20 -07:00
Owen Schwartz	aa6232d0fc	New translations en-us.json (Italian) [ci skip]	2026-06-03 21:39:18 -07:00
Owen Schwartz	beaf5dc843	New translations en-us.json (German) [ci skip]	2026-06-03 21:39:17 -07:00
Owen Schwartz	7158855052	New translations en-us.json (Czech) [ci skip]	2026-06-03 21:39:15 -07:00
Owen Schwartz	765b2d795f	New translations en-us.json (Bulgarian) [ci skip]	2026-06-03 21:39:13 -07:00
Owen Schwartz	66f00fcf94	New translations en-us.json (French) [ci skip]	2026-06-03 21:39:11 -07:00
Marc Schäfer	f617f93a94	test(middleware): add regression tests for cross-org site binding prevention Test the org-match logic in verifySiteAccess: - Same org: allowed - Cross-org: rejected with 403 - No prior org context (site-only routes): check skipped, normal flow Test route stack ordering: - verifySiteAccess runs after verifyResourceAccess/verifyTargetAccess - verifySiteAccess runs before the target create/update handler Test security scenarios for both WireGuard and newt site types. Signed-off-by: Marc Schäfer <git@marcschaeferger.de>	2026-05-29 22:57:39 +00:00
Marc Schäfer	51629247a5	fix(middleware): prevent cross-org site binding in target create/update Extend verifySiteAccess to check that when req.userOrgId is already set by a prior middleware (e.g. verifyResourceAccess/verifyTargetAccess), the site from req.body.siteId belongs to the same organization. This prevents the cross-organization tunnel boundary bypass where an attacker with resource access in one org binds that resource's target to a site in another org. Add verifySiteAccess to both target route stacks: - PUT /resource/:resourceId/target (after verifyResourceAccess) - POST /target/:targetId (after verifyTargetAccess) The org-match check runs before req.userOrg is overwritten, so the resource's organization context is preserved for comparison. Signed-off-by: Marc Schäfer <git@marcschaeferger.de>	2026-05-29 22:44:16 +00:00