Bump the prod-minor-updates group across 1 directory with 4 updates

Bumps the prod-minor-updates group with 4 updates in the / directory: [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3), [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react), [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) and [tailwind-merge](https://github.com/dcastil/tailwind-merge). Updates `@aws-sdk/client-s3` from 3.989.0 to 3.996.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.996.0/clients/client-s3) Updates `lucide-react` from 0.563.0 to 0.575.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/0.575.0/packages/lucide-react) Updates `posthog-node` from 5.24.15 to 5.25.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.25.0/packages/node) Updates `tailwind-merge` from 3.4.0 to 3.5.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](https://github.com/dcastil/tailwind-merge/compare/v3.4.0...v3.5.0) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.996.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: lucide-react dependency-version: 0.575.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: posthog-node dependency-version: 5.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: tailwind-merge dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com>
Fix sso username issue
2026-02-24 13:56:39 +00:00 · 2026-02-24 01:37:56 +00:00 · 2026-02-22 22:05:02 -08:00 · 2026-02-22 21:13:51 -08:00 · 2026-02-22 21:13:17 -08:00 · 2026-02-22 21:11:37 -08:00
46 changed files with 1407 additions and 569 deletions
--- a/.github/workflows/saas.yml
+++ b/.github/workflows/saas.yml
@@ -56,6 +56,41 @@ jobs:
            - name: Checkout code
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

+            - name: Download MaxMind GeoLite2 databases
+              env:
+                MAXMIND_LICENSE_KEY: ${{ secrets.MAXMIND_LICENSE_KEY }}
+              run: |
+                echo "Downloading MaxMind GeoLite2 databases..."
+
+                # Download GeoLite2-Country
+                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
+                  -o GeoLite2-Country.tar.gz
+
+                # Download GeoLite2-ASN
+                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-ASN&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
+                  -o GeoLite2-ASN.tar.gz
+
+                # Extract the .mmdb files
+                tar -xzf GeoLite2-Country.tar.gz --strip-components=1 --wildcards '*.mmdb'
+                tar -xzf GeoLite2-ASN.tar.gz --strip-components=1 --wildcards '*.mmdb'
+
+                # Verify files exist
+                if [ ! -f "GeoLite2-Country.mmdb" ]; then
+                  echo "ERROR: Failed to download GeoLite2-Country.mmdb"
+                  exit 1
+                fi
+
+                if [ ! -f "GeoLite2-ASN.mmdb" ]; then
+                  echo "ERROR: Failed to download GeoLite2-ASN.mmdb"
+                  exit 1
+                fi
+
+                # Clean up tar files
+                rm -f GeoLite2-Country.tar.gz GeoLite2-ASN.tar.gz
+
+                echo "MaxMind databases downloaded successfully"
+                ls -lh GeoLite2-*.mmdb
+
            - name: Monitor storage space
              run: |
                  THRESHOLD=75
--- a/8
+++ b/8
@@ -49,6 +49,14 @@ COPY server/db/ios_models.json ./dist/ios_models.json
 COPY server/db/mac_models.json ./dist/mac_models.json
 COPY public ./public

+# Copy MaxMind databases for SaaS builds
+ARG BUILD=oss
+RUN mkdir -p ./maxmind
+
+# This is only for saas
+COPY --from=builder-dev /app/GeoLite2-Country.mmdb ./maxmind/GeoLite2-Country.mmdb
+COPY --from=builder-dev /app/GeoLite2-ASN.mmdb ./maxmind/GeoLite2-ASN.mmdb
+
 # OCI Image Labels - Build Args for dynamic values
 ARG VERSION="dev"
 ARG REVISION=""
--- a/messages/bg-BG.json
+++ b/messages/bg-BG.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Ролята е премахната",
    "accessRoleRemovedDescription": "Ролята беше успешно премахната.",
    "accessRoleRequiredRemove": "Преди да изтриете тази роля, моля изберете нова роля, към която да прехвърлите настоящите членове.",
+    "network": "Мрежа",
    "manage": "Управление",
    "sitesNotFound": "Няма намерени сайтове.",
    "pangolinServerAdmin": "Администратор на сървър - Панголин",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Частно",
    "sidebarAccessControl": "Контрол на достъпа",
    "sidebarLogsAndAnalytics": "Дневници и анализи",
+    "sidebarTeam": "Екип",
    "sidebarUsers": "Потребители",
    "sidebarAdmin": "Администратор",
    "sidebarInvitations": "Покани",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Лог & Анализи",
    "sidebarBluePrints": "Чертежи",
    "sidebarOrganization": "Организация",
+    "sidebarManagement": "Управление",
    "sidebarBillingAndLicenses": "Фактуриране & Лицензи",
    "sidebarLogsAnalytics": "Анализи",
    "blueprints": "Чертежи",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Парсирано съдържание (само за четене)",
    "enableDockerSocket": "Активиране на Docker Чернова",
    "enableDockerSocketDescription": "Активиране на Docker Socket маркировка за изтегляне на етикети на чернова. Пътят на гнездото трябва да бъде предоставен на Newt.",
-    "enableDockerSocketLink": "Научете повече",
    "viewDockerContainers": "Преглед на Docker контейнери",
    "containersIn": "Контейнери в {siteName}",
    "selectContainerDescription": "Изберете контейнер, който да ползвате като име на хост за целта. Натиснете порт, за да ползвате порт",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Уведомление за наличност на функциите",
    "billingFeatureLossDescription": "Чрез понижението на плана, функциите, недостъпни в новия план, ще бъдат автоматично деактивирани. Някои настройки и конфигурации може да бъдат загубени. Моля, прегледайте ценовата матрица, за да разберете кои функции вече няма да са на разположение.",
    "billingUsageExceedsLimit": "Текущото използване ({current}) надвишава ограничението ({limit})",
+    "billingPastDueTitle": "Плащането е просрочено",
+    "billingPastDueDescription": "Вашето плащане е просрочено. Моля, актуализирайте метода на плащане, за да продължите да използвате настоящия си план. Ако проблемът не бъде разрешен, абонаментът ви ще бъде прекратен и ще бъдете прехвърлени на безплатния план.",
+    "billingUnpaidTitle": "Абонаментът не е платен",
+    "billingUnpaidDescription": "Вашият абонамент не е платен и сте прехвърлени на безплатния план. Моля, актуализирайте метода на плащане, за да възстановите вашия абонамент.",
+    "billingIncompleteTitle": "Плащането е непълно",
+    "billingIncompleteDescription": "Вашето плащане е непълно. Моля, завършете процеса на плащане, за да активирате вашия абонамент.",
+    "billingIncompleteExpiredTitle": "Плащането е изтекло",
+    "billingIncompleteExpiredDescription": "Вашето плащане никога не е завършено и е изтекло. Прехвърлени сте на безплатния план. Моля, абонирайте се отново, за да възстановите достъпа до платените функции.",
+    "billingManageSubscription": "Управлявайте вашия абонамент",
+    "billingResolvePaymentIssue": "Моля, разрешете проблема с плащането преди да извършите надграждане или понижение",
    "signUpTerms": {
        "IAgreeToThe": "Съгласен съм с",
        "termsOfService": "условията за ползване",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Времето е в секунди",
    "requireDeviceApproval": "Изискват одобрение на устройства",
    "requireDeviceApprovalDescription": "Потребители с тази роля трябва да имат нови устройства одобрени от администратор преди да могат да се свържат и да имат достъп до ресурси.",
+    "sshAccess": "SSH достъп",
+    "roleAllowSsh": "Разреши SSH",
+    "roleAllowSshAllow": "Разреши",
+    "roleAllowSshDisallow": "Забрани",
+    "roleAllowSshDescription": "Разреши на потребителите с тази роля да се свързват с ресурси чрез SSH. Когато е деактивирано, ролята не може да използва SSH достъп.",
+    "sshSudoMode": "Sudo достъп",
+    "sshSudoModeNone": "Няма",
+    "sshSudoModeNoneDescription": "Потребителят не може да изпълнява команди с sudo.",
+    "sshSudoModeFull": "Пълен Sudo",
+    "sshSudoModeFullDescription": "Потребителят може да изпълнява всяка команда с sudo.",
+    "sshSudoModeCommands": "Команди",
+    "sshSudoModeCommandsDescription": "Потребителят може да изпълнява само определени команди с sudo.",
+    "sshSudo": "Разреши sudo",
+    "sshSudoCommands": "Sudo команди",
+    "sshSudoCommandsDescription": "Списък с команди, които потребителят е разрешено да изпълнява с sudo.",
+    "sshCreateHomeDir": "Създай начална директория",
+    "sshUnixGroups": "Unix групи",
+    "sshUnixGroupsDescription": "Unix групи, в които да добавите потребителя на целевия хост.",
    "retryAttempts": "Опити за повторно",
    "expectedResponseCodes": "Очаквани кодове за отговор",
    "expectedResponseCodesDescription": "HTTP статус код, указващ здравословно състояние. Ако бъде оставено празно, между 200-300 се счита за здравословно.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Контрол на достъпа.",
    "editInternalResourceDialogAccessControlDescription": "Контролирайте кои роли, потребители и клиентски машини имат достъп до този ресурс, когато са свързани. Администраторите винаги имат достъп.",
    "editInternalResourceDialogPortRangeValidationError": "Обхватът на портовете трябва да е \"*\" за всички портове или списък от разделени със запетая портове и диапазони (например: \"80,443,8000-9000\"). Портовете трябва да са между 1 и 65535.",
+    "internalResourceAuthDaemonStrategy": "Локация на SSH Auth Daemon",
+    "internalResourceAuthDaemonStrategyDescription": "Изберете къде ще работи демонът за SSH удостоверение: на сайта (Newt) или на отдалечен хост.",
+    "internalResourceAuthDaemonDescription": "Демонът за SSH удостоверение управлява подписването на SSH ключове и PAM удостоверение за този ресурс. Изберете дали да работи на сайта (Newt) или на отделен отдалечен хост. Вижте <docsLink>документацията</docsLink> за повече информация.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Изберете стратегия",
+    "internalResourceAuthDaemonStrategyLabel": "Местоположение",
+    "internalResourceAuthDaemonSite": "На сайта",
+    "internalResourceAuthDaemonSiteDescription": "Демонът за удостоверение работи на сайта (Newt).",
+    "internalResourceAuthDaemonRemote": "Отдалечен хост",
+    "internalResourceAuthDaemonRemoteDescription": "Демонът за удостоверение работи на хост, който не е сайтът.",
+    "internalResourceAuthDaemonPort": "Порт на демона (незадължителен)",
    "orgAuthWhatsThis": "Къде мога да намеря идентификатора на организацията си?",
    "learnMore": "Научете повече.",
    "backToHome": "Връщане към началната страница.",
--- a/messages/cs-CZ.json
+++ b/messages/cs-CZ.json
@@ -336,7 +336,7 @@
    "userQuestionRemove": "Jste si jisti, že chcete trvale odstranit uživatele ze serveru?",
    "licenseKey": "Licenční klíč",
    "valid": "Valid",
-    "numberOfSites": "Počet stránek",
+    "numberOfSites": "Počet lokalit",
    "licenseKeySearch": "Hledat licenční klíče...",
    "licenseKeyAdd": "Přidat licenční klíč",
    "type": "Typ",
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Role odstraněna",
    "accessRoleRemovedDescription": "Role byla úspěšně odstraněna.",
    "accessRoleRequiredRemove": "Před odstraněním této role vyberte novou roli, do které chcete převést existující členy.",
+    "network": "Síť",
    "manage": "Spravovat",
    "sitesNotFound": "Nebyly nalezeny žádné stránky.",
    "pangolinServerAdmin": "Správce serveru - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Soukromé",
    "sidebarAccessControl": "Kontrola přístupu",
    "sidebarLogsAndAnalytics": "Logy & Analytika",
+    "sidebarTeam": "Tým",
    "sidebarUsers": "Uživatelé",
    "sidebarAdmin": "Admin",
    "sidebarInvitations": "Pozvánky",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Log & Analytics",
    "sidebarBluePrints": "Plány",
    "sidebarOrganization": "Organizace",
+    "sidebarManagement": "Správa",
    "sidebarBillingAndLicenses": "Fakturace a licence",
    "sidebarLogsAnalytics": "Analytici",
    "blueprints": "Plány",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Parsed content (Pouze pro čtení)",
    "enableDockerSocket": "Povolit Docker plán",
    "enableDockerSocketDescription": "Povolte seškrábání štítků na Docker Socket pro popisky plánů. Nová cesta musí být k dispozici.",
-    "enableDockerSocketLink": "Zjistit více",
    "viewDockerContainers": "Zobrazit kontejnery Dockeru",
    "containersIn": "Kontejnery v {siteName}",
    "selectContainerDescription": "Vyberte jakýkoli kontejner pro použití jako název hostitele pro tento cíl. Klikněte na port pro použití portu.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Upozornění na dostupnost funkce",
    "billingFeatureLossDescription": "Po pomenutí budou funkce v novém plánu automaticky zakázány. Některá nastavení a konfigurace mohou být ztraceny. Zkontrolujte cenovou matrici, abyste pochopili, které funkce již nebudou k dispozici.",
    "billingUsageExceedsLimit": "Aktuální využití ({current}) překračuje limit ({limit})",
+    "billingPastDueTitle": "Poslední splatnost platby",
+    "billingPastDueDescription": "Vaše platba je již splatná. Chcete-li pokračovat v používání aktuálních tarifů, aktualizujte prosím způsob platby. Pokud nebude vyřešeno, Vaše předplatné bude zrušeno a budete vráceno na úroveň zdarma.",
+    "billingUnpaidTitle": "Předplatné nezaplaceno",
+    "billingUnpaidDescription": "Vaše předplatné není zaplaceno a byli jste vráceni do bezplatné úrovně. Aktualizujte prosím svou platební metodu pro obnovení předplatného.",
+    "billingIncompleteTitle": "Platba nedokončena",
+    "billingIncompleteDescription": "Vaše platba je neúplná. Pro aktivaci předplatného prosím dokončete platební proces.",
+    "billingIncompleteExpiredTitle": "Platba vypršela",
+    "billingIncompleteExpiredDescription": "Vaše platba nebyla nikdy dokončena a vypršela. Byli jste vráceni na úroveň zdarma. Prosím, přihlašte se znovu pro obnovení přístupu k placeným funkcím.",
+    "billingManageSubscription": "Spravujte své předplatné",
+    "billingResolvePaymentIssue": "Vyřešte prosím problém s platbou před upgradem nebo upgradem",
    "signUpTerms": {
        "IAgreeToThe": "Souhlasím s",
        "termsOfService": "podmínky služby",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Čas je v sekundách",
    "requireDeviceApproval": "Vyžadovat schválení zařízení",
    "requireDeviceApprovalDescription": "Uživatelé s touto rolí potřebují nová zařízení schválená správcem, než se mohou připojit a přistupovat ke zdrojům.",
+    "sshAccess": "SSH přístup",
+    "roleAllowSsh": "Povolit SSH",
+    "roleAllowSshAllow": "Povolit",
+    "roleAllowSshDisallow": "Zakázat",
+    "roleAllowSshDescription": "Povolit uživatelům s touto rolí připojení k zdrojům přes SSH. Je-li zakázáno, role nemůže používat přístup SSH.",
+    "sshSudoMode": "Súdánský přístup",
+    "sshSudoModeNone": "Nic",
+    "sshSudoModeNoneDescription": "Uživatel nemůže spouštět příkazy se sudo.",
+    "sshSudoModeFull": "Úplný Súdán",
+    "sshSudoModeFullDescription": "Uživatel může spustit libovolný příkaz se sudo.",
+    "sshSudoModeCommands": "Příkazy",
+    "sshSudoModeCommandsDescription": "Uživatel může spustit pouze zadané příkazy s sudo.",
+    "sshSudo": "Povolit sudo",
+    "sshSudoCommands": "Sudo příkazy",
+    "sshSudoCommandsDescription": "Seznam příkazů, které může uživatel spouštět s sudo.",
+    "sshCreateHomeDir": "Vytvořit domovský adresář",
+    "sshUnixGroups": "Unixové skupiny",
+    "sshUnixGroupsDescription": "Unix skupiny přidají uživatele do cílového hostitele.",
    "retryAttempts": "Opakovat pokusy",
    "expectedResponseCodes": "Očekávané kódy odezvy",
    "expectedResponseCodesDescription": "HTTP kód stavu, který označuje zdravý stav. Ponecháte-li prázdné, 200-300 je považováno za zdravé.",
@@ -2362,7 +2392,7 @@
    "terms": "Výrazy",
    "privacy": "Soukromí",
    "security": "Zabezpečení",
-    "docs": "Dokumenty",
+    "docs": "Dokumentace",
    "deviceActivation": "Aktivace zařízení",
    "deviceCodeInvalidFormat": "Kód musí být 9 znaků (např. A1AJ-N5JD)",
    "deviceCodeInvalidOrExpired": "Neplatný nebo prošlý kód",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Řízení přístupu",
    "editInternalResourceDialogAccessControlDescription": "Kontrolujte, které role, uživatelé a klienti mohou přistupovat k tomuto prostředku, když jsou připojeni. Admini mají vždy přístup.",
    "editInternalResourceDialogPortRangeValidationError": "Rozsah portů musí být \"*\" pro všechny porty, nebo seznam portů a rozsahů oddělených čárkou (např. \"80,443,8000-9000\"). Porty musí být mezi 1 a 65535.",
+    "internalResourceAuthDaemonStrategy": "SSH Auth Démon umístění",
+    "internalResourceAuthDaemonStrategyDescription": "Zvolte, kde běží SSH autentizační démon: na stránce (Newt) nebo na vzdáleném serveru.",
+    "internalResourceAuthDaemonDescription": "SSH autentizační daemon zpracovává podpis SSH klíče a PAM autentizaci tohoto zdroje. Vyberte si, zda běží na webu (Newt) nebo na samostatném vzdáleném serveru. Více informací najdete v <docsLink>dokumentaci</docsLink>.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Vybrat strategii",
+    "internalResourceAuthDaemonStrategyLabel": "Poloha",
+    "internalResourceAuthDaemonSite": "Na stránce",
+    "internalResourceAuthDaemonSiteDescription": "Auth daemon běží na webu (Newt).",
+    "internalResourceAuthDaemonRemote": "Vzdálený server",
+    "internalResourceAuthDaemonRemoteDescription": "Auth daemon běží na hostitele, který není web.",
+    "internalResourceAuthDaemonPort": "Daemon port (volitelné)",
    "orgAuthWhatsThis": "Kde najdu ID mé organizace?",
    "learnMore": "Zjistit více",
    "backToHome": "Zpět na domovskou stránku",
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Rolle entfernt",
    "accessRoleRemovedDescription": "Die Rolle wurde erfolgreich entfernt.",
    "accessRoleRequiredRemove": "Bevor Sie diese Rolle löschen, wählen Sie bitte eine neue Rolle aus, zu der die bestehenden Mitglieder übertragen werden sollen.",
+    "network": "Netzwerk",
    "manage": "Verwalten",
    "sitesNotFound": "Keine Standorte gefunden.",
    "pangolinServerAdmin": "Server-Admin - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Privat",
    "sidebarAccessControl": "Zugriffskontrolle",
    "sidebarLogsAndAnalytics": "Protokolle & Analysen",
+    "sidebarTeam": "Team",
    "sidebarUsers": "Benutzer",
    "sidebarAdmin": "Admin",
    "sidebarInvitations": "Einladungen",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Log & Analytik",
    "sidebarBluePrints": "Blaupausen",
    "sidebarOrganization": "Organisation",
+    "sidebarManagement": "Management",
    "sidebarBillingAndLicenses": "Abrechnung & Lizenzen",
    "sidebarLogsAnalytics": "Analytik",
    "blueprints": "Blaupausen",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Analysierte Inhalte (Nur lesen)",
    "enableDockerSocket": "Docker Blueprint aktivieren",
    "enableDockerSocketDescription": "Aktiviere Docker-Socket-Label-Scraping für Blueprintbeschriftungen. Der Socket-Pfad muss neu angegeben werden.",
-    "enableDockerSocketLink": "Mehr erfahren",
    "viewDockerContainers": "Docker Container anzeigen",
    "containersIn": "Container in {siteName}",
    "selectContainerDescription": "Wählen Sie einen Container, der als Hostname für dieses Ziel verwendet werden soll. Klicken Sie auf einen Port, um einen Port zu verwenden.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Verfügbarkeitshinweis",
    "billingFeatureLossDescription": "Durch Herabstufung werden Funktionen, die im neuen Paket nicht verfügbar sind, automatisch deaktiviert. Einige Einstellungen und Konfigurationen können verloren gehen. Bitte überprüfen Sie die Preismatrix um zu verstehen, welche Funktionen nicht mehr verfügbar sein werden.",
    "billingUsageExceedsLimit": "Aktuelle Nutzung ({current}) überschreitet das Limit ({limit})",
+    "billingPastDueTitle": "Zahlung vergangene Fälligkeit",
+    "billingPastDueDescription": "Ihre Zahlung ist abgelaufen. Bitte aktualisieren Sie Ihre Zahlungsmethode, um die aktuellen Funktionen Ihres Pakets weiter zu nutzen. Wenn nicht geklärt, wird Ihr Abonnement abgebrochen und Sie werden auf die kostenlose Stufe zurückgekehrt.",
+    "billingUnpaidTitle": "Unbezahltes Abonnement",
+    "billingUnpaidDescription": "Dein Abonnement ist unbezahlt und du wurdest auf die kostenlose Stufe zurückgekehrt. Bitte aktualisiere deine Zahlungsmethode, um dein Abonnement wiederherzustellen.",
+    "billingIncompleteTitle": "Zahlung unvollständig",
+    "billingIncompleteDescription": "Ihre Zahlung ist unvollständig. Bitte schließen Sie den Zahlungsvorgang ab, um Ihr Abonnement zu aktivieren.",
+    "billingIncompleteExpiredTitle": "Zahlung abgelaufen",
+    "billingIncompleteExpiredDescription": "Deine Zahlung wurde nie abgeschlossen und ist abgelaufen. Du wurdest zur kostenlosen Stufe zurückgekehrt. Bitte melde dich erneut an, um den Zugriff auf kostenpflichtige Funktionen wiederherzustellen.",
+    "billingManageSubscription": "Verwalten Sie Ihr Abonnement",
+    "billingResolvePaymentIssue": "Bitte beheben Sie Ihr Zahlungsproblem vor dem Upgrade oder Herabstufen",
    "signUpTerms": {
        "IAgreeToThe": "Ich stimme den",
        "termsOfService": "Nutzungsbedingungen zu",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Zeit ist in Sekunden",
    "requireDeviceApproval": "Gerätegenehmigungen erforderlich",
    "requireDeviceApprovalDescription": "Benutzer mit dieser Rolle benötigen neue Geräte, die von einem Administrator genehmigt wurden, bevor sie sich verbinden und auf Ressourcen zugreifen können.",
+    "sshAccess": "SSH-Zugriff",
+    "roleAllowSsh": "SSH erlauben",
+    "roleAllowSshAllow": "Erlauben",
+    "roleAllowSshDisallow": "Nicht zulassen",
+    "roleAllowSshDescription": "Benutzern mit dieser Rolle erlauben, sich über SSH mit Ressourcen zu verbinden. Wenn deaktiviert, kann die Rolle keinen SSH-Zugriff verwenden.",
+    "sshSudoMode": "Sudo-Zugriff",
+    "sshSudoModeNone": "Keine",
+    "sshSudoModeNoneDescription": "Benutzer kann keine Befehle mit sudo ausführen.",
+    "sshSudoModeFull": "Volles Sudo",
+    "sshSudoModeFullDescription": "Benutzer kann jeden Befehl mit sudo ausführen.",
+    "sshSudoModeCommands": "Befehle",
+    "sshSudoModeCommandsDescription": "Benutzer kann nur die angegebenen Befehle mit sudo ausführen.",
+    "sshSudo": "sudo erlauben",
+    "sshSudoCommands": "Sudo-Befehle",
+    "sshSudoCommandsDescription": "Liste der Befehle, die der Benutzer mit sudo ausführen darf.",
+    "sshCreateHomeDir": "Home-Verzeichnis erstellen",
+    "sshUnixGroups": "Unix-Gruppen",
+    "sshUnixGroupsDescription": "Unix-Gruppen, zu denen der Benutzer auf dem Ziel-Host hinzugefügt wird.",
    "retryAttempts": "Wiederholungsversuche",
    "expectedResponseCodes": "Erwartete Antwortcodes",
    "expectedResponseCodesDescription": "HTTP-Statuscode, der einen gesunden Zustand anzeigt. Wenn leer gelassen, wird 200-300 als gesund angesehen.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Zugriffskontrolle",
    "editInternalResourceDialogAccessControlDescription": "Kontrollieren Sie, welche Rollen, Benutzer und Maschinen-Clients Zugriff auf diese Ressource haben, wenn sie verbunden sind. Admins haben immer Zugriff.",
    "editInternalResourceDialogPortRangeValidationError": "Der Port-Bereich muss \"*\" für alle Ports sein, oder eine kommaseparierte Liste von Ports und Bereichen (z.B. \"80,443.8000-9000\"). Ports müssen zwischen 1 und 65535 liegen.",
+    "internalResourceAuthDaemonStrategy": "SSH Auth-Daemon Standort",
+    "internalResourceAuthDaemonStrategyDescription": "Wählen Sie aus, wo der SSH-Authentifizierungs-Daemon läuft: auf der Site (Newt) oder auf einem entfernten Host.",
+    "internalResourceAuthDaemonDescription": "Der SSH-Authentifizierungs-Daemon verarbeitet SSH-Schlüsselsignaturen und PAM-Authentifizierung für diese Ressource. Wählen Sie, ob sie auf der Website (Newt) oder auf einem separaten entfernten Host ausgeführt wird. Siehe <docsLink>die Dokumentation</docsLink> für mehr.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Strategie auswählen",
+    "internalResourceAuthDaemonStrategyLabel": "Standort",
+    "internalResourceAuthDaemonSite": "Vor Ort",
+    "internalResourceAuthDaemonSiteDescription": "Der Auth Daemon läuft auf der Seite (Newt).",
+    "internalResourceAuthDaemonRemote": "Entfernter Host",
+    "internalResourceAuthDaemonRemoteDescription": "Der Auth Daemon läuft auf einem Host, der nicht die Site ist.",
+    "internalResourceAuthDaemonPort": "Daemon-Port (optional)",
    "orgAuthWhatsThis": "Wo finde ich meine Organisations-ID?",
    "learnMore": "Mehr erfahren",
    "backToHome": "Zurück zur Startseite",
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -1572,6 +1572,16 @@
    "billingFeatureLossWarning": "Feature Availability Notice",
    "billingFeatureLossDescription": "By downgrading, features not available in the new plan will be automatically disabled. Some settings and configurations may be lost. Please review the pricing matrix to understand which features will no longer be available.",
    "billingUsageExceedsLimit": "Current usage ({current}) exceeds limit ({limit})",
+    "billingPastDueTitle": "Payment Past Due",
+    "billingPastDueDescription": "Your payment is past due. Please update your payment method to continue using your current plan features. If not resolved, your subscription will be canceled and you'll be reverted to the free tier.",
+    "billingUnpaidTitle": "Subscription Unpaid",
+    "billingUnpaidDescription": "Your subscription is unpaid and you have been reverted to the free tier. Please update your payment method to restore your subscription.",
+    "billingIncompleteTitle": "Payment Incomplete",
+    "billingIncompleteDescription": "Your payment is incomplete. Please complete the payment process to activate your subscription.",
+    "billingIncompleteExpiredTitle": "Payment Expired",
+    "billingIncompleteExpiredDescription": "Your payment was never completed and has expired. You have been reverted to the free tier. Please subscribe again to restore access to paid features.",
+    "billingManageSubscription": "Manage your subscription",
+    "billingResolvePaymentIssue": "Please resolve your payment issue before upgrading or downgrading",
    "signUpTerms": {
        "IAgreeToThe": "I agree to the",
        "termsOfService": "terms of service",
--- a/messages/es-ES.json
+++ b/messages/es-ES.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Rol eliminado",
    "accessRoleRemovedDescription": "El rol se ha eliminado correctamente.",
    "accessRoleRequiredRemove": "Antes de eliminar este rol, seleccione un nuevo rol al que transferir miembros existentes.",
+    "network": "Red",
    "manage": "Gestionar",
    "sitesNotFound": "Sitios no encontrados.",
    "pangolinServerAdmin": "Admin Servidor - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Privado",
    "sidebarAccessControl": "Control de acceso",
    "sidebarLogsAndAnalytics": "Registros y análisis",
+    "sidebarTeam": "Equipo",
    "sidebarUsers": "Usuarios",
    "sidebarAdmin": "Admin",
    "sidebarInvitations": "Invitaciones",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Registro y análisis",
    "sidebarBluePrints": "Planos",
    "sidebarOrganization": "Organización",
+    "sidebarManagement": "Gestión",
    "sidebarBillingAndLicenses": "Facturación y licencias",
    "sidebarLogsAnalytics": "Analíticas",
    "blueprints": "Planos",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Contenido analizado (Sólo lectura)",
    "enableDockerSocket": "Habilitar Plano Docker",
    "enableDockerSocketDescription": "Activar el raspado de etiquetas de Socket Docker para etiquetas de planos. La ruta del Socket debe proporcionarse a Newt.",
-    "enableDockerSocketLink": "Saber más",
    "viewDockerContainers": "Ver contenedores Docker",
    "containersIn": "Contenedores en {siteName}",
    "selectContainerDescription": "Seleccione cualquier contenedor para usar como nombre de host para este objetivo. Haga clic en un puerto para usar un puerto.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Aviso de disponibilidad de funcionalidad",
    "billingFeatureLossDescription": "Al degradar, las características no disponibles en el nuevo plan se desactivarán automáticamente. Algunas configuraciones y configuraciones pueden perderse. Por favor, revise la matriz de precios para entender qué características ya no estarán disponibles.",
    "billingUsageExceedsLimit": "El uso actual ({current}) supera el límite ({limit})",
+    "billingPastDueTitle": "Pago vencido",
+    "billingPastDueDescription": "Su pago ha vencido. Por favor, actualice su método de pago para seguir utilizando las características actuales de su plan. Si no se resuelve, tu suscripción se cancelará y serás revertido al nivel gratuito.",
+    "billingUnpaidTitle": "Suscripción no pagada",
+    "billingUnpaidDescription": "Tu suscripción no está pagada y has sido revertido al nivel gratuito. Por favor, actualiza tu método de pago para restaurar tu suscripción.",
+    "billingIncompleteTitle": "Pago incompleto",
+    "billingIncompleteDescription": "Su pago está incompleto. Por favor, complete el proceso de pago para activar su suscripción.",
+    "billingIncompleteExpiredTitle": "Pago expirado",
+    "billingIncompleteExpiredDescription": "Tu pago nunca se completó y ha expirado. Has sido revertido al nivel gratuito. Suscríbete de nuevo para restaurar el acceso a las funciones de pago.",
+    "billingManageSubscription": "Administra tu suscripción",
+    "billingResolvePaymentIssue": "Por favor resuelva su problema de pago antes de actualizar o bajar de calificación",
    "signUpTerms": {
        "IAgreeToThe": "Estoy de acuerdo con los",
        "termsOfService": "términos del servicio",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "El tiempo está en segundos",
    "requireDeviceApproval": "Requiere aprobaciones del dispositivo",
    "requireDeviceApprovalDescription": "Los usuarios con este rol necesitan nuevos dispositivos aprobados por un administrador antes de poder conectarse y acceder a los recursos.",
+    "sshAccess": "Acceso a SSH",
+    "roleAllowSsh": "Permitir SSH",
+    "roleAllowSshAllow": "Permitir",
+    "roleAllowSshDisallow": "Rechazar",
+    "roleAllowSshDescription": "Permitir a los usuarios con este rol conectarse a recursos a través de SSH. Cuando está desactivado, el rol no puede usar acceso SSH.",
+    "sshSudoMode": "Acceso Sudo",
+    "sshSudoModeNone": "Ninguna",
+    "sshSudoModeNoneDescription": "El usuario no puede ejecutar comandos con sudo.",
+    "sshSudoModeFull": "Sudo completo",
+    "sshSudoModeFullDescription": "El usuario puede ejecutar cualquier comando con sudo.",
+    "sshSudoModeCommands": "Comandos",
+    "sshSudoModeCommandsDescription": "El usuario sólo puede ejecutar los comandos especificados con sudo.",
+    "sshSudo": "Permitir sudo",
+    "sshSudoCommands": "Comandos Sudo",
+    "sshSudoCommandsDescription": "Lista de comandos que el usuario puede ejecutar con sudo.",
+    "sshCreateHomeDir": "Crear directorio principal",
+    "sshUnixGroups": "Grupos Unix",
+    "sshUnixGroupsDescription": "Grupos Unix para agregar el usuario en el host de destino.",
    "retryAttempts": "Intentos de Reintento",
    "expectedResponseCodes": "Códigos de respuesta esperados",
    "expectedResponseCodesDescription": "Código de estado HTTP que indica un estado saludable. Si se deja en blanco, se considera saludable de 200 a 300.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Control de acceso",
    "editInternalResourceDialogAccessControlDescription": "Controla qué roles, usuarios y clientes de máquinas tienen acceso a este recurso cuando están conectados. Los administradores siempre tienen acceso.",
    "editInternalResourceDialogPortRangeValidationError": "El rango de puertos debe ser \"*\" para todos los puertos, o una lista separada por comas de puertos y rangos (por ejemplo, \"80,443,8000-9000\"). Los puertos deben estar entre 1 y 65535.",
+    "internalResourceAuthDaemonStrategy": "Ubicación del demonio de autenticación SSSH",
+    "internalResourceAuthDaemonStrategyDescription": "Elija dónde se ejecuta el daemon de autenticación SSH: en el sitio (Newt) o en un host remoto.",
+    "internalResourceAuthDaemonDescription": "El daemon de autenticación SSSH maneja la firma de claves SSH y autenticación PAM para este recurso. Elija si se ejecuta en el sitio (Newt) o en un host remoto separado. Vea <docsLink>la documentación</docsLink> para más.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Seleccionar estrategia",
+    "internalResourceAuthDaemonStrategyLabel": "Ubicación",
+    "internalResourceAuthDaemonSite": "En el sitio",
+    "internalResourceAuthDaemonSiteDescription": "Auth daemon corre en el sitio (Newt).",
+    "internalResourceAuthDaemonRemote": "Host remoto",
+    "internalResourceAuthDaemonRemoteDescription": "El daemon Auth corre en un host que no es el sitio.",
+    "internalResourceAuthDaemonPort": "Puerto de demonio (opcional)",
    "orgAuthWhatsThis": "¿Dónde puedo encontrar el ID de mi organización?",
    "learnMore": "Más información",
    "backToHome": "Volver a inicio",
--- a/messages/fr-FR.json
+++ b/messages/fr-FR.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Rôle supprimé",
    "accessRoleRemovedDescription": "Le rôle a été supprimé avec succès.",
    "accessRoleRequiredRemove": "Avant de supprimer ce rôle, veuillez sélectionner un nouveau rôle pour transférer les membres existants.",
+    "network": "Réseau",
    "manage": "Gérer",
    "sitesNotFound": "Aucun site trouvé.",
    "pangolinServerAdmin": "Admin Serveur - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Privé",
    "sidebarAccessControl": "Contrôle d'accès",
    "sidebarLogsAndAnalytics": "Journaux & Analytiques",
+    "sidebarTeam": "Equipe",
    "sidebarUsers": "Utilisateurs",
    "sidebarAdmin": "Administrateur",
    "sidebarInvitations": "Invitations",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Journaux & Analytiques",
    "sidebarBluePrints": "Configs",
    "sidebarOrganization": "Organisation",
+    "sidebarManagement": "Gestion",
    "sidebarBillingAndLicenses": "Facturation & Licences",
    "sidebarLogsAnalytics": "Analyses",
    "blueprints": "Configs",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Contenu analysé (lecture seule)",
    "enableDockerSocket": "Activer la Config Docker",
    "enableDockerSocketDescription": "Activer le ramassage d'étiquettes de socket Docker pour les étiquettes de plan. Le chemin de socket doit être fourni à Newt.",
-    "enableDockerSocketLink": "En savoir plus",
    "viewDockerContainers": "Voir les conteneurs Docker",
    "containersIn": "Conteneurs en {siteName}",
    "selectContainerDescription": "Sélectionnez n'importe quel conteneur à utiliser comme nom d'hôte pour cette cible. Cliquez sur un port pour utiliser un port.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Avis de disponibilité des fonctionnalités",
    "billingFeatureLossDescription": "En rétrogradant, les fonctionnalités non disponibles dans le nouveau plan seront automatiquement désactivées. Certains paramètres et configurations peuvent être perdus. Veuillez consulter la matrice de prix pour comprendre quelles fonctionnalités ne seront plus disponibles.",
    "billingUsageExceedsLimit": "L'utilisation actuelle ({current}) dépasse la limite ({limit})",
+    "billingPastDueTitle": "Paiement en retard",
+    "billingPastDueDescription": "Votre paiement est échu. Veuillez mettre à jour votre méthode de paiement pour continuer à utiliser les fonctionnalités de votre plan actuel. Si non résolu, votre abonnement sera annulé et vous serez remis au niveau gratuit.",
+    "billingUnpaidTitle": "Abonnement impayé",
+    "billingUnpaidDescription": "Votre abonnement est impayé et vous avez été reversé au niveau gratuit. Veuillez mettre à jour votre méthode de paiement pour restaurer votre abonnement.",
+    "billingIncompleteTitle": "Paiement incomplet",
+    "billingIncompleteDescription": "Votre paiement est incomplet. Veuillez compléter le processus de paiement pour activer votre abonnement.",
+    "billingIncompleteExpiredTitle": "Paiement expiré",
+    "billingIncompleteExpiredDescription": "Votre paiement n'a jamais été complété et a expiré. Vous avez été restauré au niveau gratuit. Veuillez vous abonner à nouveau pour restaurer l'accès aux fonctionnalités payantes.",
+    "billingManageSubscription": "Gérer votre abonnement",
+    "billingResolvePaymentIssue": "Veuillez résoudre votre problème de paiement avant de procéder à la mise à niveau ou à la rétrogradation",
    "signUpTerms": {
        "IAgreeToThe": "Je suis d'accord avec",
        "termsOfService": "les conditions d'utilisation",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Le temps est exprimé en secondes",
    "requireDeviceApproval": "Exiger les autorisations de l'appareil",
    "requireDeviceApprovalDescription": "Les utilisateurs ayant ce rôle ont besoin de nouveaux périphériques approuvés par un administrateur avant de pouvoir se connecter et accéder aux ressources.",
+    "sshAccess": "Accès SSH",
+    "roleAllowSsh": "Autoriser SSH",
+    "roleAllowSshAllow": "Autoriser",
+    "roleAllowSshDisallow": "Interdire",
+    "roleAllowSshDescription": "Autoriser les utilisateurs avec ce rôle à se connecter aux ressources via SSH. Lorsque désactivé, le rôle ne peut pas utiliser les accès SSH.",
+    "sshSudoMode": "Accès Sudo",
+    "sshSudoModeNone": "Aucun",
+    "sshSudoModeNoneDescription": "L'utilisateur ne peut pas exécuter de commandes avec sudo.",
+    "sshSudoModeFull": "Sudo complet",
+    "sshSudoModeFullDescription": "L'utilisateur peut exécuter n'importe quelle commande avec sudo.",
+    "sshSudoModeCommands": "Commandes",
+    "sshSudoModeCommandsDescription": "L'utilisateur ne peut exécuter que les commandes spécifiées avec sudo.",
+    "sshSudo": "Autoriser sudo",
+    "sshSudoCommands": "Commandes Sudo",
+    "sshSudoCommandsDescription": "Liste des commandes que l'utilisateur est autorisé à exécuter avec sudo.",
+    "sshCreateHomeDir": "Créer un répertoire personnel",
+    "sshUnixGroups": "Groupes Unix",
+    "sshUnixGroupsDescription": "Groupes Unix à ajouter à l'utilisateur sur l'hôte cible.",
    "retryAttempts": "Tentatives de réessai",
    "expectedResponseCodes": "Codes de réponse attendus",
    "expectedResponseCodesDescription": "Code de statut HTTP indiquant un état de santé satisfaisant. Si non renseigné, 200-300 est considéré comme satisfaisant.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Contrôle d'accès",
    "editInternalResourceDialogAccessControlDescription": "Contrôlez quels rôles, utilisateurs et clients de machine ont accès à cette ressource lorsqu'ils sont connectés. Les administrateurs ont toujours accès.",
    "editInternalResourceDialogPortRangeValidationError": "La plage de ports doit être \"*\" pour tous les ports, ou une liste de ports et de plages séparés par des virgules (par exemple, \"80,443,8000-9000\"). Les ports doivent être compris entre 1 et 65535.",
+    "internalResourceAuthDaemonStrategy": "Emplacement du démon d'authentification SSH",
+    "internalResourceAuthDaemonStrategyDescription": "Choisissez où le démon d'authentification SSH s'exécute : sur le site (Newt) ou sur un hôte distant.",
+    "internalResourceAuthDaemonDescription": "Le démon d'authentification SSH gère la signature des clés SSH et l'authentification PAM pour cette ressource. Choisissez s'il fonctionne sur le site (Newt) ou sur un hôte distant séparé. Voir <docsLink>la documentation</docsLink> pour plus d'informations.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Choisir une stratégie",
+    "internalResourceAuthDaemonStrategyLabel": "Localisation",
+    "internalResourceAuthDaemonSite": "Sur le site",
+    "internalResourceAuthDaemonSiteDescription": "Le démon Auth fonctionne sur le site (Newt).",
+    "internalResourceAuthDaemonRemote": "Hôte distant",
+    "internalResourceAuthDaemonRemoteDescription": "Le démon Auth fonctionne sur un hôte qui n'est pas le site.",
+    "internalResourceAuthDaemonPort": "Port du démon (optionnel)",
    "orgAuthWhatsThis": "Où puis-je trouver mon identifiant d'organisation ?",
    "learnMore": "En savoir plus",
    "backToHome": "Retour à l'accueil",
--- a/messages/it-IT.json
+++ b/messages/it-IT.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Ruolo rimosso",
    "accessRoleRemovedDescription": "Il ruolo è stato rimosso con successo.",
    "accessRoleRequiredRemove": "Prima di eliminare questo ruolo, seleziona un nuovo ruolo a cui trasferire i membri esistenti.",
+    "network": "Rete",
    "manage": "Gestisci",
    "sitesNotFound": "Nessun sito trovato.",
    "pangolinServerAdmin": "Server Admin - Pangolina",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Privato",
    "sidebarAccessControl": "Controllo Accesso",
    "sidebarLogsAndAnalytics": "Registri E Analisi",
+    "sidebarTeam": "Squadra",
    "sidebarUsers": "Utenti",
    "sidebarAdmin": "Amministratore",
    "sidebarInvitations": "Inviti",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Log & Analytics",
    "sidebarBluePrints": "Progetti",
    "sidebarOrganization": "Organizzazione",
+    "sidebarManagement": "Gestione",
    "sidebarBillingAndLicenses": "Fatturazione E Licenze",
    "sidebarLogsAnalytics": "Analisi",
    "blueprints": "Progetti",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Sommario Analizzato (Solo Lettura)",
    "enableDockerSocket": "Abilita Progetto Docker",
    "enableDockerSocketDescription": "Abilita la raschiatura dell'etichetta Docker Socket per le etichette dei progetti. Il percorso del socket deve essere fornito a Newt.",
-    "enableDockerSocketLink": "Scopri di più",
    "viewDockerContainers": "Visualizza Contenitori Docker",
    "containersIn": "Contenitori in {siteName}",
    "selectContainerDescription": "Seleziona qualsiasi contenitore da usare come hostname per questo obiettivo. Fai clic su una porta per usare una porta.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Avviso Di Disponibilità Caratteristica",
    "billingFeatureLossDescription": "Con il downgrading, le funzioni non disponibili nel nuovo piano saranno disattivate automaticamente. Alcune impostazioni e configurazioni potrebbero andare perse. Controlla la matrice dei prezzi per capire quali funzioni non saranno più disponibili.",
    "billingUsageExceedsLimit": "L'utilizzo corrente ({current}) supera il limite ({limit})",
+    "billingPastDueTitle": "Pagamento Scaduto",
+    "billingPastDueDescription": "Il pagamento è scaduto. Si prega di aggiornare il metodo di pagamento per continuare a utilizzare le funzioni del piano corrente. Se non risolto, il tuo abbonamento verrà annullato e verrai ripristinato al livello gratuito.",
+    "billingUnpaidTitle": "Abbonamento Non Pagato",
+    "billingUnpaidDescription": "Il tuo abbonamento non è pagato e sei stato restituito al livello gratuito. Per favore aggiorna il metodo di pagamento per ripristinare l'abbonamento.",
+    "billingIncompleteTitle": "Pagamento Incompleto",
+    "billingIncompleteDescription": "Il pagamento è incompleto. Si prega di completare il processo di pagamento per attivare il tuo abbonamento.",
+    "billingIncompleteExpiredTitle": "Pagamento Scaduto",
+    "billingIncompleteExpiredDescription": "Il tuo pagamento non è mai stato completato ed è scaduto. Sei stato ripristinato al livello gratuito. Si prega di iscriversi nuovamente per ripristinare l'accesso alle funzionalità a pagamento.",
+    "billingManageSubscription": "Gestisci il tuo abbonamento",
+    "billingResolvePaymentIssue": "Si prega di risolvere il problema di pagamento prima di aggiornare o declassare",
    "signUpTerms": {
        "IAgreeToThe": "Accetto i",
        "termsOfService": "termini di servizio",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Il tempo è in secondi",
    "requireDeviceApproval": "Richiede Approvazioni Dispositivo",
    "requireDeviceApprovalDescription": "Gli utenti con questo ruolo hanno bisogno di nuovi dispositivi approvati da un amministratore prima di poter connettersi e accedere alle risorse.",
+    "sshAccess": "Accesso SSH",
+    "roleAllowSsh": "Consenti SSH",
+    "roleAllowSshAllow": "Consenti",
+    "roleAllowSshDisallow": "Non Consentire",
+    "roleAllowSshDescription": "Consenti agli utenti con questo ruolo di connettersi alle risorse tramite SSH. Quando disabilitato, il ruolo non può utilizzare l'accesso SSH.",
+    "sshSudoMode": "Accesso Sudo",
+    "sshSudoModeNone": "Nessuno",
+    "sshSudoModeNoneDescription": "L'utente non può eseguire comandi con sudo.",
+    "sshSudoModeFull": "Sudo Completo",
+    "sshSudoModeFullDescription": "L'utente può eseguire qualsiasi comando con sudo.",
+    "sshSudoModeCommands": "Comandi",
+    "sshSudoModeCommandsDescription": "L'utente può eseguire solo i comandi specificati con sudo.",
+    "sshSudo": "Consenti sudo",
+    "sshSudoCommands": "Comandi Sudo",
+    "sshSudoCommandsDescription": "Elenco di comandi che l'utente può eseguire con sudo.",
+    "sshCreateHomeDir": "Crea Cartella Home",
+    "sshUnixGroups": "Gruppi Unix",
+    "sshUnixGroupsDescription": "Gruppi Unix su cui aggiungere l'utente sull'host di destinazione.",
    "retryAttempts": "Tentativi di Riprova",
    "expectedResponseCodes": "Codici di Risposta Attesi",
    "expectedResponseCodesDescription": "Codice di stato HTTP che indica lo stato di salute. Se lasciato vuoto, considerato sano è compreso tra 200-300.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Controllo Accesso",
    "editInternalResourceDialogAccessControlDescription": "Controlla quali ruoli, utenti e client macchina hanno accesso a questa risorsa quando connessi. Gli amministratori hanno sempre accesso.",
    "editInternalResourceDialogPortRangeValidationError": "Il range delle porte deve essere \"*\" per tutte le porte, o un elenco di porte e intervalli separato da virgole (ad es. \"80,443,8000-9000\"). Le porte devono essere tra 1 e 65535.",
+    "internalResourceAuthDaemonStrategy": "Posizione Demone Autenticazione SSH",
+    "internalResourceAuthDaemonStrategyDescription": "Scegli dove funziona il demone di autenticazione SSH: sul sito (Newt) o su un host remoto.",
+    "internalResourceAuthDaemonDescription": "Il demone di autenticazione SSH gestisce la firma della chiave SSH e l'autenticazione PAM per questa risorsa. Scegli se viene eseguito sul sito (Newt) o su un host remoto separato. Vedi <docsLink>la documentazione</docsLink> per ulteriori informazioni.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Seleziona Strategia",
+    "internalResourceAuthDaemonStrategyLabel": "Posizione",
+    "internalResourceAuthDaemonSite": "Sul Sito",
+    "internalResourceAuthDaemonSiteDescription": "Il demone Auth viene eseguito sul sito (Nuovo).",
+    "internalResourceAuthDaemonRemote": "Host Remoto",
+    "internalResourceAuthDaemonRemoteDescription": "Il demone di autenticazione viene eseguito su un host che non è il sito.",
+    "internalResourceAuthDaemonPort": "Porta Demone (facoltativa)",
    "orgAuthWhatsThis": "Dove posso trovare l'ID della mia organizzazione?",
    "learnMore": "Scopri di più",
    "backToHome": "Torna alla home",
--- a/messages/ko-KR.json
+++ b/messages/ko-KR.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "역할이 제거되었습니다",
    "accessRoleRemovedDescription": "역할이 성공적으로 제거되었습니다.",
    "accessRoleRequiredRemove": "이 역할을 삭제하기 전에 기존 구성원을 전송할 새 역할을 선택하세요.",
+    "network": "네트워크",
    "manage": "관리",
    "sitesNotFound": "사이트를 찾을 수 없습니다.",
    "pangolinServerAdmin": "서버 관리자 - 판골린",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "비공개",
    "sidebarAccessControl": "액세스 제어",
    "sidebarLogsAndAnalytics": "로그 및 분석",
+    "sidebarTeam": "팀",
    "sidebarUsers": "사용자",
    "sidebarAdmin": "관리자",
    "sidebarInvitations": "초대",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "로그 & 통계",
    "sidebarBluePrints": "청사진",
    "sidebarOrganization": "조직",
+    "sidebarManagement": "관리",
    "sidebarBillingAndLicenses": "결제 및 라이선스",
    "sidebarLogsAnalytics": "분석",
    "blueprints": "청사진",
@@ -1289,7 +1292,6 @@
    "parsedContents": "구문 분석된 콘텐츠 (읽기 전용)",
    "enableDockerSocket": "Docker 청사진 활성화",
    "enableDockerSocketDescription": "블루프린트 레이블을 위한 Docker 소켓 레이블 수집을 활성화합니다. 소켓 경로는 Newt에 제공되어야 합니다.",
-    "enableDockerSocketLink": "자세히 알아보기",
    "viewDockerContainers": "도커 컨테이너 보기",
    "containersIn": "{siteName}의 컨테이너",
    "selectContainerDescription": "이 대상을 위한 호스트 이름으로 사용할 컨테이너를 선택하세요. 포트를 사용하려면 포트를 클릭하세요.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "기능 가용성 알림",
    "billingFeatureLossDescription": "다운그레이드함으로써 새 계획에서 사용할 수 없는 기능은 자동으로 비활성화됩니다. 일부 설정 및 구성은 손실될 수 있습니다. 어떤 기능들이 더 이상 사용 불가능한지 이해하기 위해 가격표를 검토하세요.",
    "billingUsageExceedsLimit": "현재 사용량 ({current})이 제한 ({limit})을 초과합니다",
+    "billingPastDueTitle": "연체된 결제",
+    "billingPastDueDescription": "결제가 연체되었습니다. 현재 이용 중인 플랜 기능을 계속 사용하기 위해 결제 수단을 업데이트해 주세요. 해결되지 않으면 구독이 취소되고 무료 요금제로 전환됩니다.",
+    "billingUnpaidTitle": "결제되지 않은 구독",
+    "billingUnpaidDescription": "구독 결제가 완료되지 않아 무료 요금제로 전환되었습니다. 구독을 복원하려면 결제 수단을 업데이트해 주세요.",
+    "billingIncompleteTitle": "불완전한 결제",
+    "billingIncompleteDescription": "결제가 불완전합니다. 구독을 활성화하기 위해 결제 과정을 완료해 주세요.",
+    "billingIncompleteExpiredTitle": "만료된 결제",
+    "billingIncompleteExpiredDescription": "결제가 완료되지 않아 만료되었습니다. 무료 요금제로 전환되었습니다. 유료 기능에 대한 액세스를 복원하려면 다시 구독해 주세요.",
+    "billingManageSubscription": "구독을 관리하십시오",
+    "billingResolvePaymentIssue": "업그레이드 또는 다운그레이드하기 전에 결제 문제를 해결해 주세요.",
    "signUpTerms": {
        "IAgreeToThe": "동의합니다",
        "termsOfService": "서비스 약관",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "시간은 초 단위입니다",
    "requireDeviceApproval": "장치 승인 요구",
    "requireDeviceApprovalDescription": "이 역할을 가진 사용자는 장치가 연결되기 전에 관리자의 승인이 필요합니다.",
+    "sshAccess": "SSH 접속",
+    "roleAllowSsh": "SSH 허용",
+    "roleAllowSshAllow": "허용",
+    "roleAllowSshDisallow": "허용 안 함",
+    "roleAllowSshDescription": "이 역할을 가진 사용자가 SSH를 통해 리소스에 연결할 수 있도록 허용합니다. 비활성화되면 역할은 SSH 접속을 사용할 수 없습니다.",
+    "sshSudoMode": "Sudo 접속",
+    "sshSudoModeNone": "없음",
+    "sshSudoModeNoneDescription": "사용자는 sudo로 명령을 실행할 수 없습니다.",
+    "sshSudoModeFull": "전체 Sudo",
+    "sshSudoModeFullDescription": "사용자는 모든 명령을 sudo로 실행할 수 있습니다.",
+    "sshSudoModeCommands": "명령",
+    "sshSudoModeCommandsDescription": "사용자는 sudo로 지정된 명령만 실행할 수 있습니다.",
+    "sshSudo": "Sudo 허용",
+    "sshSudoCommands": "Sudo 명령",
+    "sshSudoCommandsDescription": "사용자가 sudo로 실행할 수 있도록 허용된 명령 목록입니다.",
+    "sshCreateHomeDir": "홈 디렉터리 생성",
+    "sshUnixGroups": "유닉스 그룹",
+    "sshUnixGroupsDescription": "대상 호스트에서 사용자를 추가할 유닉스 그룹입니다.",
    "retryAttempts": "재시도 횟수",
    "expectedResponseCodes": "예상 응답 코드",
    "expectedResponseCodesDescription": "정상 상태를 나타내는 HTTP 상태 코드입니다. 비워 두면 200-300이 정상으로 간주됩니다.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "액세스 제어",
    "editInternalResourceDialogAccessControlDescription": "연결 시 이 리소스에 대한 액세스 권한을 가지는 역할, 사용자, 그리고 머신 클라이언트를 제어합니다. 관리자는 항상 접근할 수 있습니다.",
    "editInternalResourceDialogPortRangeValidationError": "모든 포트에 대해서는 \"*\"로, 아니면 쉼표로 구분된 포트 및 범위 목록(예: \"80,443,8000-9000\")을 설정해야 합니다. 포트는 1에서 65535 사이여야 합니다.",
+    "internalResourceAuthDaemonStrategy": "SSH 인증 데몬 위치",
+    "internalResourceAuthDaemonStrategyDescription": "SSH 인증 데몬이 작동하는 위치를 선택하세요: 사이트(Newt)에서 또는 원격 호스트에서.",
+    "internalResourceAuthDaemonDescription": "SSH 인증 데몬은 이 리소스를 위한 SSH 키 서명과 PAM 인증을 처리합니다. 사이트(Newt)에서 나 별도의 원격 호스트에서 실행할 것인지를 선택하세요. 자세한 내용은 <docsLink>문서</docsLink>를 참조하세요.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "전략 선택",
+    "internalResourceAuthDaemonStrategyLabel": "위치",
+    "internalResourceAuthDaemonSite": "사이트에서 인증 데몬이 실행됩니다(Newt).",
+    "internalResourceAuthDaemonSiteDescription": "인증 데몬이 사이트(Newt)에서 실행됩니다.",
+    "internalResourceAuthDaemonRemote": "원격 호스트",
+    "internalResourceAuthDaemonRemoteDescription": "인증 데몬이 사이트가 아닌 다른 호스트에서 실행됩니다.",
+    "internalResourceAuthDaemonPort": "데몬 포트 (선택 사항)",
    "orgAuthWhatsThis": "조직 ID를 어디에서 찾을 수 있습니까?",
    "learnMore": "자세히 알아보기",
    "backToHome": "홈으로 돌아가기",
--- a/messages/nb-NO.json
+++ b/messages/nb-NO.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Rolle fjernet",
    "accessRoleRemovedDescription": "Rollen er vellykket fjernet.",
    "accessRoleRequiredRemove": "Før du sletter denne rollen, vennligst velg en ny rolle å overføre eksisterende medlemmer til.",
+    "network": "Nettverk",
    "manage": "Administrer",
    "sitesNotFound": "Ingen områder funnet.",
    "pangolinServerAdmin": "Server Admin - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Privat",
    "sidebarAccessControl": "Tilgangskontroll",
    "sidebarLogsAndAnalytics": "Logger og analyser",
+    "sidebarTeam": "Lag",
    "sidebarUsers": "Brukere",
    "sidebarAdmin": "Administrator",
    "sidebarInvitations": "Invitasjoner",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Logg og analyser",
    "sidebarBluePrints": "Tegninger",
    "sidebarOrganization": "Organisasjon",
+    "sidebarManagement": "Administrasjon",
    "sidebarBillingAndLicenses": "Fakturering & lisenser",
    "sidebarLogsAnalytics": "Analyser",
    "blueprints": "Tegninger",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Parastinnhold (kun lese)",
    "enableDockerSocket": "Aktiver Docker blåkopi",
    "enableDockerSocketDescription": "Aktiver skraping av Docker Socket for blueprint Etiketter. Socket bane må brukes for nye.",
-    "enableDockerSocketLink": "Lær mer",
    "viewDockerContainers": "Vis Docker-containere",
    "containersIn": "Containere i {siteName}",
    "selectContainerDescription": "Velg en hvilken som helst container for å bruke som vertsnavn for dette målet. Klikk på en port for å bruke en port.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Fremhev tilgjengelig varsel",
    "billingFeatureLossDescription": "Ved å nedgradere vil funksjoner som ikke er tilgjengelige i den nye planen automatisk bli deaktivert. Noen innstillinger og konfigurasjoner kan gå tapt. Vennligst gjennomgå prismatrisen for å forstå hvilke funksjoner som ikke lenger vil være tilgjengelige.",
    "billingUsageExceedsLimit": "Gjeldende bruk ({current}) overskrider grensen ({limit})",
+    "billingPastDueTitle": "Betalingen har forfalt",
+    "billingPastDueDescription": "Betalingen er forfalt. Vennligst oppdater betalingsmetoden din for å fortsette å bruke den gjeldende funksjonsplanen din. Hvis du ikke har løst deg, vil abonnementet ditt avbrytes, og du vil bli tilbakestilt til gratistiden.",
+    "billingUnpaidTitle": "Abonnement ubetalt",
+    "billingUnpaidDescription": "Ditt abonnement er ubetalt og du har blitt tilbakestilt til gratis kasse. Vennligst oppdater din betalingsmetode for å gjenopprette abonnementet.",
+    "billingIncompleteTitle": "Betaling ufullstendig",
+    "billingIncompleteDescription": "Betalingen er ufullstendig. Vennligst fullfør betalingsprosessen for å aktivere abonnementet.",
+    "billingIncompleteExpiredTitle": "Betaling utløpt",
+    "billingIncompleteExpiredDescription": "Din betaling ble aldri fullført, og har utløpt. Du har blitt tilbakestilt til gratis dekk. Vennligst abonner på nytt for å gjenopprette tilgangen til betalte funksjoner.",
+    "billingManageSubscription": "Administrere ditt abonnement",
+    "billingResolvePaymentIssue": "Vennligst løs ditt betalingsproblem før du oppgraderer eller nedgraderer betalingen",
    "signUpTerms": {
        "IAgreeToThe": "Jeg godtar",
        "termsOfService": "brukervilkårene",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Tid er i sekunder",
    "requireDeviceApproval": "Krev enhetsgodkjenning",
    "requireDeviceApprovalDescription": "Brukere med denne rollen trenger nye enheter godkjent av en admin før de kan koble seg og få tilgang til ressurser.",
+    "sshAccess": "SSH tilgang",
+    "roleAllowSsh": "Tillat SSH",
+    "roleAllowSshAllow": "Tillat",
+    "roleAllowSshDisallow": "Forby",
+    "roleAllowSshDescription": "Tillat brukere med denne rollen å koble til ressurser via SSH. Når deaktivert får rollen ikke tilgang til SSH.",
+    "sshSudoMode": "Sudo tilgang",
+    "sshSudoModeNone": "Ingen",
+    "sshSudoModeNoneDescription": "Brukeren kan ikke kjøre kommandoer med sudo.",
+    "sshSudoModeFull": "Full Sudo",
+    "sshSudoModeFullDescription": "Brukeren kan kjøre hvilken som helst kommando med sudo.",
+    "sshSudoModeCommands": "Kommandoer",
+    "sshSudoModeCommandsDescription": "Brukeren kan bare kjøre de angitte kommandoene med sudo.",
+    "sshSudo": "Tillat sudo",
+    "sshSudoCommands": "Sudo kommandoer",
+    "sshSudoCommandsDescription": "Liste av kommandoer brukeren har lov til å kjøre med sudo.",
+    "sshCreateHomeDir": "Opprett hjemmappe",
+    "sshUnixGroups": "Unix grupper",
+    "sshUnixGroupsDescription": "Unix grupper for å legge til brukeren til målverten.",
    "retryAttempts": "Forsøk på nytt",
    "expectedResponseCodes": "Forventede svarkoder",
    "expectedResponseCodesDescription": "HTTP-statuskode som indikerer sunn status. Hvis den blir stående tom, regnes 200-300 som sunn.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Tilgangskontroll",
    "editInternalResourceDialogAccessControlDescription": "Kontroller hvilke roller, brukere og maskinklienter som har tilgang til denne ressursen når den er koblet til. Administratorer har alltid tilgang.",
    "editInternalResourceDialogPortRangeValidationError": "Portsjiktet må være \"*\" for alle porter, eller en kommaseparert liste med porter og sjikt (f.eks. \"80,443,8000-9000\"). Porter må være mellom 1 og 65535.",
+    "internalResourceAuthDaemonStrategy": "SSH Auth Daemon Sted",
+    "internalResourceAuthDaemonStrategyDescription": "Velg hvor SSH-autentisering daemon kjører: på nettstedet (Newt) eller på en ekstern vert.",
+    "internalResourceAuthDaemonDescription": "SSH-godkjenning daemon håndterer SSH-nøkkel signering og PAM autentisering for denne ressursen. Velg om den kjører på nettstedet (Newt) eller på en separat ekstern vert. Se <docsLink>dokumentasjonen</docsLink> for mer.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Velg strategi",
+    "internalResourceAuthDaemonStrategyLabel": "Sted",
+    "internalResourceAuthDaemonSite": "På nettsted",
+    "internalResourceAuthDaemonSiteDescription": "Autentiser daemon kjører på nettstedet (Newt).",
+    "internalResourceAuthDaemonRemote": "Ekstern vert",
+    "internalResourceAuthDaemonRemoteDescription": "Autentiser daemon kjører på en vert som ikke er nettstedet.",
+    "internalResourceAuthDaemonPort": "Daemon Port (valgfritt)",
    "orgAuthWhatsThis": "Hvor kan jeg finne min organisasjons-ID?",
    "learnMore": "Lær mer",
    "backToHome": "Gå tilbake til start",
--- a/messages/nl-NL.json
+++ b/messages/nl-NL.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Rol verwijderd",
    "accessRoleRemovedDescription": "De rol is succesvol verwijderd.",
    "accessRoleRequiredRemove": "Voordat u deze rol verwijdert, selecteer een nieuwe rol om bestaande leden aan te dragen.",
+    "network": "Netwerk",
    "manage": "Beheren",
    "sitesNotFound": "Geen sites gevonden.",
    "pangolinServerAdmin": "Serverbeheer - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Privé",
    "sidebarAccessControl": "Toegangs controle",
    "sidebarLogsAndAnalytics": "Logs & Analytics",
+    "sidebarTeam": "Team",
    "sidebarUsers": "Gebruikers",
    "sidebarAdmin": "Beheerder",
    "sidebarInvitations": "Uitnodigingen",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Log & Analytics",
    "sidebarBluePrints": "Blauwdrukken",
    "sidebarOrganization": "Organisatie",
+    "sidebarManagement": "Beheer",
    "sidebarBillingAndLicenses": "Facturatie & Licenties",
    "sidebarLogsAnalytics": "Analyses",
    "blueprints": "Blauwdrukken",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Geparseerde inhoud (alleen lezen)",
    "enableDockerSocket": "Schakel Docker Blauwdruk in",
    "enableDockerSocketDescription": "Schakel Docker Socket label in voor blauwdruk labels. Pad naar Nieuw.",
-    "enableDockerSocketLink": "Meer informatie",
    "viewDockerContainers": "Bekijk Docker containers",
    "containersIn": "Containers in {siteName}",
    "selectContainerDescription": "Selecteer een container om als hostnaam voor dit doel te gebruiken. Klik op een poort om een poort te gebruiken.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Kennisgeving beschikbaarheid",
    "billingFeatureLossDescription": "Door downgraden worden functies die niet beschikbaar zijn in het nieuwe abonnement automatisch uitgeschakeld. Sommige instellingen en configuraties kunnen verloren gaan. Raadpleeg de prijsmatrix om te begrijpen welke functies niet langer beschikbaar zijn.",
    "billingUsageExceedsLimit": "Huidig gebruik ({current}) overschrijdt limiet ({limit})",
+    "billingPastDueTitle": "Vervaldatum betaling",
+    "billingPastDueDescription": "Uw betaling is verlopen. Werk uw betaalmethode bij om uw huidige abonnementsfuncties te blijven gebruiken. Als dit niet is opgelost, zal je abonnement worden geannuleerd en zal je worden teruggezet naar de vrije rang.",
+    "billingUnpaidTitle": "Abonnement Onbetaald",
+    "billingUnpaidDescription": "Uw abonnement is niet betaald en u bent teruggekeerd naar het gratis niveau. Update uw betalingsmethode om uw abonnement te herstellen.",
+    "billingIncompleteTitle": "Betaling onvolledig",
+    "billingIncompleteDescription": "Uw betaling is onvolledig. Voltooi alstublieft het betalingsproces om uw abonnement te activeren.",
+    "billingIncompleteExpiredTitle": "Betaling verlopen",
+    "billingIncompleteExpiredDescription": "Uw betaling is nooit voltooid en verlopen. U bent teruggekeerd naar de gratis niveaus. Abonneer u opnieuw om de toegang tot betaalde functies te herstellen.",
+    "billingManageSubscription": "Beheer uw abonnement",
+    "billingResolvePaymentIssue": "Gelieve uw betalingsprobleem op te lossen voor het upgraden of downgraden",
    "signUpTerms": {
        "IAgreeToThe": "Ik ga akkoord met de",
        "termsOfService": "servicevoorwaarden",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Tijd is in seconden",
    "requireDeviceApproval": "Vereist goedkeuring van apparaat",
    "requireDeviceApprovalDescription": "Gebruikers met deze rol hebben nieuwe apparaten nodig die door een beheerder zijn goedgekeurd voordat ze verbinding kunnen maken met bronnen en deze kunnen gebruiken.",
+    "sshAccess": "SSH toegang",
+    "roleAllowSsh": "SSH toestaan",
+    "roleAllowSshAllow": "Toestaan",
+    "roleAllowSshDisallow": "Weigeren",
+    "roleAllowSshDescription": "Sta gebruikers met deze rol toe om verbinding te maken met bronnen via SSH. Indien uitgeschakeld kan de rol geen gebruik maken van SSH toegang.",
+    "sshSudoMode": "Sudo toegang",
+    "sshSudoModeNone": "geen",
+    "sshSudoModeNoneDescription": "Gebruiker kan geen commando's uitvoeren met sudo.",
+    "sshSudoModeFull": "Volledige Sudo",
+    "sshSudoModeFullDescription": "Gebruiker kan elk commando uitvoeren met een sudo.",
+    "sshSudoModeCommands": "Opdrachten",
+    "sshSudoModeCommandsDescription": "Gebruiker kan alleen de opgegeven commando's uitvoeren met de sudo.",
+    "sshSudo": "sudo toestaan",
+    "sshSudoCommands": "Sudo Commando's",
+    "sshSudoCommandsDescription": "Lijst van commando's die de gebruiker mag uitvoeren met een sudo.",
+    "sshCreateHomeDir": "Maak Home Directory",
+    "sshUnixGroups": "Unix groepen",
+    "sshUnixGroupsDescription": "Unix groepen om de gebruiker toe te voegen aan de doel host.",
    "retryAttempts": "Herhaal Pogingen",
    "expectedResponseCodes": "Verwachte Reactiecodes",
    "expectedResponseCodesDescription": "HTTP-statuscode die gezonde status aangeeft. Indien leeg wordt 200-300 als gezond beschouwd.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Toegangs controle",
    "editInternalResourceDialogAccessControlDescription": "Beheer welke rollen, gebruikers en machineclients toegang hebben tot deze bron wanneer ze zijn verbonden. Beheerders hebben altijd toegang.",
    "editInternalResourceDialogPortRangeValidationError": "Poortbereik moet \"*\" zijn voor alle poorten, of een komma-gescheiden lijst van poorten en bereiken (bijv. \"80,443,8000-9000\"). Poorten moeten tussen 1 en 65535 zijn.",
+    "internalResourceAuthDaemonStrategy": "SSH Auth Daemon locatie",
+    "internalResourceAuthDaemonStrategyDescription": "Kies waar de SSH authenticatie daemon wordt uitgevoerd: op de website (Newt) of op een externe host.",
+    "internalResourceAuthDaemonDescription": "De SSH authenticatie daemon zorgt voor SSH sleutelondertekening en PAM authenticatie voor deze resource. Kies of het wordt uitgevoerd op de website (Nieuw) of op een afzonderlijke externe host. Zie <docsLink>de documentatie</docsLink> voor meer.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Selecteer strategie",
+    "internalResourceAuthDaemonStrategyLabel": "Locatie",
+    "internalResourceAuthDaemonSite": "In de site",
+    "internalResourceAuthDaemonSiteDescription": "Auth daemon draait op de site (Newt).",
+    "internalResourceAuthDaemonRemote": "Externe host",
+    "internalResourceAuthDaemonRemoteDescription": "Authenticatiedaemon draait op een host die niet de site is.",
+    "internalResourceAuthDaemonPort": "Daemon poort (optioneel)",
    "orgAuthWhatsThis": "Waar kan ik mijn organisatie-ID vinden?",
    "learnMore": "Meer informatie",
    "backToHome": "Ga terug naar startpagina",
--- a/messages/pl-PL.json
+++ b/messages/pl-PL.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Rola usunięta",
    "accessRoleRemovedDescription": "Rola została pomyślnie usunięta.",
    "accessRoleRequiredRemove": "Przed usunięciem tej roli, wybierz nową rolę do której zostaną przeniesieni obecni członkowie.",
+    "network": "Sieć",
    "manage": "Zarządzaj",
    "sitesNotFound": "Nie znaleziono witryn.",
    "pangolinServerAdmin": "Administrator serwera - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Prywatny",
    "sidebarAccessControl": "Kontrola dostępu",
    "sidebarLogsAndAnalytics": "Logi i Analityki",
+    "sidebarTeam": "Drużyna",
    "sidebarUsers": "Użytkownicy",
    "sidebarAdmin": "Administrator",
    "sidebarInvitations": "Zaproszenia",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Dziennik & Analityka",
    "sidebarBluePrints": "Schematy",
    "sidebarOrganization": "Organizacja",
+    "sidebarManagement": "Zarządzanie",
    "sidebarBillingAndLicenses": "Płatność i licencje",
    "sidebarLogsAnalytics": "Analityka",
    "blueprints": "Schematy",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Przetworzona zawartość (tylko do odczytu)",
    "enableDockerSocket": "Włącz schemat dokera",
    "enableDockerSocketDescription": "Włącz etykietowanie kieszeni dokującej dla etykiet schematów. Ścieżka do gniazda musi być dostarczona do Newt.",
-    "enableDockerSocketLink": "Dowiedz się więcej",
    "viewDockerContainers": "Zobacz kontenery dokujące",
    "containersIn": "Pojemniki w {siteName}",
    "selectContainerDescription": "Wybierz dowolny kontener do użycia jako nazwa hosta dla tego celu. Kliknij port, aby użyć portu.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Powiadomienie o dostępności funkcji",
    "billingFeatureLossDescription": "Po obniżeniu wartości funkcje niedostępne w nowym planie zostaną automatycznie wyłączone. Niektóre ustawienia i konfiguracje mogą zostać utracone. Zapoznaj się z matrycą cenową, aby zrozumieć, które funkcje nie będą już dostępne.",
    "billingUsageExceedsLimit": "Bieżące użycie ({current}) przekracza limit ({limit})",
+    "billingPastDueTitle": "Płatność w przeszłości",
+    "billingPastDueDescription": "Twoja płatność jest zaległa. Zaktualizuj metodę płatności, aby kontynuować korzystanie z funkcji aktualnego planu. Jeśli nie zostanie rozwiązana, Twoja subskrypcja zostanie anulowana i zostaniesz przywrócony do darmowego poziomu.",
+    "billingUnpaidTitle": "Subskrypcja niezapłacona",
+    "billingUnpaidDescription": "Twoja subskrypcja jest niezapłacona i została przywrócona do darmowego poziomu. Zaktualizuj swoją metodę płatności, aby przywrócić subskrypcję.",
+    "billingIncompleteTitle": "Płatność niezakończona",
+    "billingIncompleteDescription": "Twoja płatność jest niekompletna. Ukończ proces płatności, aby aktywować subskrypcję.",
+    "billingIncompleteExpiredTitle": "Płatność wygasła",
+    "billingIncompleteExpiredDescription": "Twoja płatność nigdy nie została zakończona i wygasła. Zostałeś przywrócony do darmowego poziomu. Zapisz się ponownie, aby przywrócić dostęp do płatnych funkcji.",
+    "billingManageSubscription": "Zarządzaj subskrypcją",
+    "billingResolvePaymentIssue": "Rozwiąż problem z płatnościami przed aktualizacją lub obniżeniem oceny",
    "signUpTerms": {
        "IAgreeToThe": "Zgadzam się z",
        "termsOfService": "warunkami usługi",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Czas w sekundach",
    "requireDeviceApproval": "Wymagaj zatwierdzenia urządzenia",
    "requireDeviceApprovalDescription": "Użytkownicy o tej roli potrzebują nowych urządzeń zatwierdzonych przez administratora, zanim będą mogli połączyć się i uzyskać dostęp do zasobów.",
+    "sshAccess": "Dostęp SSH",
+    "roleAllowSsh": "Zezwalaj na SSH",
+    "roleAllowSshAllow": "Zezwól",
+    "roleAllowSshDisallow": "Nie zezwalaj",
+    "roleAllowSshDescription": "Zezwalaj użytkownikom z tej roli na łączenie się z zasobami za pomocą SSH. Gdy wyłączone, rola nie może korzystać z dostępu SSH.",
+    "sshSudoMode": "Dostęp Sudo",
+    "sshSudoModeNone": "Brak",
+    "sshSudoModeNoneDescription": "Użytkownik nie może uruchamiać poleceń z sudo.",
+    "sshSudoModeFull": "Pełne Sudo",
+    "sshSudoModeFullDescription": "Użytkownik może uruchomić dowolne polecenie z sudo.",
+    "sshSudoModeCommands": "Polecenia",
+    "sshSudoModeCommandsDescription": "Użytkownik może uruchamiać tylko określone polecenia z sudo.",
+    "sshSudo": "Zezwól na sudo",
+    "sshSudoCommands": "Komendy Sudo",
+    "sshSudoCommandsDescription": "Lista poleceń, które użytkownik może uruchamiać z sudo.",
+    "sshCreateHomeDir": "Utwórz katalog domowy",
+    "sshUnixGroups": "Grupy Unix",
+    "sshUnixGroupsDescription": "Grupy Unix do dodania użytkownika do docelowego hosta.",
    "retryAttempts": "Próby Ponowienia",
    "expectedResponseCodes": "Oczekiwane Kody Odpowiedzi",
    "expectedResponseCodesDescription": "Kod statusu HTTP, który wskazuje zdrowy status. Jeśli pozostanie pusty, uznaje się 200-300 za zdrowy.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Kontrola dostępu",
    "editInternalResourceDialogAccessControlDescription": "Kontroluj, które role, użytkownicy i klienci maszyn mają dostęp do tego zasobu po połączeniu. Administratorzy zawsze mają dostęp.",
    "editInternalResourceDialogPortRangeValidationError": "Zakres portów musi być \"*\" dla wszystkich portów lub listą portów i zakresów oddzielonych przecinkami (np. \"80,443,8000-9000\"). Porty muszą znajdować się w przedziale od 1 do 65535.",
+    "internalResourceAuthDaemonStrategy": "SSH Auth Daemon Lokalizacja",
+    "internalResourceAuthDaemonStrategyDescription": "Wybierz, gdzie działa demon uwierzytelniania SSH: na stronie (Newt) lub na zdalnym serwerze.",
+    "internalResourceAuthDaemonDescription": "Uwierzytelnianie SSH obsługuje podpisywanie klucza SSH i uwierzytelnianie PAM dla tego zasobu. Wybierz, czy działa na stronie (Newt), czy na oddzielnym serwerze zdalnym. Zobacz <docsLink>dokumentację</docsLink> dla więcej.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Wybierz strategię",
+    "internalResourceAuthDaemonStrategyLabel": "Lokalizacja",
+    "internalResourceAuthDaemonSite": "Na stronie",
+    "internalResourceAuthDaemonSiteDescription": "Demon Auth działa na stronie (nowy).",
+    "internalResourceAuthDaemonRemote": "Zdalny host",
+    "internalResourceAuthDaemonRemoteDescription": "Demon Auth działa na serwerze, który nie jest stroną.",
+    "internalResourceAuthDaemonPort": "Port Daemon (opcjonalnie)",
    "orgAuthWhatsThis": "Gdzie mogę znaleźć swój identyfikator organizacji?",
    "learnMore": "Dowiedz się więcej",
    "backToHome": "Wróć do strony głównej",
--- a/messages/pt-PT.json
+++ b/messages/pt-PT.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Função removida",
    "accessRoleRemovedDescription": "A função foi removida com sucesso.",
    "accessRoleRequiredRemove": "Antes de apagar esta função, selecione uma nova função para transferir os membros existentes.",
+    "network": "Rede",
    "manage": "Gerir",
    "sitesNotFound": "Nenhum site encontrado.",
    "pangolinServerAdmin": "Administrador do Servidor - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Privado",
    "sidebarAccessControl": "Controle de Acesso",
    "sidebarLogsAndAnalytics": "Registros e Análises",
+    "sidebarTeam": "Equipe",
    "sidebarUsers": "Utilizadores",
    "sidebarAdmin": "Administrador",
    "sidebarInvitations": "Convites",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Registo & Análise",
    "sidebarBluePrints": "Diagramas",
    "sidebarOrganization": "Organização",
+    "sidebarManagement": "Gestão",
    "sidebarBillingAndLicenses": "Faturamento e Licenças",
    "sidebarLogsAnalytics": "Análises",
    "blueprints": "Diagramas",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Conteúdo analisado (Somente Leitura)",
    "enableDockerSocket": "Habilitar o Diagrama Docker",
    "enableDockerSocketDescription": "Ativar a scraping de rótulo Docker para rótulos de diagramas. Caminho de Socket deve ser fornecido para Newt.",
-    "enableDockerSocketLink": "Saiba mais",
    "viewDockerContainers": "Ver contêineres Docker",
    "containersIn": "Contêineres em {siteName}",
    "selectContainerDescription": "Selecione qualquer contêiner para usar como hostname para este alvo. Clique em uma porta para usar uma porta.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Aviso de disponibilidade de recursos",
    "billingFeatureLossDescription": "Ao fazer o downgrading, recursos não disponíveis no novo plano serão desativados automaticamente. Algumas configurações e configurações podem ser perdidas. Por favor, revise a matriz de preços para entender quais características não estarão mais disponíveis.",
    "billingUsageExceedsLimit": "Uso atual ({current}) excede o limite ({limit})",
+    "billingPastDueTitle": "Pagamento passado devido",
+    "billingPastDueDescription": "Seu pagamento está vencido. Por favor, atualize seu método de pagamento para continuar usando os recursos do seu plano atual. Se não for resolvido, sua assinatura será cancelada e você será revertido para o nível gratuito.",
+    "billingUnpaidTitle": "Assinatura não paga",
+    "billingUnpaidDescription": "Sua assinatura não foi paga e você voltou para o nível gratuito. Atualize o seu método de pagamento para restaurar sua assinatura.",
+    "billingIncompleteTitle": "Pagamento Incompleto",
+    "billingIncompleteDescription": "Seu pagamento está incompleto. Por favor, complete o processo de pagamento para ativar sua assinatura.",
+    "billingIncompleteExpiredTitle": "Pagamento expirado",
+    "billingIncompleteExpiredDescription": "Seu pagamento nunca foi concluído e expirou. Você foi revertido para o nível gratuito. Por favor, inscreva-se novamente para restaurar o acesso a recursos pagos.",
+    "billingManageSubscription": "Gerencie sua assinatura",
+    "billingResolvePaymentIssue": "Por favor, resolva seu problema de pagamento antes de atualizar ou rebaixar",
    "signUpTerms": {
        "IAgreeToThe": "Concordo com",
        "termsOfService": "os termos de serviço",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "O tempo está em segundos",
    "requireDeviceApproval": "Exigir aprovação do dispositivo",
    "requireDeviceApprovalDescription": "Usuários com esta função precisam de novos dispositivos aprovados por um administrador antes que eles possam se conectar e acessar recursos.",
+    "sshAccess": "Acesso SSH",
+    "roleAllowSsh": "Permitir SSH",
+    "roleAllowSshAllow": "Autorizar",
+    "roleAllowSshDisallow": "Anular",
+    "roleAllowSshDescription": "Permitir que usuários com esta função se conectem a recursos via SSH. Quando desativado, a função não pode usar o acesso SSH.",
+    "sshSudoMode": "Acesso Sudo",
+    "sshSudoModeNone": "Nenhuma",
+    "sshSudoModeNoneDescription": "O usuário não pode executar comandos com o sudo.",
+    "sshSudoModeFull": "Sudo Completo",
+    "sshSudoModeFullDescription": "O usuário pode executar qualquer comando com sudo.",
+    "sshSudoModeCommands": "Comandos",
+    "sshSudoModeCommandsDescription": "Usuário só pode executar os comandos especificados com sudo.",
+    "sshSudo": "Permitir sudo",
+    "sshSudoCommands": "Comandos Sudo",
+    "sshSudoCommandsDescription": "Lista de comandos com permissão de executar com o sudo.",
+    "sshCreateHomeDir": "Criar Diretório Inicial",
+    "sshUnixGroups": "Grupos Unix",
+    "sshUnixGroupsDescription": "Grupos Unix para adicionar o usuário no host de destino.",
    "retryAttempts": "Tentativas de Repetição",
    "expectedResponseCodes": "Códigos de Resposta Esperados",
    "expectedResponseCodesDescription": "Código de status HTTP que indica estado saudável. Se deixado em branco, 200-300 é considerado saudável.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Controle de Acesso",
    "editInternalResourceDialogAccessControlDescription": "Controle quais funções, usuários e clientes de máquina podem acessar este recurso quando conectados. Os administradores sempre têm acesso.",
    "editInternalResourceDialogPortRangeValidationError": "O intervalo de portas deve ser \"*\" para todas as portas, ou uma lista de portas e intervalos separados por vírgulas (por exemplo, \"80,443,8000-9000\"). As portas devem estar entre 1 e 65535.",
+    "internalResourceAuthDaemonStrategy": "Local do Daemon de autenticação SSH",
+    "internalResourceAuthDaemonStrategyDescription": "Escolha onde o daemon de autenticação SSH funciona: no site (Newt) ou em um host remoto.",
+    "internalResourceAuthDaemonDescription": "A autenticação SSH daemon lida com assinatura de chave SSH e autenticação PAM para este recurso. Escolha se ele é executado no site (Newt) ou em um host remoto separado. Veja <docsLink>a documentação</docsLink> para mais informações.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Selecione a estratégia",
+    "internalResourceAuthDaemonStrategyLabel": "Local:",
+    "internalResourceAuthDaemonSite": "No Site",
+    "internalResourceAuthDaemonSiteDescription": "O serviço de autenticação é executado no site (Newt).",
+    "internalResourceAuthDaemonRemote": "Host Remoto",
+    "internalResourceAuthDaemonRemoteDescription": "O serviço de autenticação é executado em um host que não é o site.",
+    "internalResourceAuthDaemonPort": "Porta do Daemon (opcional)",
    "orgAuthWhatsThis": "Onde posso encontrar meu ID da organização?",
    "learnMore": "Saiba mais",
    "backToHome": "Voltar para a página inicial",
--- a/messages/ru-RU.json
+++ b/messages/ru-RU.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Роль удалена",
    "accessRoleRemovedDescription": "Роль была успешно удалена.",
    "accessRoleRequiredRemove": "Перед удалением этой роли выберите новую роль для переноса существующих участников.",
+    "network": "Сеть",
    "manage": "Управление",
    "sitesNotFound": "Сайты не найдены.",
    "pangolinServerAdmin": "Администратор сервера - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Приватный",
    "sidebarAccessControl": "Контроль доступа",
    "sidebarLogsAndAnalytics": "Журналы и аналитика",
+    "sidebarTeam": "Команда",
    "sidebarUsers": "Пользователи",
    "sidebarAdmin": "Админ",
    "sidebarInvitations": "Приглашения",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Журнал и аналитика",
    "sidebarBluePrints": "Чертежи",
    "sidebarOrganization": "Организация",
+    "sidebarManagement": "Управление",
    "sidebarBillingAndLicenses": "Биллинг и лицензии",
    "sidebarLogsAnalytics": "Статистика",
    "blueprints": "Чертежи",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Переработанное содержимое (только для чтения)",
    "enableDockerSocket": "Включить чертёж Docker",
    "enableDockerSocketDescription": "Включить scraping ярлыка Docker Socket для ярлыков чертежей. Путь к сокету должен быть предоставлен в Newt.",
-    "enableDockerSocketLink": "Узнать больше",
    "viewDockerContainers": "Просмотр контейнеров Docker",
    "containersIn": "Контейнеры в {siteName}",
    "selectContainerDescription": "Выберите любой контейнер для использования в качестве имени хоста для этой цели. Нажмите на порт, чтобы использовать порт.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Уведомление о доступности функций",
    "billingFeatureLossDescription": "При переходе на другой тарифный план функции не будут автоматически отключены. Некоторые настройки и конфигурации могут быть потеряны. Пожалуйста, ознакомьтесь с матрицей ценообразования, чтобы понять, какие функции больше не будут доступны.",
    "billingUsageExceedsLimit": "Текущее использование ({current}) превышает предел ({limit})",
+    "billingPastDueTitle": "Платеж просрочен",
+    "billingPastDueDescription": "Ваш платеж просрочен. Пожалуйста, обновите способ оплаты, чтобы продолжить использовать текущие функции. Если ваша подписка не будет решена, она будет отменена, и вы вернетесь к бесплатному уровню.",
+    "billingUnpaidTitle": "Подписка не оплачена",
+    "billingUnpaidDescription": "Ваша подписка не оплачена, и вы были возвращены к бесплатному уровню. Пожалуйста, обновите способ оплаты, чтобы восстановить вашу подписку.",
+    "billingIncompleteTitle": "Платеж не завершен",
+    "billingIncompleteDescription": "Ваш платеж не завершен. Пожалуйста, завершите процесс оплаты, чтобы активировать вашу подписку.",
+    "billingIncompleteExpiredTitle": "Платеж просрочен",
+    "billingIncompleteExpiredDescription": "Ваш платеж не был завершен и истек. Вы были возвращены к бесплатному уровню. Пожалуйста, подпишитесь снова, чтобы восстановить доступ к платным функциям.",
+    "billingManageSubscription": "Управление подпиской",
+    "billingResolvePaymentIssue": "Пожалуйста, решите проблему оплаты перед обновлением или понижением сорта",
    "signUpTerms": {
        "IAgreeToThe": "Я согласен с",
        "termsOfService": "условия использования",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Время указано в секундах",
    "requireDeviceApproval": "Требовать подтверждения устройства",
    "requireDeviceApprovalDescription": "Пользователям с этой ролью нужны новые устройства, одобренные администратором, прежде чем они смогут подключаться и получать доступ к ресурсам.",
+    "sshAccess": "SSH доступ",
+    "roleAllowSsh": "Разрешить SSH",
+    "roleAllowSshAllow": "Разрешить",
+    "roleAllowSshDisallow": "Запретить",
+    "roleAllowSshDescription": "Разрешить пользователям с этой ролью подключаться к ресурсам через SSH. Если отключено, роль не может использовать доступ SSH.",
+    "sshSudoMode": "Sudo доступ",
+    "sshSudoModeNone": "Нет",
+    "sshSudoModeNoneDescription": "Пользователь не может запускать команды с sudo.",
+    "sshSudoModeFull": "Полная судо",
+    "sshSudoModeFullDescription": "Пользователь может запускать любую команду с помощью sudo.",
+    "sshSudoModeCommands": "Команды",
+    "sshSudoModeCommandsDescription": "Пользователь может запускать только указанные команды с помощью sudo.",
+    "sshSudo": "Разрешить sudo",
+    "sshSudoCommands": "Sudo Команды",
+    "sshSudoCommandsDescription": "Список команд, которые пользователю разрешено запускать с помощью sudo.",
+    "sshCreateHomeDir": "Создать домашний каталог",
+    "sshUnixGroups": "Unix группы",
+    "sshUnixGroupsDescription": "Unix группы для добавления пользователя на целевой хост.",
    "retryAttempts": "Количество попыток повторного запроса",
    "expectedResponseCodes": "Ожидаемые коды ответов",
    "expectedResponseCodesDescription": "HTTP-код состояния, указывающий на здоровое состояние. Если оставить пустым, 200-300 считается здоровым.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Контроль доступа",
    "editInternalResourceDialogAccessControlDescription": "Контролируйте, какие роли, пользователи и машинные клиенты имеют доступ к этому ресурсу при подключении. Администраторы всегда имеют доступ.",
    "editInternalResourceDialogPortRangeValidationError": "Диапазон портов должен быть \"*\" для всех портов или списком портов и диапазонов через запятую (например, \"80,443,8000-9000\"). Порты должны находиться в диапазоне от 1 до 65535.",
+    "internalResourceAuthDaemonStrategy": "Местоположение демона по SSH",
+    "internalResourceAuthDaemonStrategyDescription": "Выберите, где работает демон аутентификации SSH: на сайте (Newt) или на удаленном узле.",
+    "internalResourceAuthDaemonDescription": "Демон аутентификации SSH обрабатывает подписание ключей SSH и аутентификацию PAM для этого ресурса. Выберите, запускать ли его на сайте (Newt) или на отдельном удаленном хосте. Подробности смотрите в <docsLink>документации</docsLink>.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Выберите стратегию",
+    "internalResourceAuthDaemonStrategyLabel": "Местоположение",
+    "internalResourceAuthDaemonSite": "На сайте",
+    "internalResourceAuthDaemonSiteDescription": "На сайте работает демон Auth (Newt).",
+    "internalResourceAuthDaemonRemote": "Удаленный хост",
+    "internalResourceAuthDaemonRemoteDescription": "Демон Auth запускается на хост, который не является сайтом.",
+    "internalResourceAuthDaemonPort": "Порт демона (опционально)",
    "orgAuthWhatsThis": "Где я могу найти ID моей организации?",
    "learnMore": "Узнать больше",
    "backToHome": "Вернуться домой",
--- a/messages/tr-TR.json
+++ b/messages/tr-TR.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "Rol kaldırıldı",
    "accessRoleRemovedDescription": "Rol başarıyla kaldırıldı.",
    "accessRoleRequiredRemove": "Bu rolü silmeden önce, mevcut üyeleri aktarmak için yeni bir rol seçin.",
+    "network": "Ağ",
    "manage": "Yönet",
    "sitesNotFound": "Site bulunamadı.",
    "pangolinServerAdmin": "Sunucu Yöneticisi - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "Özel",
    "sidebarAccessControl": "Erişim Kontrolü",
    "sidebarLogsAndAnalytics": "Kayıtlar & Analitik",
+    "sidebarTeam": "Ekip",
    "sidebarUsers": "Kullanıcılar",
    "sidebarAdmin": "Yönetici",
    "sidebarInvitations": "Davetiye",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "Kayıt & Analiz",
    "sidebarBluePrints": "Planlar",
    "sidebarOrganization": "Organizasyon",
+    "sidebarManagement": "Yönetim",
    "sidebarBillingAndLicenses": "Faturalandırma & Lisanslar",
    "sidebarLogsAnalytics": "Analitik",
    "blueprints": "Planlar",
@@ -1289,7 +1292,6 @@
    "parsedContents": "Verilerin Ayrıştırılmış İçeriği (Salt Okunur)",
    "enableDockerSocket": "Docker Soketini Etkinleştir",
    "enableDockerSocketDescription": "Plan etiketleri için Docker Socket etiket toplamasını etkinleştirin. Newt'e soket yolu sağlanmalıdır.",
-    "enableDockerSocketLink": "Daha fazla bilgi",
    "viewDockerContainers": "Docker Konteynerlerini Görüntüle",
    "containersIn": "{siteName} içindeki konteynerler",
    "selectContainerDescription": "Bu hedef için bir ana bilgisayar adı olarak kullanmak üzere herhangi bir konteyner seçin. Bir bağlantı noktası kullanmak için bir bağlantı noktasına tıklayın.",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "Özellik Kullanılabilirlik Bildirimi",
    "billingFeatureLossDescription": "Plan düşürüldüğünde, yeni planda mevcut olmayan özellikler otomatik olarak devre dışı bırakılacaktır. Bazı ayarlar ve yapılar kaybolabilir. Hangi özelliklerin artık mevcut olmayacağını anlamak için fiyat tablosunu inceleyiniz.",
    "billingUsageExceedsLimit": "Mevcut kullanım ({current}) limitleri ({limit}) aşıyor",
+    "billingPastDueTitle": "Ödeme Geçmiş",
+    "billingPastDueDescription": "Ödemenizın vadesi geçti. Mevcut plan özelliklerinizi kullanmaya devam etmek için lütfen ödeme yöntemini güncelleyin. Sorun çözülmezse aboneliğiniz iptal edilecek ve ücretsiz seviyeye dönüleceksiniz.",
+    "billingUnpaidTitle": "Ödenmemiş Abonelik",
+    "billingUnpaidDescription": "Aboneliğiniz ödenmedi ve ücretsiz seviyeye geri döndünüz. Aboneliğinizi geri yüklemek için lütfen ödeme yöntemini güncelleyin.",
+    "billingIncompleteTitle": "Eksik Ödeme",
+    "billingIncompleteDescription": "Ödemeniz eksik. Aboneliğinizi etkinleştirmek için lütfen ödeme sürecini tamamlayın.",
+    "billingIncompleteExpiredTitle": "Ödeme Süresi Doldu",
+    "billingIncompleteExpiredDescription": "Ödemeniz hiç tamamlanmadı ve süresi doldu. Ücretsiz seviyeye geri döndünüz. Ücretli özelliklere erişimi yeniden sağlamak için lütfen yeniden abone olun.",
+    "billingManageSubscription": "Aboneliğinizi Yönetin",
+    "billingResolvePaymentIssue": "Yükseltmeden veya düşürmeden önce ödeme sorunuzu çözün",
    "signUpTerms": {
        "IAgreeToThe": "Kabul ediyorum",
        "termsOfService": "hizmet şartları",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "Zaman saniye cinsindendir",
    "requireDeviceApproval": "Cihaz Onaylarını Gerektir",
    "requireDeviceApprovalDescription": "Bu role sahip kullanıcıların yeni cihazlarının bağlanabilmesi ve kaynaklara erişebilmesi için bir yönetici tarafından onaylanması gerekiyor.",
+    "sshAccess": "SSH Erişimi",
+    "roleAllowSsh": "SSH'a İzin Ver",
+    "roleAllowSshAllow": "İzin Ver",
+    "roleAllowSshDisallow": "İzin Verme",
+    "roleAllowSshDescription": "Bu role sahip kullanıcıların SSH aracılığıyla kaynaklara bağlanmasına izin verin. Devre dışı bırakıldığında, rol SSH erişimini kullanamaz.",
+    "sshSudoMode": "Sudo Erişimi",
+    "sshSudoModeNone": "Hiçbiri",
+    "sshSudoModeNoneDescription": "Kullanıcı, sudo komutunu kullanarak komut çalıştıramaz.",
+    "sshSudoModeFull": "Tam Sudo",
+    "sshSudoModeFullDescription": "Kullanıcı, sudo komutuyla her türlü komutu çalıştırabilir.",
+    "sshSudoModeCommands": "Komutlar",
+    "sshSudoModeCommandsDescription": "Kullanıcı sadece belirtilen komutları sudo ile çalıştırabilir.",
+    "sshSudo": "Sudo'ya izin ver",
+    "sshSudoCommands": "Sudo Komutları",
+    "sshSudoCommandsDescription": "Kullanıcının sudo ile çalıştırmasına izin verilen komutların listesi.",
+    "sshCreateHomeDir": "Ev Dizini Oluştur",
+    "sshUnixGroups": "Unix Grupları",
+    "sshUnixGroupsDescription": "Hedef ana bilgisayarda kullanıcıya eklemek için Unix grupları.",
    "retryAttempts": "Tekrar Deneme Girişimleri",
    "expectedResponseCodes": "Beklenen Yanıt Kodları",
    "expectedResponseCodesDescription": "Sağlıklı durumu gösteren HTTP durum kodu. Boş bırakılırsa, 200-300 arası sağlıklı kabul edilir.",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "Erişim Kontrolü",
    "editInternalResourceDialogAccessControlDescription": "Bağlandığında bu kaynağa erişimi olan roller, kullanıcılar ve makine müşterilerini kontrol edin. Yöneticiler her zaman erişime sahiptir.",
    "editInternalResourceDialogPortRangeValidationError": "Port aralığı, tüm portlar için \"*\" veya virgülle ayrılmış bir port ve aralık listesi olmalıdır (ör. \"80,443,8000-9000\"). Portlar 1 ile 65535 arasında olmalıdır.",
+    "internalResourceAuthDaemonStrategy": "SSH Kimlik Doğrulama Daemon Yeri",
+    "internalResourceAuthDaemonStrategyDescription": "SSH kimlik doğrulama sunucusunun nerede çalışacağını seçin: sitede (Newt) veya uzak bir ana bilgisayarda.",
+    "internalResourceAuthDaemonDescription": "SSH kimlik doğrulama sunucusu, bu kaynak için SSH anahtar imzalama ve PAM kimlik doğrulamasını yapar. Sitede (Newt) veya ayrı bir uzak ana bilgisayarda çalışıp çalışmayacağını seçin. Daha fazla bilgi için <docsLink> belgeleri</docsLink> görün.",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "Strateji Seçin",
+    "internalResourceAuthDaemonStrategyLabel": "Konum",
+    "internalResourceAuthDaemonSite": "Sitede",
+    "internalResourceAuthDaemonSiteDescription": "Kimlik doğrulama sunucusu sitede (Newt) çalışır.",
+    "internalResourceAuthDaemonRemote": "Uzak Ana Bilgisayar",
+    "internalResourceAuthDaemonRemoteDescription": "Kimlik doğrulama sunucusu, site olmayan bir ana bilgisayarda çalışır.",
+    "internalResourceAuthDaemonPort": "Daemon Portu (isteğe bağlı)",
    "orgAuthWhatsThis": "Kuruluş kimliğimi nerede bulabilirim?",
    "learnMore": "Daha fazla bilgi",
    "backToHome": "Ana sayfaya geri dön",
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -790,6 +790,7 @@
    "accessRoleRemoved": "角色已删除",
    "accessRoleRemovedDescription": "角色已成功删除。",
    "accessRoleRequiredRemove": "删除此角色之前，请选择一个新角色来转移现有成员。",
+    "network": "网络",
    "manage": "管理",
    "sitesNotFound": "未找到站点。",
    "pangolinServerAdmin": "服务器管理员 - Pangolin",
@@ -1249,6 +1250,7 @@
    "sidebarClientResources": "非公开的",
    "sidebarAccessControl": "访问控制",
    "sidebarLogsAndAnalytics": "日志与分析",
+    "sidebarTeam": "团队",
    "sidebarUsers": "用户",
    "sidebarAdmin": "管理员",
    "sidebarInvitations": "邀请",
@@ -1267,6 +1269,7 @@
    "sidebarLogAndAnalytics": "日志与分析",
    "sidebarBluePrints": "蓝图",
    "sidebarOrganization": "组织",
+    "sidebarManagement": "管理",
    "sidebarBillingAndLicenses": "帐单和许可证",
    "sidebarLogsAnalytics": "分析",
    "blueprints": "蓝图",
@@ -1289,7 +1292,6 @@
    "parsedContents": "解析内容 (只读)",
    "enableDockerSocket": "启用 Docker 蓝图",
    "enableDockerSocketDescription": "启用 Docker Socket 标签擦除蓝图标签。套接字路径必须提供给新的。",
-    "enableDockerSocketLink": "了解更多",
    "viewDockerContainers": "查看停靠容器",
    "containersIn": "{siteName} 中的容器",
    "selectContainerDescription": "选择任何容器作为目标的主机名。点击端口使用端口。",
@@ -1570,6 +1572,16 @@
    "billingFeatureLossWarning": "功能可用通知",
    "billingFeatureLossDescription": "如果降级，新计划中不可用的功能将被自动禁用。一些设置和配置可能会丢失。 请查看定价矩阵以了解哪些功能将不再可用。",
    "billingUsageExceedsLimit": "当前使用量 ({current}) 超出限制 ({limit})",
+    "billingPastDueTitle": "过去到期的付款",
+    "billingPastDueDescription": "您的付款已过期。请更新您的付款方法以继续使用您当前的计划功能。 如果不解决，您的订阅将被取消，您将被恢复到免费等级。",
+    "billingUnpaidTitle": "订阅未付款",
+    "billingUnpaidDescription": "您的订阅未付，您已恢复到免费等级。请更新您的付款方法以恢复您的订阅。",
+    "billingIncompleteTitle": "付款不完成",
+    "billingIncompleteDescription": "您的付款不完整。请完成付款过程以激活您的订阅。",
+    "billingIncompleteExpiredTitle": "付款已过期",
+    "billingIncompleteExpiredDescription": "您的付款尚未完成且已过期。您已恢复到免费级别。请再次订阅以恢复对已支付功能的访问。",
+    "billingManageSubscription": "管理您的订阅",
+    "billingResolvePaymentIssue": "请在升级或降级之前解决您的付款问题",
    "signUpTerms": {
        "IAgreeToThe": "我同意",
        "termsOfService": "服务条款",
@@ -1643,6 +1655,24 @@
    "timeIsInSeconds": "时间以秒为单位",
    "requireDeviceApproval": "需要设备批准",
    "requireDeviceApprovalDescription": "具有此角色的用户需要管理员批准的新设备才能连接和访问资源。",
+    "sshAccess": "SSH 访问",
+    "roleAllowSsh": "允许 SSH",
+    "roleAllowSshAllow": "允许",
+    "roleAllowSshDisallow": "不允许",
+    "roleAllowSshDescription": "允许具有此角色的用户通过 SSH 连接到资源。禁用时，角色不能使用 SSH 访问。",
+    "sshSudoMode": "Sudo 访问",
+    "sshSudoModeNone": "无",
+    "sshSudoModeNoneDescription": "用户不能用sudo运行命令。",
+    "sshSudoModeFull": "全苏多",
+    "sshSudoModeFullDescription": "用户可以用 sudo 运行任何命令。",
+    "sshSudoModeCommands": "命令",
+    "sshSudoModeCommandsDescription": "用户只能用 sudo 运行指定的命令。",
+    "sshSudo": "允许Sudo",
+    "sshSudoCommands": "Sudo 命令",
+    "sshSudoCommandsDescription": "允许用户使用 sudo 运行的命令列表。",
+    "sshCreateHomeDir": "创建主目录",
+    "sshUnixGroups": "Unix 组",
+    "sshUnixGroupsDescription": "将用户添加到目标主机的Unix组。",
    "retryAttempts": "重试次数",
    "expectedResponseCodes": "期望响应代码",
    "expectedResponseCodesDescription": "HTTP 状态码表示健康状态。如留空，200-300 被视为健康。",
@@ -2503,6 +2533,17 @@
    "editInternalResourceDialogAccessControl": "访问控制",
    "editInternalResourceDialogAccessControlDescription": "控制当连接到此资源时，哪些角色、用户和机器客户端可以访问。管理员始终具有访问权。",
    "editInternalResourceDialogPortRangeValidationError": "端口范围必须为\"*\"表示所有端口，或一个用逗号分隔的端口和范围列表（例如：\"80,443,8000-9000\"）。端口必须在1到65535之间。",
+    "internalResourceAuthDaemonStrategy": "SSH 认证守护进程位置",
+    "internalResourceAuthDaemonStrategyDescription": "选择 SSH 身份验证守护进程在哪里运行：站点(新建) 或远程主机。",
+    "internalResourceAuthDaemonDescription": "SSH 身份验证守护程序处理此资源的 SSH 密钥签名和PAM 身份验证。 选择它是在站点(新建)还是在单独的远程主机上运行。请参阅 <docsLink>文档</docsLink>。",
+    "internalResourceAuthDaemonDocsUrl": "https://docs.pangolin.net",
+    "internalResourceAuthDaemonStrategyPlaceholder": "选择策略",
+    "internalResourceAuthDaemonStrategyLabel": "地点",
+    "internalResourceAuthDaemonSite": "在站点",
+    "internalResourceAuthDaemonSiteDescription": "认证守护进程在站点上运行(新建)。",
+    "internalResourceAuthDaemonRemote": "远程主机",
+    "internalResourceAuthDaemonRemoteDescription": "认证守护进程运行在不是站点的主机上。",
+    "internalResourceAuthDaemonPort": "守护进程端口(可选)",
    "orgAuthWhatsThis": "我的组织ID在哪里可以找到？",
    "learnMore": "了解更多",
    "backToHome": "返回首页",
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
    },
    "dependencies": {
        "@asteasolutions/zod-to-openapi": "8.4.0",
-        "@aws-sdk/client-s3": "3.989.0",
+        "@aws-sdk/client-s3": "3.996.0",
        "@faker-js/faker": "10.3.0",
        "@headlessui/react": "2.2.9",
        "@hookform/resolvers": "5.2.2",
@@ -89,7 +89,7 @@
        "jmespath": "0.16.0",
        "js-yaml": "4.1.1",
        "jsonwebtoken": "9.0.3",
-        "lucide-react": "0.563.0",
+        "lucide-react": "0.575.0",
        "maxmind": "5.0.5",
        "moment": "2.30.1",
        "next": "15.5.12",
@@ -100,7 +100,7 @@
        "nodemailer": "8.0.1",
        "oslo": "1.2.1",
        "pg": "8.18.0",
-        "posthog-node": "5.24.15",
+        "posthog-node": "5.25.0",
        "qrcode.react": "4.2.0",
        "react": "19.2.4",
        "react-day-picker": "9.13.2",
@@ -115,7 +115,7 @@
        "sshpk": "^1.18.0",
        "stripe": "20.3.1",
        "swagger-ui-express": "5.0.1",
-        "tailwind-merge": "3.4.0",
+        "tailwind-merge": "3.5.0",
        "topojson-client": "3.1.0",
        "tw-animate-css": "1.4.0",
        "use-debounce": "^10.1.0",
--- a/server/auth/sessions/app.ts
+++ b/server/auth/sessions/app.ts
@@ -3,7 +3,14 @@ import {
    encodeHexLowerCase
 } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
-import { resourceSessions, Session, sessions, User, users } from "@server/db";
+import {
+    resourceSessions,
+    safeRead,
+    Session,
+    sessions,
+    User,
+    users
+} from "@server/db";
 import { db } from "@server/db";
 import { eq, inArray } from "drizzle-orm";
 import config from "@server/lib/config";
@@ -54,11 +61,15 @@ export async function validateSessionToken(
    const sessionId = encodeHexLowerCase(
        sha256(new TextEncoder().encode(token))
    );
-    const result = await db
-        .select({ user: users, session: sessions })
-        .from(sessions)
-        .innerJoin(users, eq(sessions.userId, users.userId))
-        .where(eq(sessions.sessionId, sessionId));
+
+    const result = await safeRead((db) =>
+        db
+            .select({ user: users, session: sessions })
+            .from(sessions)
+            .innerJoin(users, eq(sessions.userId, users.userId))
+            .where(eq(sessions.sessionId, sessionId))
+    );
+
    if (result.length < 1) {
        return { session: null, user: null };
    }
--- a/server/auth/sessions/resource.ts
+++ b/server/auth/sessions/resource.ts
@@ -1,7 +1,7 @@
 import { encodeHexLowerCase } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { resourceSessions, ResourceSession } from "@server/db";
-import { db } from "@server/db";
+import { db, safeRead } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import config from "@server/lib/config";

@@ -66,15 +66,17 @@ export async function validateResourceSessionToken(
    const sessionId = encodeHexLowerCase(
        sha256(new TextEncoder().encode(token))
    );
-    const result = await db
-        .select()
-        .from(resourceSessions)
-        .where(
-            and(
-                eq(resourceSessions.sessionId, sessionId),
-                eq(resourceSessions.resourceId, resourceId)
+    const result = await safeRead((db) =>
+        db
+            .select()
+            .from(resourceSessions)
+            .where(
+                and(
+                    eq(resourceSessions.sessionId, sessionId),
+                    eq(resourceSessions.resourceId, resourceId)
+                )
            )
-        );
+    );

    if (result.length < 1) {
        return { resourceSession: null };
--- a/server/db/pg/index.ts
+++ b/server/db/pg/index.ts
@@ -1,4 +1,5 @@
 export * from "./driver";
+export * from "./safeRead";
 export * from "./schema/schema";
 export * from "./schema/privateSchema";
 export * from "./migrate";
--- a/server/db/pg/safeRead.ts
+++ b/server/db/pg/safeRead.ts
@@ -0,0 +1,24 @@
+import { db, primaryDb } from "./driver";
+
+/**
+ * Runs a read query with replica fallback for Postgres.
+ * Executes the query against the replica first (when replicas exist).
+ * If the query throws or returns no data (null, undefined, or empty array),
+ * runs the same query against the primary.
+ */
+export async function safeRead<T>(
+    query: (d: typeof db | typeof primaryDb) => Promise<T>
+): Promise<T> {
+    try {
+        const result = await query(db);
+        if (result === undefined || result === null) {
+            return query(primaryDb);
+        }
+        if (Array.isArray(result) && result.length === 0) {
+            return query(primaryDb);
+        }
+        return result;
+    } catch {
+        return query(primaryDb);
+    }
+}
--- a/server/db/pg/schema/schema.ts
+++ b/server/db/pg/schema/schema.ts
@@ -233,10 +233,10 @@ export const siteResources = pgTable("siteResources", {
    tcpPortRangeString: varchar("tcpPortRangeString").notNull().default("*"),
    udpPortRangeString: varchar("udpPortRangeString").notNull().default("*"),
    disableIcmp: boolean("disableIcmp").notNull().default(false),
-    authDaemonPort: integer("authDaemonPort"),
-    authDaemonMode: varchar("authDaemonMode", { length: 32 }).$type<
-        "site" | "remote"
-    >()
+    authDaemonPort: integer("authDaemonPort").default(22123),
+    authDaemonMode: varchar("authDaemonMode", { length: 32 })
+        .$type<"site" | "remote">()
+        .default("site")
 });

 export const clientSiteResources = pgTable("clientSiteResources", {
@@ -379,7 +379,7 @@ export const roles = pgTable("roles", {
    requireDeviceApproval: boolean("requireDeviceApproval").default(false),
    sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("none"), // "none" | "full" | "commands"
    sshSudoCommands: text("sshSudoCommands").default("[]"),
-    sshCreateHomeDir: boolean("sshCreateHomeDir").default(false),
+    sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
    sshUnixGroups: text("sshUnixGroups").default("[]")
 });

@@ -1067,4 +1067,6 @@ export type SecurityKey = InferSelectModel<typeof securityKeys>;
 export type WebauthnChallenge = InferSelectModel<typeof webauthnChallenge>;
 export type DeviceWebAuthCode = InferSelectModel<typeof deviceWebAuthCodes>;
 export type RequestAuditLog = InferSelectModel<typeof requestAuditLog>;
-export type RoundTripMessageTracker = InferSelectModel<typeof roundTripMessageTracker>;
+export type RoundTripMessageTracker = InferSelectModel<
+    typeof roundTripMessageTracker
+>;
--- a/server/db/sqlite/index.ts
+++ b/server/db/sqlite/index.ts
@@ -1,4 +1,5 @@
 export * from "./driver";
+export * from "./safeRead";
 export * from "./schema/schema";
 export * from "./schema/privateSchema";
 export * from "./migrate";
--- a/server/db/sqlite/safeRead.ts
+++ b/server/db/sqlite/safeRead.ts
@@ -0,0 +1,11 @@
+import { db } from "./driver";
+
+/**
+ * Runs a read query. For SQLite there is no replica/primary distinction,
+ * so the query is executed once against the database.
+ */
+export async function safeRead<T>(
+    query: (d: typeof db) => Promise<T>
+): Promise<T> {
+    return query(db);
+}
--- a/server/db/sqlite/schema/schema.ts
+++ b/server/db/sqlite/schema/schema.ts
@@ -258,8 +258,10 @@ export const siteResources = sqliteTable("siteResources", {
    disableIcmp: integer("disableIcmp", { mode: "boolean" })
        .notNull()
        .default(false),
-    authDaemonPort: integer("authDaemonPort"),
-    authDaemonMode: text("authDaemonMode").$type<"site" | "remote">()
+    authDaemonPort: integer("authDaemonPort").default(22123),
+    authDaemonMode: text("authDaemonMode")
+        .$type<"site" | "remote">()
+        .default("site")
 });

 export const clientSiteResources = sqliteTable("clientSiteResources", {
--- a/server/lib/billing/usageService.ts
+++ b/server/lib/billing/usageService.ts
@@ -46,8 +46,6 @@ export class UsageService {
            return null;
        }

-        let orgIdToUse = await this.getBillingOrg(orgId, transaction);
-
        // Truncate value to 11 decimal places
        value = this.truncateValue(value);

@@ -59,6 +57,7 @@ export class UsageService {
            try {
                let usage;
                if (transaction) {
+                    const orgIdToUse = await this.getBillingOrg(orgId, transaction);
                    usage = await this.internalAddUsage(
                        orgIdToUse,
                        featureId,
@@ -67,6 +66,7 @@ export class UsageService {
                    );
                } else {
                    await db.transaction(async (trx) => {
+                        const orgIdToUse = await this.getBillingOrg(orgId, trx);
                        usage = await this.internalAddUsage(
                            orgIdToUse,
                            featureId,
@@ -92,7 +92,7 @@ export class UsageService {
                    const delay = baseDelay + jitter;

                    logger.warn(
-                        `Deadlock detected for ${orgIdToUse}/${featureId}, retrying attempt ${attempt}/${maxRetries} after ${delay.toFixed(0)}ms`
+                        `Deadlock detected for ${orgId}/${featureId}, retrying attempt ${attempt}/${maxRetries} after ${delay.toFixed(0)}ms`
                    );

                    await new Promise((resolve) => setTimeout(resolve, delay));
@@ -100,7 +100,7 @@ export class UsageService {
                }

                logger.error(
-                    `Failed to add usage for ${orgIdToUse}/${featureId} after ${attempt} attempts:`,
+                    `Failed to add usage for ${orgId}/${featureId} after ${attempt} attempts:`,
                    error
                );
                break;
@@ -169,7 +169,7 @@ export class UsageService {
            return;
        }

-        let orgIdToUse = await this.getBillingOrg(orgId);
+        const orgIdToUse = await this.getBillingOrg(orgId);

        try {
            // Truncate value to 11 decimal places if provided
@@ -227,7 +227,7 @@ export class UsageService {
        orgId: string,
        featureId: FeatureId
    ): Promise<string | null> {
-        let orgIdToUse = await this.getBillingOrg(orgId);
+        const orgIdToUse = await this.getBillingOrg(orgId);

        const cacheKey = `customer_${orgIdToUse}_${featureId}`;
        const cached = cache.get<string>(cacheKey);
@@ -274,7 +274,7 @@ export class UsageService {
            return null;
        }

-        let orgIdToUse = await this.getBillingOrg(orgId, trx);
+        const orgIdToUse = await this.getBillingOrg(orgId, trx);

        const usageId = `${orgIdToUse}-${featureId}`;

@@ -382,7 +382,7 @@ export class UsageService {
            return false;
        }

-        let orgIdToUse = await this.getBillingOrg(orgId, trx);
+        const orgIdToUse = await this.getBillingOrg(orgId, trx);

        // This method should check the current usage against the limits set for the organization
        // and kick out all of the sites on the org
--- a/server/lib/blueprints/clientResources.ts
+++ b/server/lib/blueprints/clientResources.ts
@@ -11,7 +11,7 @@ import {
    userSiteResources
 } from "@server/db";
 import { sites } from "@server/db";
-import { eq, and, ne, inArray } from "drizzle-orm";
+import { eq, and, ne, inArray, or } from "drizzle-orm";
 import { Config } from "./types";
 import logger from "@server/logger";
 import { getNextAvailableAliasAddress } from "../ip";
@@ -142,7 +142,10 @@ export async function updateClientResources(
                    .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
                    .where(
                        and(
-                            inArray(users.username, resourceData.users),
+                            or(
+                                inArray(users.username, resourceData.users),
+                                inArray(users.email, resourceData.users)
+                            ),
                            eq(userOrgs.orgId, orgId)
                        )
                    );
@@ -276,7 +279,10 @@ export async function updateClientResources(
                    .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
                    .where(
                        and(
-                            inArray(users.username, resourceData.users),
+                            or(
+                                inArray(users.username, resourceData.users),
+                                inArray(users.email, resourceData.users)
+                            ),
                            eq(userOrgs.orgId, orgId)
                        )
                    );
--- a/server/lib/blueprints/proxyResources.ts
+++ b/server/lib/blueprints/proxyResources.ts
@@ -212,7 +212,10 @@ export async function updateProxyResources(
            } else {
                // Update existing resource

-                const isLicensed = await isLicensedOrSubscribed(orgId, tierMatrix.maintencePage);
+                const isLicensed = await isLicensedOrSubscribed(
+                    orgId,
+                    tierMatrix.maintencePage
+                );
                if (!isLicensed) {
                    resourceData.maintenance = undefined;
                }
@@ -590,7 +593,10 @@ export async function updateProxyResources(
                        existingRule.action !== getRuleAction(rule.action) ||
                        existingRule.match !== rule.match.toUpperCase() ||
                        existingRule.value !==
-                        getRuleValue(rule.match.toUpperCase(), rule.value) ||
+                            getRuleValue(
+                                rule.match.toUpperCase(),
+                                rule.value
+                            ) ||
                        existingRule.priority !== intendedPriority
                    ) {
                        validateRule(rule);
@@ -648,7 +654,10 @@ export async function updateProxyResources(
                );
            }

-            const isLicensed = await isLicensedOrSubscribed(orgId, tierMatrix.maintencePage);
+            const isLicensed = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.maintencePage
+            );
            if (!isLicensed) {
                resourceData.maintenance = undefined;
            }
@@ -935,7 +944,12 @@ async function syncUserResources(
            .select()
            .from(users)
            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
-            .where(and(eq(users.username, username), eq(userOrgs.orgId, orgId)))
+            .where(
+                and(
+                    or(eq(users.username, username), eq(users.email, username)),
+                    eq(userOrgs.orgId, orgId)
+                )
+            )
            .limit(1);

        if (!user) {
--- a/server/lib/blueprints/types.ts
+++ b/server/lib/blueprints/types.ts
@@ -69,7 +69,7 @@ export const AuthSchema = z.object({
        .refine((roles) => !roles.includes("Admin"), {
            error: "Admin role cannot be included in sso-roles"
        }),
-    "sso-users": z.array(z.email()).optional().default([]),
+    "sso-users": z.array(z.string()).optional().default([]),
    "whitelist-users": z.array(z.email()).optional().default([]),
    "auto-login-idp": z.int().positive().optional()
 });
@@ -335,7 +335,7 @@ export const ClientResourceSchema = z
            .refine((roles) => !roles.includes("Admin"), {
                error: "Admin role cannot be included in roles"
            }),
-        users: z.array(z.email()).optional().default([]),
+        users: z.array(z.string()).optional().default([]),
        machines: z.array(z.string()).optional().default([])
    })
    .refine(
--- a/server/private/lib/billing/getOrgTierData.ts
+++ b/server/private/lib/billing/getOrgTierData.ts
@@ -78,7 +78,8 @@ export async function getOrgTierData(
            if (
                subscription.type === "tier1" ||
                subscription.type === "tier2" ||
-                subscription.type === "tier3"
+                subscription.type === "tier3" ||
+                subscription.type === "enterprise"
            ) {
                tier = subscription.type;
                active = true;
--- a/server/private/lib/lock.ts
+++ b/server/private/lib/lock.ts
@@ -14,6 +14,9 @@
 import { config } from "@server/lib/config";
 import logger from "@server/logger";
 import { redis } from "#private/lib/redis";
+import { v4 as uuidv4 } from "uuid";
+
+const instanceId = uuidv4();

 export class LockManager {
    /**
@@ -33,7 +36,7 @@ export class LockManager {
        }

        const lockValue = `${
-            config.getRawConfig().gerbil.exit_node_name
+            instanceId
        }:${Date.now()}`;
        const redisKey = `lock:${lockKey}`;

@@ -52,7 +55,7 @@ export class LockManager {
                if (result === "OK") {
                    logger.debug(
                        `Lock acquired: ${lockKey} by ${
-                            config.getRawConfig().gerbil.exit_node_name
+                            instanceId
                        }`
                    );
                    return true;
@@ -63,14 +66,14 @@ export class LockManager {
                if (
                    existingValue &&
                    existingValue.startsWith(
-                        `${config.getRawConfig().gerbil.exit_node_name}:`
+                        `${instanceId}:`
                    )
                ) {
                    // Extend the lock TTL since it's the same worker
                    await redis.pexpire(redisKey, ttlMs);
                    logger.debug(
                        `Lock extended: ${lockKey} by ${
-                            config.getRawConfig().gerbil.exit_node_name
+                            instanceId
                        }`
                    );
                    return true;
@@ -116,7 +119,7 @@ export class LockManager {
      local key = KEYS[1]
      local worker_prefix = ARGV[1]
      local current_value = redis.call('GET', key)
-      
+
      if current_value and string.find(current_value, worker_prefix, 1, true) == 1 then
        return redis.call('DEL', key)
      else
@@ -129,19 +132,19 @@ export class LockManager {
                luaScript,
                1,
                redisKey,
-                `${config.getRawConfig().gerbil.exit_node_name}:`
+                `${instanceId}:`
            )) as number;

            if (result === 1) {
                logger.debug(
                    `Lock released: ${lockKey} by ${
-                        config.getRawConfig().gerbil.exit_node_name
+                        instanceId
                    }`
                );
            } else {
                logger.warn(
                    `Lock not released - not owned by worker: ${lockKey} by ${
-                        config.getRawConfig().gerbil.exit_node_name
+                        instanceId
                    }`
                );
            }
@@ -198,7 +201,7 @@ export class LockManager {
            const ownedByMe =
                exists &&
                value!.startsWith(
-                    `${config.getRawConfig().gerbil.exit_node_name}:`
+                    `${instanceId}:`
                );
            const owner = exists ? value!.split(":")[0] : undefined;

@@ -233,7 +236,7 @@ export class LockManager {
      local worker_prefix = ARGV[1]
      local ttl = tonumber(ARGV[2])
      local current_value = redis.call('GET', key)
-      
+
      if current_value and string.find(current_value, worker_prefix, 1, true) == 1 then
        return redis.call('PEXPIRE', key, ttl)
      else
@@ -246,14 +249,14 @@ export class LockManager {
                luaScript,
                1,
                redisKey,
-                `${config.getRawConfig().gerbil.exit_node_name}:`,
+                `${instanceId}:`,
                ttlMs.toString()
            )) as number;

            if (result === 1) {
                logger.debug(
                    `Lock extended: ${lockKey} by ${
-                        config.getRawConfig().gerbil.exit_node_name
+                        instanceId
                    } for ${ttlMs}ms`
                );
                return true;
@@ -356,7 +359,7 @@ export class LockManager {
                    (value) =>
                        value &&
                        value.startsWith(
-                            `${config.getRawConfig().gerbil.exit_node_name}:`
+                            `${instanceId}:`
                        )
                ).length;
            }
--- a/server/private/lib/readConfigFile.ts
+++ b/server/private/lib/readConfigFile.ts
@@ -72,15 +72,15 @@ export const privateConfigSchema = z.object({
                        db: z.int().nonnegative().optional().default(0)
                    })
                )
+                .optional(),
+            tls: z
+                .object({
+                    rejectUnauthorized: z
+                        .boolean()
+                        .optional()
+                        .default(true)
+                })
                .optional()
-            // tls: z
-            //     .object({
-            //         reject_unauthorized: z
-            //             .boolean()
-            //             .optional()
-            //             .default(true)
-            //     })
-            //     .optional()
        })
        .optional(),
    gerbil: z
--- a/server/private/lib/redis.ts
+++ b/server/private/lib/redis.ts
@@ -108,11 +108,15 @@ class RedisManager {
            port: redisConfig.port!,
            password: redisConfig.password,
            db: redisConfig.db
-            // tls: {
-            //     rejectUnauthorized:
-            //         redisConfig.tls?.reject_unauthorized || false
-            // }
        };
+        
+        // Enable TLS if configured (required for AWS ElastiCache in-transit encryption)
+        if (redisConfig.tls) {
+            opts.tls = {
+                rejectUnauthorized: redisConfig.tls.rejectUnauthorized ?? true
+            };
+        }
+        
        return opts;
    }

@@ -130,11 +134,15 @@ class RedisManager {
            port: replica.port!,
            password: replica.password,
            db: replica.db || redisConfig.db
-            // tls: {
-            //     rejectUnauthorized:
-            //         replica.tls?.reject_unauthorized || false
-            // }
        };
+        
+        // Enable TLS if configured (required for AWS ElastiCache in-transit encryption)
+        if (redisConfig.tls) {
+            opts.tls = {
+                rejectUnauthorized: redisConfig.tls.rejectUnauthorized ?? true
+            };
+        }
+        
        return opts;
    }

--- a/server/routers/gerbil/receiveBandwidth.ts
+++ b/server/routers/gerbil/receiveBandwidth.ts
@@ -197,7 +197,6 @@ export async function updateSiteBandwidth(
                        usageService
                            .checkLimitSet(
                                orgId,
-
                                FeatureId.EGRESS_DATA_MB,
                                bandwidthUsage
                            )
--- a/server/setup/copyInConfig.ts
+++ b/server/setup/copyInConfig.ts
@@ -2,9 +2,13 @@ import { db, dnsRecords } from "@server/db";
 import { domains, exitNodes, orgDomains, orgs, resources } from "@server/db";
 import config from "@server/lib/config";
 import { eq, ne } from "drizzle-orm";
-import logger from "@server/logger";
+import { build } from "@server/build";

 export async function copyInConfig() {
+    if (build == "saas") {
+        return;
+    }
+
    const endpoint = config.getRawConfig().gerbil.base_endpoint;
    const listenPort = config.getRawConfig().gerbil.start_port;

--- a/server/setup/migrationsPg.ts
+++ b/server/setup/migrationsPg.ts
@@ -19,6 +19,7 @@ import m11 from "./scriptsPg/1.14.0";
 import m12 from "./scriptsPg/1.15.0";
 import m13 from "./scriptsPg/1.15.3";
 import m14 from "./scriptsPg/1.15.4";
+import { build } from "@server/build";

 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -53,6 +54,10 @@ async function run() {
 }

 export async function runMigrations() {
+    if (build == "saas") {
+        console.log("Running in SaaS mode, skipping migrations...");
+        return;
+    }
    if (process.env.DISABLE_MIGRATIONS) {
        console.log("Migrations are disabled. Skipping...");
        return;
--- a/server/setup/migrationsSqlite.ts
+++ b/server/setup/migrationsSqlite.ts
@@ -37,6 +37,7 @@ import m32 from "./scriptsSqlite/1.14.0";
 import m33 from "./scriptsSqlite/1.15.0";
 import m34 from "./scriptsSqlite/1.15.3";
 import m35 from "./scriptsSqlite/1.15.4";
+import { build } from "@server/build";

 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -105,6 +106,10 @@ function backupDb() {
 }

 export async function runMigrations() {
+    if (build == "saas") {
+        console.log("Running in SaaS mode, skipping migrations...");
+        return;
+    }
    if (process.env.DISABLE_MIGRATIONS) {
        console.log("Migrations are disabled. Skipping...");
        return;
--- a/server/setup/scriptsSqlite/1.16.0.ts
+++ b/server/setup/scriptsSqlite/1.16.0.ts
@@ -14,7 +14,7 @@ export default async function migration() {
    // all roles set hoemdir to true

    // generate ca certs for all orgs?
-    // set authDaemonMode to "site" for all orgs
+    // set authDaemonMode to "site" for all site-resources

    try {
        db.transaction(() => {})();
--- a/src/app/[orgId]/settings/(private)/billing/page.tsx
+++ b/src/app/[orgId]/settings/(private)/billing/page.tsx
@@ -445,6 +445,54 @@ export default function BillingPage() {

    const currentPlanId = getCurrentPlanId();

+    // Check if subscription is in a problematic state that requires attention
+    const hasProblematicSubscription = (): boolean => {
+        if (!tierSubscription?.subscription) return false;
+        const status = tierSubscription.subscription.status;
+        return (
+            status === "past_due" ||
+            status === "unpaid" ||
+            status === "incomplete" ||
+            status === "incomplete_expired"
+        );
+    };
+
+    const isProblematicState = hasProblematicSubscription();
+
+    // Get user-friendly subscription status message
+    const getSubscriptionStatusMessage = (): { title: string; description: string } | null => {
+        if (!tierSubscription?.subscription || !isProblematicState) return null;
+        
+        const status = tierSubscription.subscription.status;
+        
+        switch (status) {
+            case "past_due":
+                return {
+                    title: t("billingPastDueTitle") || "Payment Past Due",
+                    description: t("billingPastDueDescription") || "Your payment is past due. Please update your payment method to continue using your current plan features. If not resolved, your subscription will be canceled and you'll be reverted to the free tier."
+                };
+            case "unpaid":
+                return {
+                    title: t("billingUnpaidTitle") || "Subscription Unpaid",
+                    description: t("billingUnpaidDescription") || "Your subscription is unpaid and you have been reverted to the free tier. Please update your payment method to restore your subscription."
+                };
+            case "incomplete":
+                return {
+                    title: t("billingIncompleteTitle") || "Payment Incomplete",
+                    description: t("billingIncompleteDescription") || "Your payment is incomplete. Please complete the payment process to activate your subscription."
+                };
+            case "incomplete_expired":
+                return {
+                    title: t("billingIncompleteExpiredTitle") || "Payment Expired",
+                    description: t("billingIncompleteExpiredDescription") || "Your payment was never completed and has expired. You have been reverted to the free tier. Please subscribe again to restore access to paid features."
+                };
+            default:
+                return null;
+        }
+    };
+
+    const statusMessage = getSubscriptionStatusMessage();
+
    // Get button label and action for each plan
    const getPlanAction = (plan: PlanOption) => {
        if (plan.id === "enterprise") {
@@ -458,7 +506,7 @@ export default function BillingPage() {

        if (plan.id === currentPlanId) {
            // If it's the basic plan (basic with no subscription), show as current but disabled
-            if (plan.id === "basic" && !hasSubscription) {
+            if (plan.id === "basic" && !hasSubscription && !isProblematicState) {
                return {
                    label: "Current Plan",
                    action: () => {},
@@ -466,8 +514,17 @@ export default function BillingPage() {
                    disabled: true
                };
            }
+            // If on free tier but has a problematic subscription, allow them to manage it
+            if (plan.id === "basic" && isProblematicState) {
+                return {
+                    label: "Manage Subscription",
+                    action: handleModifySubscription,
+                    variant: "default" as const,
+                    disabled: false
+                };
+            }
            return {
-                label: "Modify Current Plan",
+                label: "Manage Current Plan",
                action: handleModifySubscription,
                variant: "default" as const,
                disabled: false
@@ -503,7 +560,7 @@ export default function BillingPage() {
                    }
                },
                variant: "outline" as const,
-                disabled: false
+                disabled: isProblematicState
            };
        }

@@ -522,7 +579,7 @@ export default function BillingPage() {
                }
            },
            variant: "outline" as const,
-            disabled: false
+            disabled: isProblematicState
        };
    };

@@ -648,6 +705,26 @@ export default function BillingPage() {

    return (
        <SettingsContainer>
+            {/* Subscription Status Alert */}
+            {isProblematicState && statusMessage && (
+                <Alert variant="destructive" className="mb-6">
+                    <AlertTriangle className="h-4 w-4" />
+                    <AlertTitle>
+                        {statusMessage.title}
+                    </AlertTitle>
+                    <AlertDescription>
+                        {statusMessage.description}
+                        {" "}
+                        <button
+                            onClick={handleModifySubscription}
+                            className="underline font-semibold hover:no-underline"
+                        >
+                            {t("billingManageSubscription") || "Manage your subscription"}
+                        </button>
+                    </AlertDescription>
+                </Alert>
+            )}
+
            {/* Your Plan Section */}
            <SettingsSection>
                <SettingsSectionHeader>
@@ -692,22 +769,50 @@ export default function BillingPage() {
                                        </div>
                                    </div>
                                    <div className="mt-4">
-                                        <Button
-                                            variant={
-                                                isCurrentPlan
-                                                    ? "default"
-                                                    : "outline"
-                                            }
-                                            size="sm"
-                                            className="w-full"
-                                            onClick={planAction.action}
-                                            disabled={
-                                                isLoading || planAction.disabled
-                                            }
-                                            loading={isLoading && isCurrentPlan}
-                                        >
-                                            {planAction.label}
-                                        </Button>
+                                        {isProblematicState && planAction.disabled && !isCurrentPlan && plan.id !== "enterprise" ? (
+                                            <Tooltip>
+                                                <TooltipTrigger asChild>
+                                                    <div>
+                                                        <Button
+                                                            variant={
+                                                                isCurrentPlan
+                                                                    ? "default"
+                                                                    : "outline"
+                                                            }
+                                                            size="sm"
+                                                            className="w-full"
+                                                            onClick={planAction.action}
+                                                            disabled={
+                                                                isLoading || planAction.disabled
+                                                            }
+                                                            loading={isLoading && isCurrentPlan}
+                                                        >
+                                                            {planAction.label}
+                                                        </Button>
+                                                    </div>
+                                                </TooltipTrigger>
+                                                <TooltipContent>
+                                                    <p>{t("billingResolvePaymentIssue") || "Please resolve your payment issue before upgrading or downgrading"}</p>
+                                                </TooltipContent>
+                                            </Tooltip>
+                                        ) : (
+                                            <Button
+                                                variant={
+                                                    isCurrentPlan
+                                                        ? "default"
+                                                        : "outline"
+                                                }
+                                                size="sm"
+                                                className="w-full"
+                                                onClick={planAction.action}
+                                                disabled={
+                                                    isLoading || planAction.disabled
+                                                }
+                                                loading={isLoading && isCurrentPlan}
+                                            >
+                                                {planAction.label}
+                                            </Button>
+                                        )}
                                    </div>
                                </div>
                            );
--- a/src/app/layout.tsx
+++ b/src/app/layout.tsx
@@ -1,6 +1,5 @@
 import type { Metadata } from "next";
 import "./globals.css";
-import { Geist, Inter, Manrope, Open_Sans } from "next/font/google";
 import { ThemeProvider } from "@app/providers/ThemeProvider";
 import EnvProvider from "@app/providers/EnvProvider";
 import { pullEnv } from "@app/lib/pullEnv";
@@ -24,6 +23,7 @@ import { TanstackQueryProvider } from "@app/components/TanstackQueryProvider";
 import { TailwindIndicator } from "@app/components/TailwindIndicator";
 import { ViewportHeightFix } from "@app/components/ViewportHeightFix";
 import StoreInternalRedirect from "@app/components/StoreInternalRedirect";
+import { Inter } from "next/font/google";

 export const metadata: Metadata = {
    title: `Dashboard - ${process.env.BRANDING_APP_NAME || "Pangolin"}`,
@@ -32,10 +32,12 @@ export const metadata: Metadata = {

 export const dynamic = "force-dynamic";

-const font = Inter({
+const inter = Inter({
    subsets: ["latin"]
 });

+const fontClassName = inter.className;
+
 export default async function RootLayout({
    children
 }: Readonly<{
@@ -79,16 +81,16 @@ export default async function RootLayout({

    return (
        <html suppressHydrationWarning lang={locale}>
-            <body className={`${font.className} h-screen-safe overflow-hidden`}>
+            <body className={`${fontClassName} h-screen-safe overflow-hidden`}>
                <StoreInternalRedirect />
                <TopLoader />
-                {build === "saas" && (
+                {/* build === "saas" && (
                    <Script
                        src="https://rybbit.fossorial.io/api/script.js"
                        data-site-id="fe1ff2a33287"
                        strategy="afterInteractive"
                    />
-                )}
+                )*/}
                <ViewportHeightFix />
                <NextIntlClientProvider>
                    <ThemeProvider
--- a/src/components/ClientInfoCard.tsx
+++ b/src/components/ClientInfoCard.tsx
@@ -26,7 +26,7 @@ export default function SiteInfoCard({}: ClientInfoCardProps) {
    return (
        <Alert>
            <AlertDescription>
-                <InfoSections cols={4}>
+                <InfoSections cols={3}>
                    <InfoSection>
                        <InfoSectionTitle>{t("name")}</InfoSectionTitle>
                        <InfoSectionContent>{client.name}</InfoSectionContent>
@@ -55,12 +55,6 @@ export default function SiteInfoCard({}: ClientInfoCardProps) {
                            )}
                        </InfoSectionContent>
                    </InfoSection>
-                    <InfoSection>
-                        <InfoSectionTitle>{t("address")}</InfoSectionTitle>
-                        <InfoSectionContent>
-                            {client.subnet.split("/")[0]}
-                        </InfoSectionContent>
-                    </InfoSection>
                </InfoSections>
            </AlertDescription>
        </Alert>
--- a/src/components/SiteInfoCard.tsx
+++ b/src/components/SiteInfoCard.tsx
@@ -33,7 +33,7 @@ export default function SiteInfoCard({}: SiteInfoCardProps) {
    return (
        <Alert>
            <AlertDescription>
-                <InfoSections cols={4}>
+                <InfoSections cols={3}>
                    <InfoSection>
                        <InfoSectionTitle>{t("identifier")}</InfoSectionTitle>
                        <InfoSectionContent>{site.niceId}</InfoSectionContent>
@@ -68,15 +68,6 @@ export default function SiteInfoCard({}: SiteInfoCardProps) {
                            {getConnectionTypeString(site.type)}
                        </InfoSectionContent>
                    </InfoSection>
-
-                    {site.type == "newt" && (
-                        <InfoSection>
-                            <InfoSectionTitle>Address</InfoSectionTitle>
-                            <InfoSectionContent>
-                                {site.address?.split("/")[0]}
-                            </InfoSectionContent>
-                        </InfoSection>
-                    )}
                </InfoSections>
            </AlertDescription>
        </Alert>
--- a/src/lib/api/isOrgSubscribed.ts
+++ b/src/lib/api/isOrgSubscribed.ts
@@ -20,7 +20,7 @@ export const isOrgSubscribed = cache(async (orgId: string) => {
        try {
            const subRes = await getCachedSubscription(orgId);
            subscribed =
-                (subRes.data.data.tier == "tier1" || subRes.data.data.tier == "tier2" || subRes.data.data.tier == "tier3") &&
+                (subRes.data.data.tier == "tier1" || subRes.data.data.tier == "tier2" || subRes.data.data.tier == "tier3" || subRes.data.data.tier == "enterprise") &&
                subRes.data.data.active;
        } catch {}
    }
--- a/src/providers/SubscriptionStatusProvider.tsx
+++ b/src/providers/SubscriptionStatusProvider.tsx
@@ -42,7 +42,8 @@ export function SubscriptionStatusProvider({
                if (
                    subscription.type == "tier1" ||
                    subscription.type == "tier2" ||
-                    subscription.type == "tier3"
+                    subscription.type == "tier3" ||
+                    subscription.type == "enterprise"
                ) {
                    return {
                        tier: subscription.type,
@@ -61,7 +62,7 @@ export function SubscriptionStatusProvider({
    const isSubscribed = () => {
        const { tier, active } = getTier();
        return (
-            (tier == "tier1" || tier == "tier2" || tier == "tier3") &&
+            (tier == "tier1" || tier == "tier2" || tier == "tier3" || tier == "enterprise") &&
            active
        );
    };
Author	SHA1	Message	Date
dependabot[bot]	31a36246d4	Bump the prod-minor-updates group across 1 directory with 4 updates Bumps the prod-minor-updates group with 4 updates in the / directory: [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3), [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react), [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) and [tailwind-merge](https://github.com/dcastil/tailwind-merge). Updates `@aws-sdk/client-s3` from 3.989.0 to 3.996.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.996.0/clients/client-s3) Updates `lucide-react` from 0.563.0 to 0.575.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/0.575.0/packages/lucide-react) Updates `posthog-node` from 5.24.15 to 5.25.0 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.25.0/packages/node) Updates `tailwind-merge` from 3.4.0 to 3.5.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](https://github.com/dcastil/tailwind-merge/compare/v3.4.0...v3.5.0) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.996.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: lucide-react dependency-version: 0.575.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: posthog-node dependency-version: 5.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates - dependency-name: tailwind-merge dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: prod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com>	2026-02-24 01:37:56 +00:00
Owen	a502780c9b	Fix sso username issue	2026-02-22 22:05:02 -08:00
Owen Schwartz	418e099804	Merge pull request #2521 from fosrl/dev 1.15.4-s.6	2026-02-22 21:13:51 -08:00
Owen Schwartz	06258aa386	Merge pull request #2513 from fosrl/crowdin_dev New Crowdin updates	2026-02-22 21:13:17 -08:00
Owen Schwartz	d7608b1cc8	New translations en-us.json (Norwegian Bokmal)	2026-02-22 21:11:37 -08:00
Owen Schwartz	cb86ad4104	New translations en-us.json (Chinese Simplified)	2026-02-22 21:11:35 -08:00
Owen Schwartz	8cd51df1e1	New translations en-us.json (Turkish)	2026-02-22 21:11:34 -08:00
Owen Schwartz	8ef7220766	New translations en-us.json (Russian)	2026-02-22 21:11:33 -08:00
Owen Schwartz	b5333a3686	New translations en-us.json (Portuguese)	2026-02-22 21:11:31 -08:00
Owen Schwartz	e6e92dbc0f	New translations en-us.json (Polish)	2026-02-22 21:11:30 -08:00
Owen Schwartz	01fdd41a10	New translations en-us.json (Dutch)	2026-02-22 21:11:28 -08:00
Owen Schwartz	6af06a38ae	New translations en-us.json (Korean)	2026-02-22 21:11:27 -08:00
Owen Schwartz	5d9c66d22d	New translations en-us.json (Italian)	2026-02-22 21:11:26 -08:00
Owen Schwartz	81f5a4b127	New translations en-us.json (German)	2026-02-22 21:11:24 -08:00
Owen Schwartz	da3e68a20b	New translations en-us.json (Czech)	2026-02-22 21:11:23 -08:00
Owen Schwartz	8712c1719e	New translations en-us.json (Bulgarian)	2026-02-22 21:11:22 -08:00
Owen Schwartz	593c5db0e8	New translations en-us.json (Spanish)	2026-02-22 21:11:20 -08:00
Owen Schwartz	b28391feae	New translations en-us.json (French)	2026-02-22 21:11:19 -08:00
Owen	5f8df6d4cd	Merge branch 'main' into dev	2026-02-22 21:02:58 -08:00
Owen	c36efe7f14	Add translations	2026-02-22 21:02:21 -08:00
Owen	cf97b6df9c	Handle billing bad subs, remove exit node name from lock, prevent some stuff on saas	2026-02-22 20:45:53 -08:00
Owen	6d9b129ac9	Merge branch 'main' into k8s	2026-02-22 17:28:09 -08:00
miloschwartz	e17ec798d4	remove local fonts	2026-02-22 11:18:57 -08:00
miloschwartz	58ac499f30	add safeRead	2026-02-21 16:38:51 -08:00
miloschwartz	f07f0092ad	testing with local font	2026-02-21 14:34:38 -08:00
Owen Schwartz	7c04526088	New translations en-us.json (Czech)	2026-02-21 05:24:27 -08:00
Owen Schwartz	2d7ab68576	New translations en-us.json (Czech)	2026-02-21 04:14:18 -08:00
miloschwartz	218a4893b6	hide address on sites and clients	2026-02-20 22:47:56 -08:00
miloschwartz	266bf261aa	update note in migration	2026-02-20 22:45:37 -08:00
Owen Schwartz	63694032e8	Merge pull request #2511 from fosrl/dev 1.15.4-s.4	2026-02-20 20:45:23 -08:00
Owen Schwartz	b77aaedb58	Merge pull request #2510 from fosrl/crowdin_dev New Crowdin updates	2026-02-20 20:44:45 -08:00
Owen Schwartz	a316d0301f	New translations en-us.json (Norwegian Bokmal)	2026-02-20 20:43:45 -08:00
Owen Schwartz	dcd499720e	New translations en-us.json (Chinese Simplified)	2026-02-20 20:43:44 -08:00
Owen Schwartz	e18fe21eca	New translations en-us.json (Turkish)	2026-02-20 20:43:43 -08:00
Owen Schwartz	2970b51fb8	New translations en-us.json (Russian)	2026-02-20 20:43:42 -08:00
Owen Schwartz	b9236ff52e	New translations en-us.json (Portuguese)	2026-02-20 20:43:41 -08:00
Owen Schwartz	38eb0ec7ed	New translations en-us.json (Polish)	2026-02-20 20:43:39 -08:00
Owen Schwartz	ecba4a0b80	New translations en-us.json (Dutch)	2026-02-20 20:43:38 -08:00
Owen Schwartz	e6da18c952	New translations en-us.json (Korean)	2026-02-20 20:43:37 -08:00
Owen Schwartz	12941ac5ae	New translations en-us.json (Italian)	2026-02-20 20:43:36 -08:00
Owen Schwartz	11085bda63	New translations en-us.json (German)	2026-02-20 20:43:35 -08:00
Owen Schwartz	c03211cc53	New translations en-us.json (Czech)	2026-02-20 20:43:33 -08:00
Owen Schwartz	2867459600	New translations en-us.json (Bulgarian)	2026-02-20 20:43:32 -08:00
Owen Schwartz	32b24db9bf	New translations en-us.json (Spanish)	2026-02-20 20:43:31 -08:00
Owen Schwartz	660bf9ff87	New translations en-us.json (French)	2026-02-20 20:43:30 -08:00
miloschwartz	78c4ddebba	set defaults	2026-02-20 20:35:57 -08:00
Owen	b786497299	Working on k8s	2026-02-19 17:55:49 -08:00
miloschwartz	eedf57af89	disable rybbit in saas	2026-02-19 17:54:40 -08:00
Owen	756f3f32ca	Merge branch 'dev'	2026-02-17 21:57:49 -08:00
Owen	5987f6b2cd	Allow enterprise	2026-02-17 21:55:57 -08:00
Owen	09a9457021	Fix transaction issue	2026-02-17 21:27:23 -08:00
Owen Schwartz	ca4643ec36	Merge pull request #2494 from fosrl/dev 1.15.4-s.3	2026-02-17 21:07:04 -08:00