feat(frontend): align console IA with integrations sidebar
Add 对接与扩展 (IPSec, Feishu/OIDC, Plugins, Nodes), move identity out of settings onto /identity, make sessions/logs tab-deep-linkable, and rename ops audit / dial-in / admin labels to match the locked nav.
This commit is contained in:
Codex committed
1 parent
7f80f0f7ce
commit
f01d3dc5ea
12 files changed
+584
-262
No files matched your search
+219
-56
@@ -229,27 +229,34 @@
|
||||
"title": "Feishu / OIDC browser authentication",
|
||||
"externalService": "Requires openvpn-auth-oauth2",
|
||||
"componentReady": "Authentication component installed v{version}",
|
||||
"authEntryPending": "HTTPS is ready at {domain}; sync the authentication route in Settings → Feishu Identity after starting the tunnel.",
|
||||
"authEntryPending": "HTTPS is ready at {domain}; sync the authentication route on the Feishu / OIDC Identity page after starting the tunnel.",
|
||||
"app": "Create app",
|
||||
"appShort": "Feishu developer console",
|
||||
"identity": "Enter identity settings",
|
||||
"identityShort": "OIDC and credentials",
|
||||
"builtinIdentityShort": "Enter Feishu credentials in Settings",
|
||||
"builtinIdentityShort": "Enter Feishu credentials on the Feishu / OIDC Identity page",
|
||||
"callback": "Set public callback",
|
||||
"callbackShort": "HTTPS reverse proxy",
|
||||
"test": "Test client",
|
||||
"testShort": "Browser sign-in",
|
||||
"appTip": "Ask a Feishu administrator to create and publish an app with the appropriate sign-in capability.",
|
||||
"builtinAppTip": "Manage Feishu App ID and App Secret in Settings → Feishu Identity, not in each tunnel.",
|
||||
"builtinAppTip": "Manage Feishu App ID and App Secret on the Feishu / OIDC Identity page, not in each tunnel.",
|
||||
"openConsole": "Open Feishu app console",
|
||||
"appInstruction1": "Create an enterprise app, obtain its credentials, and enable the web sign-in capability.",
|
||||
"appInstruction2": "Register a redirect URL under the app's security/redirect settings. If using a broker, use the broker's upstream callback here.",
|
||||
"builtinAppInstruction2": "Register the Feishu app callback shown below in the app's redirect settings, not the VPN client callback.",
|
||||
"appInstruction3": "Publish the app and restrict its available users to people allowed to access this VPN.",
|
||||
"scopeTip": "Restrict who can use the Feishu app. LDAP dial-in users are not automatically linked to Feishu identities.",
|
||||
"providerTip": "Use the built-in Feishu issuer configured in Settings, or provide an external issuer with OIDC discovery and ID tokens. A Feishu app URL alone is not an issuer.",
|
||||
"source": "Identity source", "builtinSource": "Built-in Feishu", "externalSource": "External OIDC", "configureBuiltIn": "The built-in Feishu issuer is not enabled. Save app credentials and enable it in Settings first.", "manageFeishu": "Open Settings → Feishu Identity", "builtinSummary": "The Feishu App ID, App Secret, and tenant are managed in Settings; this tunnel references the issuer and its own public authentication entry.",
|
||||
"useBuiltIn": "Use built-in Feishu issuer", "builtInSecret": "The server supplies the VPN Client Secret. Do not enter the Feishu App Secret here.", "builtInGatewayPending": "The public Nginx route for the built-in issuer is pending; sync it in Settings before testing.",
|
||||
"providerTip": "Use the built-in Feishu issuer configured on the Feishu / OIDC Identity page, or provide an external issuer with OIDC discovery and ID tokens. A Feishu app URL alone is not an issuer.",
|
||||
"source": "Identity source",
|
||||
"builtinSource": "Built-in Feishu",
|
||||
"externalSource": "External OIDC",
|
||||
"configureBuiltIn": "The built-in Feishu issuer is not enabled. Save app credentials and enable it on the Feishu / OIDC Identity page first.",
|
||||
"manageFeishu": "Open Feishu / OIDC Identity",
|
||||
"builtinSummary": "The Feishu App ID, App Secret, and tenant are managed on the Feishu / OIDC Identity page; this tunnel references the issuer and its own public authentication entry.",
|
||||
"useBuiltIn": "Use built-in Feishu issuer",
|
||||
"builtInSecret": "The server supplies the VPN Client Secret. Do not enter the Feishu App Secret here.",
|
||||
"builtInGatewayPending": "The public Nginx route for the built-in issuer is pending; sync it on the Feishu / OIDC Identity page before testing.",
|
||||
"issuer": "OIDC issuer URL",
|
||||
"issuerTip": "Use an HTTPS issuer that provides standard discovery (/.well-known/openid-configuration) and ID tokens, not an authorization page URL.",
|
||||
"clientId": "OIDC Client ID",
|
||||
@@ -260,14 +267,17 @@
|
||||
"secretTip": "Encrypted server-side and stored only in the auth service's 0600 configuration file.",
|
||||
"baseUrl": "Public sign-in URL",
|
||||
"baseTip": "Automatic filling reuses the domain and certificate only. The management site does not yet proxy OAuth2 paths to the auth component. Sign-in needs that Nginx route. Recheck saved tunnel callbacks if the domain changes.",
|
||||
"builtinBaseTip": "Uses the system HTTPS domain automatically. The auth component listens locally; sync public routes in Settings after starting the tunnel.",
|
||||
"reuseDomain": "Use current public domain", "linkedDomain": "Using the HTTPS domain from system settings; you can edit it.",
|
||||
"builtinBaseTip": "Uses the system HTTPS domain automatically. The auth component listens locally; sync public routes on the Feishu / OIDC Identity page after starting the tunnel.",
|
||||
"reuseDomain": "Use current public domain",
|
||||
"linkedDomain": "Using the HTTPS domain from system settings; you can edit it.",
|
||||
"listenPort": "Local auth service port",
|
||||
"portTip": "Listens only on 127.0.0.1; no public access needed. New tunnels increment from 19090; +/- and manual entry skip configured and locally occupied ports.",
|
||||
"portLookupFailed": "Could not find an available port. Retry or enter one manually.",
|
||||
"callbackTitle": "Register this callback with the final OIDC provider",
|
||||
"callbackTip": "With an identity broker, register this URL in the broker's OIDC client, and register the broker's upstream callback in Feishu. Reverse proxy the public endpoint to 127.0.0.1:{port}; :18080 does not handle this callback.",
|
||||
"builtinCallbackTitle": "The VPN client and Feishu app use different callbacks", "builtinCallbackTip": "The VPN client callback above is handled by openvpn-auth-oauth2. Register only the Feishu app callback below in Feishu. After starting the tunnel, sync /oauth2/ to local port 127.0.0.1:{port} in Settings.", "feishuCallbackLabel": "Feishu app callback",
|
||||
"builtinCallbackTitle": "The VPN client and Feishu app use different callbacks",
|
||||
"builtinCallbackTip": "The VPN client callback above is handled by openvpn-auth-oauth2. Register only the Feishu app callback below in Feishu. After starting the tunnel, sync /oauth2/ to local port 127.0.0.1:{port} on the Feishu / OIDC Identity page.",
|
||||
"feishuCallbackLabel": "Feishu app callback",
|
||||
"testTip": "Install openvpn-auth-oauth2 and OpenVPN ≥ 2.6.2, then test with a WebAuth-capable client (e.g. OpenVPN Community for Windows or Tunnelblick/Viscosity for macOS). OpenVPN Connect v3 needs individual testing.",
|
||||
"startFailed": "Configuration generated, but the tunnel did not start. Resolve the error below and retry from the tunnel list.",
|
||||
"fillRequired": "Configure an identity source, OIDC issuer, VPN client credentials, and public sign-in URL"
|
||||
@@ -349,8 +359,8 @@
|
||||
"installFailed": "Failed to install {protocol}"
|
||||
},
|
||||
"users": {
|
||||
"title": "User Management",
|
||||
"clientLoginHint": "These accounts sign in to the admin console. Desktop VPN clients use VPN dial-in users assigned to a WireGuard line.",
|
||||
"title": "Admins",
|
||||
"clientLoginHint": "These accounts sign in to the admin console. Desktop VPN clients use dial-in accounts assigned to a WireGuard line.",
|
||||
"batchImport": "Batch Import",
|
||||
"ldapImport": "LDAP Import",
|
||||
"addUser": "Add User",
|
||||
@@ -428,7 +438,7 @@
|
||||
"empty": "No client devices registered"
|
||||
},
|
||||
"vpnUsers": {
|
||||
"title": "VPN Dial-in Users",
|
||||
"title": "Dial-in Accounts",
|
||||
"mfaHint": "OpenVPN Two-Factor Auth (TOTP / Static Challenge / PIN+OTP)",
|
||||
"addUser": "Add User",
|
||||
"bulkImport": "Bulk Import",
|
||||
@@ -454,7 +464,7 @@
|
||||
"lastOnline": "Last Online",
|
||||
"downloadConfig": "Download Config",
|
||||
"otpManagement": "OTP Management",
|
||||
"addVpnUserTitle": "Add VPN Dial-in User",
|
||||
"addVpnUserTitle": "Add Dial-in Account",
|
||||
"dialTunnel": "Dial-in Tunnel",
|
||||
"pickFromUsers": "Pick from Users",
|
||||
"displayNameLabel": "Display Name",
|
||||
@@ -576,18 +586,65 @@
|
||||
"noAlerts": "No traffic alerts"
|
||||
},
|
||||
"identity": {
|
||||
"tab": "Feishu identity", "title": "Built-in Feishu identity service", "description": "Issue OIDC identities for VPN using your existing HTTPS domain. Feishu app credentials stay upstream; this platform creates separate VPN client credentials.",
|
||||
"guideTitle": "Feishu app setup", "guideApp": "Enter the enterprise app ID and secret; grant the three scopes below as needed.", "guidePermission": "", "guidePublish": "Publish the app and include VPN users in its availability scope.", "guideCallback": "Security Settings → Redirect URL:", "guideCallbackPending": "Configure an HTTPS domain first.", "guideVerify": "", "guideManual": "", "guideScope": "",
|
||||
"tenantPermission": "tenant:tenant:readonly · enterprise lookup", "userPermission": "contact:user.base:readonly · browser sign-in", "basicProfilePermission": "contact:user.basic_profile:readonly · name lookup by open_id (app identity)", "permissionSteps": "Grant the app identity scope and publish the app; after a member signs in, check their name below.", "openFeishuPermission": "Open Feishu permissions ↗", "checkNamePending": "Check name below", "checking": "Checking", "checked": "Verified", "checkFailed": "Check failed", "checkPending": "Not checked", "checkedByLogin": "Login verified", "loginPending": "Verify on first login",
|
||||
"appId": "Feishu App ID", "appSecret": "Feishu App Secret", "secretPlaceholder": "Leave blank if saved; enter a new secret to rotate", "tenant": "Allowed Feishu tenant_key", "tenantPlaceholder": "Fetched automatically or enter manually", "fetchTenant": "Check again", "fetchingTenant": "Checking ({seconds}s)…", "tenantFetched": "Enterprise permission verified", "tenantFailed": "Enterprise permission check failed", "tenantNotEnabled": "", "enabled": "Enable built-in issuer", "httpsOnly": "Use HTTPS to enter app credentials.", "openHttps": "Open HTTPS management site",
|
||||
"httpsRequired": "Configure and activate your public HTTPS site and certificate first.", "gatewayPending": "The identity provider is saved but Nginx does not yet route /id/; sync the gateway.",
|
||||
"addresses": "Addresses and client credentials", "issuer": "OIDC issuer", "feishuCallback": "Callback registered in Feishu", "vpnCallback": "VPN client callback", "clientId": "VPN Client ID",
|
||||
"oneTimeSecret": "New VPN Client Secret is displayed only once. Store it safely; rotation of active tunnel credentials requires separate planning.", "routeHint": "Sync identity routes first. After starting the one OpenVPN OIDC tunnel using this domain, sync again to route /oauth2/ to its local auth component.",
|
||||
"syncGateway": "Sync identity gateway", "gatewaySynced": "Gateway routes updated", "gatewayFailed": "Gateway update failed", "loadFailed": "Could not load identity settings", "saved": "Identity settings saved", "saveFailed": "Could not save identity settings"
|
||||
"tab": "Feishu identity",
|
||||
"title": "Built-in Feishu identity service",
|
||||
"description": "Issue OIDC identities for VPN using your existing HTTPS domain. Feishu app credentials stay upstream; this platform creates separate VPN client credentials.",
|
||||
"guideTitle": "Feishu app setup",
|
||||
"guideApp": "Enter the enterprise app ID and secret; grant the three scopes below as needed.",
|
||||
"guidePermission": "",
|
||||
"guidePublish": "Publish the app and include VPN users in its availability scope.",
|
||||
"guideCallback": "Security Settings → Redirect URL:",
|
||||
"guideCallbackPending": "Configure an HTTPS domain first.",
|
||||
"guideVerify": "",
|
||||
"guideManual": "",
|
||||
"guideScope": "",
|
||||
"tenantPermission": "tenant:tenant:readonly · enterprise lookup",
|
||||
"userPermission": "contact:user.base:readonly · browser sign-in",
|
||||
"basicProfilePermission": "contact:user.basic_profile:readonly · name lookup by open_id (app identity)",
|
||||
"permissionSteps": "Grant the app identity scope and publish the app; after a member signs in, check their name below.",
|
||||
"openFeishuPermission": "Open Feishu permissions ↗",
|
||||
"checkNamePending": "Check name below",
|
||||
"checking": "Checking",
|
||||
"checked": "Verified",
|
||||
"checkFailed": "Check failed",
|
||||
"checkPending": "Not checked",
|
||||
"checkedByLogin": "Login verified",
|
||||
"loginPending": "Verify on first login",
|
||||
"appId": "Feishu App ID",
|
||||
"appSecret": "Feishu App Secret",
|
||||
"secretPlaceholder": "Leave blank if saved; enter a new secret to rotate",
|
||||
"tenant": "Allowed Feishu tenant_key",
|
||||
"tenantPlaceholder": "Fetched automatically or enter manually",
|
||||
"fetchTenant": "Check again",
|
||||
"fetchingTenant": "Checking ({seconds}s)…",
|
||||
"tenantFetched": "Enterprise permission verified",
|
||||
"tenantFailed": "Enterprise permission check failed",
|
||||
"tenantNotEnabled": "",
|
||||
"enabled": "Enable built-in issuer",
|
||||
"httpsOnly": "Use HTTPS to enter app credentials.",
|
||||
"openHttps": "Open HTTPS management site",
|
||||
"httpsRequired": "Configure and activate your public HTTPS site and certificate first.",
|
||||
"gatewayPending": "The identity provider is saved but Nginx does not yet route /id/; sync the gateway.",
|
||||
"addresses": "Addresses and client credentials",
|
||||
"issuer": "OIDC issuer",
|
||||
"feishuCallback": "Callback registered in Feishu",
|
||||
"vpnCallback": "VPN client callback",
|
||||
"clientId": "VPN Client ID",
|
||||
"oneTimeSecret": "New VPN Client Secret is displayed only once. Store it safely; rotation of active tunnel credentials requires separate planning.",
|
||||
"routeHint": "Sync identity routes first. After starting the one OpenVPN OIDC tunnel using this domain, sync again to route /oauth2/ to its local auth component.",
|
||||
"syncGateway": "Sync identity gateway",
|
||||
"gatewaySynced": "Gateway routes updated",
|
||||
"gatewayFailed": "Gateway update failed",
|
||||
"loadFailed": "Could not load identity settings",
|
||||
"saved": "Identity settings saved",
|
||||
"saveFailed": "Could not save identity settings",
|
||||
"pageDescription": "Configure Feishu or OIDC identity (app credentials, tenant, callbacks, and directory sync). Per-tunnel admission stays on the tunnel editor."
|
||||
},
|
||||
"settings": {
|
||||
"pageDescription": "Manage account security, the public gateway, and server setup.",
|
||||
"securityTab": "Account Security", "gatewayTab": "Public Gateway", "hostTab": "Server Setup",
|
||||
"securityTab": "Account Security",
|
||||
"gatewayTab": "Public Gateway",
|
||||
"hostTab": "Server Setup",
|
||||
"mustChangePassword": "First login or password has been reset by admin. You must change your password before using other features.",
|
||||
"changePassword": "Change Password",
|
||||
"oldPassword": "Current Password",
|
||||
@@ -615,7 +672,7 @@
|
||||
"prodSuggestion": "Production Tip",
|
||||
"prodSuggestionDesc": "Expose via Nginx/Caddy reverse proxy with TLS termination",
|
||||
"auditTitle": "Audit Log (Latest 100)",
|
||||
"auditMigrated": "Audit logs have been moved to Log Center with pagination, filtering, and CSV export",
|
||||
"auditMigrated": "Audit logs have been moved to Operation Audit with pagination, filtering, and CSV export",
|
||||
"noAuditLogs": "No audit logs yet",
|
||||
"mfaEnabledTitle": "MFA Enabled — Please Save Backup Codes",
|
||||
"backupCodesHint": "These backup codes are shown only once. Use them to log in if you lose your phone. Copy and save them now!",
|
||||
@@ -636,10 +693,12 @@
|
||||
"strengthWeak": "Weak",
|
||||
"strengthFair": "Fair",
|
||||
"strengthStrong": "Strong",
|
||||
"strengthVeryStrong": "Very Strong"
|
||||
"strengthVeryStrong": "Very Strong",
|
||||
"identityMovedHint": "Feishu / OIDC platform settings moved to a dedicated sidebar page; they are no longer configured here.",
|
||||
"identityMovedLink": "Open Feishu / OIDC Identity"
|
||||
},
|
||||
"plugins": {
|
||||
"title": "Custom Protocol Plugins",
|
||||
"title": "Custom Protocol Plugins (Preview)",
|
||||
"registerPlugin": "Register Plugin",
|
||||
"commandHooks": "command hooks",
|
||||
"pluginHint": "Plugins implement the unified protocol contract via {hooks}: the platform pipes tunnel config JSON to hook commands via stdin.",
|
||||
@@ -653,10 +712,11 @@
|
||||
"protocolIdPlaceholder": "e.g., myproto (alphanumeric)",
|
||||
"displayName": "Display Name",
|
||||
"optional": "Optional",
|
||||
"protocolIdRequired": "Protocol ID and Start hook are required"
|
||||
"protocolIdRequired": "Protocol ID and Start hook are required",
|
||||
"soonHint": "Protocol plugins are an early preview; contracts and stability are still evolving."
|
||||
},
|
||||
"nodes": {
|
||||
"title": "Node Management",
|
||||
"title": "Node Management (Preview)",
|
||||
"addNode": "Add Node",
|
||||
"nodeHint": "Nodes are used to deploy tunnels to relay servers. The local node is the built-in default; remote nodes support SSH credential verification (password/private key). Verified nodes show \"Verified\" status.",
|
||||
"type": "Type",
|
||||
@@ -691,7 +751,8 @@
|
||||
"updated": "Updated",
|
||||
"verifySuccess": "Verification successful: {msg}",
|
||||
"verifyFailed": "Verification failed: {msg}",
|
||||
"deleteNodeConfirm": "Delete node \"{name}\"? This action cannot be undone."
|
||||
"deleteNodeConfirm": "Delete node \"{name}\"? This action cannot be undone.",
|
||||
"soonHint": "Node management is an early multi-relay entry point; use with caution in production."
|
||||
},
|
||||
"notFound": {
|
||||
"title": "404",
|
||||
@@ -760,20 +821,26 @@
|
||||
"createTunnel": "Create Tunnel",
|
||||
"editTunnel": "Edit Tunnel",
|
||||
"ipsecPeer": "IPSec Peer Test",
|
||||
"nodes": "Nodes",
|
||||
"users": "Users",
|
||||
"vpnUsers": "VPN Dial-in Users",
|
||||
"nodes": "Nodes (Preview)",
|
||||
"users": "Admins",
|
||||
"vpnUsers": "Dial-in Accounts",
|
||||
"clientDevices": "Client Devices",
|
||||
"plugins": "Protocol Plugins",
|
||||
"plugins": "Protocol Plugins (Preview)",
|
||||
"settings": "Settings",
|
||||
"logs": "Log Center",
|
||||
"logs": "Operation Audit",
|
||||
"notFound": "Page Not Found",
|
||||
"sidebarOps": "Tunnel Ops",
|
||||
"sidebarOps": "Tunnels",
|
||||
"sidebarResource": "Identity & Devices",
|
||||
"sidebarSystem": "System",
|
||||
"sidebarWorkspace": "Workspace", "console": "Admin Console",
|
||||
"navigation": "Main navigation", "openNavigation": "Open navigation", "closeNavigation": "Close navigation",
|
||||
"collapseNavigation": "Collapse sidebar", "expandNavigation": "Expand sidebar"
|
||||
"sidebarWorkspace": "Workspace",
|
||||
"console": "Admin Console",
|
||||
"navigation": "Main navigation",
|
||||
"openNavigation": "Open navigation",
|
||||
"closeNavigation": "Close navigation",
|
||||
"collapseNavigation": "Collapse sidebar",
|
||||
"expandNavigation": "Expand sidebar",
|
||||
"identityAccess": "Feishu / OIDC Identity",
|
||||
"sidebarIntegration": "Integrations"
|
||||
},
|
||||
"protocolIcon": {
|
||||
"custom": "Custom Protocol"
|
||||
@@ -781,20 +848,93 @@
|
||||
"tls": {
|
||||
"title": "Domain & certificate",
|
||||
"description": "Configure a public domain and use Nginx / Certbot for HTTP-01 issuance and renewal.",
|
||||
"domain": "Configured domain", "activeDomain": "Active domain", "saveDomain": "Save domain", "restartRequired": "Domain saved; restart OpsX VPN to enable ports 80/443 and automatic issuance", "saveFailed": "Could not save domain", "dns": "DNS", "certificate": "Certificate", "valid": "Valid", "pending": "Pending first HTTPS handshake",
|
||||
"notConfigured": "Disabled", "saved": "Domain configuration saved", "issuer": "Issuer", "expires": "Expires", "renewal": "Renewal", "automatic": "Automatic (autocert)",
|
||||
"ports": "HTTP / HTTPS ports", "externalPorts": "Managed by external Nginx; listener status not checked", "setupHint": "Restart to apply a saved domain or mode. Before switching to Nginx, follow the deployment guide to install it, issue a certificate, and validate the configuration. Go mode caches certificates in data/acme; saving settings alone does not issue a certificate.",
|
||||
"refresh": "Refresh status", "openHttps": "Open HTTPS health check", "loadFailed": "Could not load certificate status",
|
||||
"mode": "Public entry mode", "goMode": "Go automatic certificate (binds 80/443)", "nginxMode": "Nginx proxy (external 80/443)", "saveMode": "Save entry mode",
|
||||
"domain": "Configured domain",
|
||||
"activeDomain": "Active domain",
|
||||
"saveDomain": "Save domain",
|
||||
"restartRequired": "Domain saved; restart OpsX VPN to enable ports 80/443 and automatic issuance",
|
||||
"saveFailed": "Could not save domain",
|
||||
"dns": "DNS",
|
||||
"certificate": "Certificate",
|
||||
"valid": "Valid",
|
||||
"pending": "Pending first HTTPS handshake",
|
||||
"notConfigured": "Disabled",
|
||||
"saved": "Domain configuration saved",
|
||||
"issuer": "Issuer",
|
||||
"expires": "Expires",
|
||||
"renewal": "Renewal",
|
||||
"automatic": "Automatic (autocert)",
|
||||
"ports": "HTTP / HTTPS ports",
|
||||
"externalPorts": "Managed by external Nginx; listener status not checked",
|
||||
"setupHint": "Restart to apply a saved domain or mode. Before switching to Nginx, follow the deployment guide to install it, issue a certificate, and validate the configuration. Go mode caches certificates in data/acme; saving settings alone does not issue a certificate.",
|
||||
"refresh": "Refresh status",
|
||||
"openHttps": "Open HTTPS health check",
|
||||
"loadFailed": "Could not load certificate status",
|
||||
"mode": "Public entry mode",
|
||||
"goMode": "Go automatic certificate (binds 80/443)",
|
||||
"nginxMode": "Nginx proxy (external 80/443)",
|
||||
"saveMode": "Save entry mode",
|
||||
"nginxHint": "Save the Nginx mode and domain, restart the service, then enable the site and request a certificate. Public ports 80/443 must be open.",
|
||||
"externalRenewal": "Managed by Certbot", "previewNginx": "Preview Nginx configuration", "previewOnly": "Configuration preview; HTTP handles issuance and HTTPS starts after the certificate exists.", "httpSite": "HTTP-01 site", "httpsSite": "HTTPS management site",
|
||||
"siteStage": "Site stage", "stage_none": "Inactive", "stage_http": "HTTP-01 ready; certificate pending", "stage_https": "HTTPS configuration enabled", "activateSite": "Enable site and issue certificate", "activateHint": "Checks existing sites and ports first. Certbot registration uses no email address, so renewal failures cannot be reported by email.", "siteReady": "HTTPS site and certificate are ready", "siteFailed": "Gateway or certificate setup failed; see output",
|
||||
"externalRenewal": "Managed by Certbot",
|
||||
"previewNginx": "Preview Nginx configuration",
|
||||
"previewOnly": "Configuration preview; HTTP handles issuance and HTTPS starts after the certificate exists.",
|
||||
"httpSite": "HTTP-01 site",
|
||||
"httpsSite": "HTTPS management site",
|
||||
"siteStage": "Site stage",
|
||||
"stage_none": "Inactive",
|
||||
"stage_http": "HTTP-01 ready; certificate pending",
|
||||
"stage_https": "HTTPS configuration enabled",
|
||||
"activateSite": "Enable site and issue certificate",
|
||||
"activateHint": "Checks existing sites and ports first. Certbot registration uses no email address, so renewal failures cannot be reported by email.",
|
||||
"siteReady": "HTTPS site and certificate are ready",
|
||||
"siteFailed": "Gateway or certificate setup failed; see output",
|
||||
"directPortWarning": "The management service still listens publicly on port 18080, bypassing Nginx path rules. Migrate clients using the old HTTP address, then bind the service to 127.0.0.1:18080.",
|
||||
"setupTitle": "Optional HTTPS public gateway", "setupStepCheck": "Detect system", "setupStepInstall": "Install dependencies", "setupStepConfigure": "Configure gateway and certificate", "detectedSystem": "Server OS", "setupUnsupported": "Automatic setup requires root on Ubuntu or TencentOS Server 4", "setupScope": "Use only if you choose the Nginx gateway. Installs Nginx / Certbot and prepares the validation directory. It does not install VPN protocol dependencies, enable ports, or issue certificates.", "setupButton": "Prepare Nginx / Certbot", "setupComplete": "Dependencies are ready; configure the site and certificate next", "setupFailed": "Initialization failed; inspect the output", "setupInterrupted": "Log connection interrupted; refresh status. Installation may still be running on the server",
|
||||
"commonSetupTitle": "First-time shared network setup", "commonSetupHint": "Check permissions, default route and IPv4 forwarding. Enable shared forwarding only when needed; install protocol-specific dependencies separately in Create Tunnel.", "hostRoot": "Privileges", "hostRoute": "Default route", "hostForward": "IPv4 forwarding", "enableForwarding": "Enable IPv4 forwarding", "forwardingEnabled": "IPv4 forwarding enabled"
|
||||
"setupTitle": "Optional HTTPS public gateway",
|
||||
"setupStepCheck": "Detect system",
|
||||
"setupStepInstall": "Install dependencies",
|
||||
"setupStepConfigure": "Configure gateway and certificate",
|
||||
"detectedSystem": "Server OS",
|
||||
"setupUnsupported": "Automatic setup requires root on Ubuntu or TencentOS Server 4",
|
||||
"setupScope": "Use only if you choose the Nginx gateway. Installs Nginx / Certbot and prepares the validation directory. It does not install VPN protocol dependencies, enable ports, or issue certificates.",
|
||||
"setupButton": "Prepare Nginx / Certbot",
|
||||
"setupComplete": "Dependencies are ready; configure the site and certificate next",
|
||||
"setupFailed": "Initialization failed; inspect the output",
|
||||
"setupInterrupted": "Log connection interrupted; refresh status. Installation may still be running on the server",
|
||||
"commonSetupTitle": "First-time shared network setup",
|
||||
"commonSetupHint": "Check permissions, default route and IPv4 forwarding. Enable shared forwarding only when needed; install protocol-specific dependencies separately in Create Tunnel.",
|
||||
"hostRoot": "Privileges",
|
||||
"hostRoute": "Default route",
|
||||
"hostForward": "IPv4 forwarding",
|
||||
"enableForwarding": "Enable IPv4 forwarding",
|
||||
"forwardingEnabled": "IPv4 forwarding enabled"
|
||||
},
|
||||
"feishuSync": {
|
||||
"title": "Feishu directory", "publishAll": "Publish the Feishu app, set availability to All Employees, and include departments in directory visibility.", "hint": "Sync manually or every 30 minutes; imports do not grant VPN access.", "permissions": "Grant department and user-list access; Feishu error codes show missing permissions.", "liveCheck": "Access check", "recheck": "Check again", "checking": "Checking…", "checkFailed": "Access check failed", "liveVisibility": "App visibility: {departments} departments · {users} individual users (not the enterprise total)", "scopeMissing": "Departments are not visible. Check department access and directory scope, then publish.", "permissionMissing": "Departments: {department}; users: {users}. Grant scopes indicated by the error codes.", "apiReady": "Endpoints work. Confirm publication and All Employees in Feishu.", "ok": "Available", "auto": "Auto sync (30 min)", "run": "Sync now", "lastSuccess": "Last success", "counts": "Departments {departments} · members {members}", "visibility": "Last scope: {departments} departments · {users} individual users", "noDepartments": "Departments are not visible yet. Check the app's access and directory scope.", "numberName": "Feishu still returns a 'User + number' name. Sync saved that value; if you just renamed them, check app visibility and retry later.", "name": "Name", "departments": "Department IDs", "firstMembers": "Showing the first 500 members", "saved": "Sync settings saved", "started": "Sync started", "done": "Directory sync complete", "failed": "Directory sync failed"
|
||||
"title": "Feishu directory",
|
||||
"publishAll": "Publish the Feishu app, set availability to All Employees, and include departments in directory visibility.",
|
||||
"hint": "Sync manually or every 30 minutes; imports do not grant VPN access.",
|
||||
"permissions": "Grant department and user-list access; Feishu error codes show missing permissions.",
|
||||
"liveCheck": "Access check",
|
||||
"recheck": "Check again",
|
||||
"checking": "Checking…",
|
||||
"checkFailed": "Access check failed",
|
||||
"liveVisibility": "App visibility: {departments} departments · {users} individual users (not the enterprise total)",
|
||||
"scopeMissing": "Departments are not visible. Check department access and directory scope, then publish.",
|
||||
"permissionMissing": "Departments: {department}; users: {users}. Grant scopes indicated by the error codes.",
|
||||
"apiReady": "Endpoints work. Confirm publication and All Employees in Feishu.",
|
||||
"ok": "Available",
|
||||
"auto": "Auto sync (30 min)",
|
||||
"run": "Sync now",
|
||||
"lastSuccess": "Last success",
|
||||
"counts": "Departments {departments} · members {members}",
|
||||
"visibility": "Last scope: {departments} departments · {users} individual users",
|
||||
"noDepartments": "Departments are not visible yet. Check the app's access and directory scope.",
|
||||
"numberName": "Feishu still returns a 'User + number' name. Sync saved that value; if you just renamed them, check app visibility and retry later.",
|
||||
"name": "Name",
|
||||
"departments": "Department IDs",
|
||||
"firstMembers": "Showing the first 500 members",
|
||||
"saved": "Sync settings saved",
|
||||
"started": "Sync started",
|
||||
"done": "Directory sync complete",
|
||||
"failed": "Directory sync failed"
|
||||
},
|
||||
"feishuDirectory": {
|
||||
"title": "Feishu directory lookup",
|
||||
@@ -1000,15 +1140,38 @@
|
||||
"desc": "Standard IP protocol 47 tunnel for point-to-point Layer 3 connectivity between Linux, routers, and firewalls",
|
||||
"scenes": "Network Device Interconnect / Site-to-Site Routing",
|
||||
"fields": {
|
||||
"local_endpoint": { "label": "Local Public IP" },
|
||||
"remote_endpoint": { "label": "Remote Public IP" },
|
||||
"local_tunnel_ip": { "label": "Local Tunnel IP", "tip": "Use a /30, for example 10.255.0.1/30" },
|
||||
"remote_tunnel_ip": { "label": "Remote Tunnel IP", "tip": "Must share the local tunnel IP subnet" },
|
||||
"remote_subnet": { "label": "Remote LAN Subnet", "tip": "Adds a static route through the GRE peer" },
|
||||
"enable_nat": { "label": "NAT Remote Traffic", "tip": "Enable only when the remote subnet needs Internet egress via this host" },
|
||||
"outbound_interface": { "label": "NAT Egress Interface" },
|
||||
"ttl": { "label": "TTL" },
|
||||
"mtu": { "label": "GRE MTU", "tip": "1476 is typical over public Internet GRE; lower it for additional encapsulation" }
|
||||
"local_endpoint": {
|
||||
"label": "Local Public IP"
|
||||
},
|
||||
"remote_endpoint": {
|
||||
"label": "Remote Public IP"
|
||||
},
|
||||
"local_tunnel_ip": {
|
||||
"label": "Local Tunnel IP",
|
||||
"tip": "Use a /30, for example 10.255.0.1/30"
|
||||
},
|
||||
"remote_tunnel_ip": {
|
||||
"label": "Remote Tunnel IP",
|
||||
"tip": "Must share the local tunnel IP subnet"
|
||||
},
|
||||
"remote_subnet": {
|
||||
"label": "Remote LAN Subnet",
|
||||
"tip": "Adds a static route through the GRE peer"
|
||||
},
|
||||
"enable_nat": {
|
||||
"label": "NAT Remote Traffic",
|
||||
"tip": "Enable only when the remote subnet needs Internet egress via this host"
|
||||
},
|
||||
"outbound_interface": {
|
||||
"label": "NAT Egress Interface"
|
||||
},
|
||||
"ttl": {
|
||||
"label": "TTL"
|
||||
},
|
||||
"mtu": {
|
||||
"label": "GRE MTU",
|
||||
"tip": "1476 is typical over public Internet GRE; lower it for additional encapsulation"
|
||||
}
|
||||
}
|
||||
},
|
||||
"frp": {
|
||||
|
||||
+219
-56
@@ -229,27 +229,34 @@
|
||||
"title": "飞书 / OIDC 浏览器认证配置",
|
||||
"externalService": "需要 openvpn-auth-oauth2",
|
||||
"componentReady": "认证组件已安装 v{version}",
|
||||
"authEntryPending": "{domain} 的 HTTPS 已就绪；专线启动后还需在“设置 → 飞书身份”同步认证入口路由。",
|
||||
"authEntryPending": "{domain} 的 HTTPS 已就绪；专线启动后还需在「飞书 / OIDC 身份」页同步认证入口路由。",
|
||||
"app": "创建应用",
|
||||
"appShort": "飞书开放平台",
|
||||
"identity": "填写身份信息",
|
||||
"identityShort": "OIDC 和应用凭据",
|
||||
"builtinIdentityShort": "在系统设置中填写飞书凭据",
|
||||
"builtinIdentityShort": "在「飞书 / OIDC 身份」页填写飞书凭据",
|
||||
"callback": "设置公网回调",
|
||||
"callbackShort": "HTTPS 与反向代理",
|
||||
"test": "客户端试连",
|
||||
"testShort": "浏览器登录验证",
|
||||
"appTip": "先由飞书管理员在开放平台创建应用，启用身份登录所需能力，并发布应用。",
|
||||
"builtinAppTip": "飞书 App ID 和 App Secret 统一在“设置 → 飞书身份”填写，不在专线里填写。",
|
||||
"builtinAppTip": "飞书 App ID 和 App Secret 统一在「飞书 / OIDC 身份」页填写，不在专线里填写。",
|
||||
"openConsole": "打开飞书开放平台的应用管理",
|
||||
"appInstruction1": "创建企业自建应用，获取应用凭据，并启用登录所需的网页授权能力。",
|
||||
"appInstruction2": "在应用的安全/重定向地址设置中登记回调；若使用身份代理，这里应填代理给飞书的上游回调地址。",
|
||||
"builtinAppInstruction2": "在飞书应用的安全/重定向地址中登记下方“飞书应用回调”，不要登记 VPN 客户端回调。",
|
||||
"appInstruction3": "发布应用，并在可用范围中只授权允许使用此 VPN 的人员。",
|
||||
"scopeTip": "在飞书侧限定应用可用人员。现有 LDAP 拨号用户不会自动关联飞书身份。",
|
||||
"providerTip": "可使用设置页配置的内置飞书身份服务；使用外部发行者时仍需标准 OIDC discovery 与 ID Token。飞书应用地址本身不是发行者。",
|
||||
"source": "身份来源", "builtinSource": "内置飞书身份", "externalSource": "外部 OIDC", "configureBuiltIn": "尚未启用内置飞书身份服务；请先到设置页保存应用凭据并启用。", "manageFeishu": "前往设置 → 飞书身份", "builtinSummary": "飞书 App ID、App Secret 与租户标识在设置页统一管理；专线只引用 OIDC 发行者和专属认证入口。",
|
||||
"useBuiltIn": "使用内置飞书身份服务", "builtInSecret": "VPN Client Secret 由服务端自动关联，无需复制或填写飞书 App Secret。", "builtInGatewayPending": "内置身份入口尚未同步 Nginx；到“设置 → 飞书身份”同步后再联调。",
|
||||
"providerTip": "可使用「飞书 / OIDC 身份」页配置的内置飞书身份服务；使用外部发行者时仍需标准 OIDC discovery 与 ID Token。飞书应用地址本身不是发行者。",
|
||||
"source": "身份来源",
|
||||
"builtinSource": "内置飞书身份",
|
||||
"externalSource": "外部 OIDC",
|
||||
"configureBuiltIn": "尚未启用内置飞书身份服务；请先到「飞书 / OIDC 身份」页保存应用凭据并启用。",
|
||||
"manageFeishu": "前往「飞书 / OIDC 身份」",
|
||||
"builtinSummary": "飞书 App ID、App Secret 与租户标识在「飞书 / OIDC 身份」页统一管理；专线只引用 OIDC 发行者和专属认证入口。",
|
||||
"useBuiltIn": "使用内置飞书身份服务",
|
||||
"builtInSecret": "VPN Client Secret 由服务端自动关联，无需复制或填写飞书 App Secret。",
|
||||
"builtInGatewayPending": "内置身份入口尚未同步 Nginx；到「飞书 / OIDC 身份」页同步后再联调。",
|
||||
"issuer": "OIDC 发行者地址",
|
||||
"issuerTip": "填写能提供标准 OIDC discovery（/.well-known/openid-configuration）和 ID Token 的 HTTPS 地址；不要填写飞书授权页面地址。",
|
||||
"clientId": "OIDC Client ID",
|
||||
@@ -260,14 +267,17 @@
|
||||
"secretTip": "仅保存在服务端加密存储与 0600 的认证服务配置文件内。",
|
||||
"baseUrl": "认证入口公网地址",
|
||||
"baseTip": "自动填写仅复用域名和证书；当前管理站点尚未转发认证组件的 OAuth2 路径。接通 Nginx 回调路由前不能完成登录。修改域名后需核对已保存专线的回调地址。",
|
||||
"builtinBaseTip": "自动使用系统 HTTPS 域名；认证组件仅监听本机，启动专线后到设置页同步公网路由。",
|
||||
"reuseDomain": "使用当前公网域名", "linkedDomain": "已引用系统设置中的 HTTPS 域名；可手动修改。",
|
||||
"builtinBaseTip": "自动使用系统 HTTPS 域名；认证组件仅监听本机，启动专线后到「飞书 / OIDC 身份」页同步公网路由。",
|
||||
"reuseDomain": "使用当前公网域名",
|
||||
"linkedDomain": "已引用系统设置中的 HTTPS 域名；可手动修改。",
|
||||
"listenPort": "本机认证服务端口",
|
||||
"portTip": "仅监听本机 127.0.0.1，无需公网开放。新建专线自动从 19090 起递增；加减或手动输入会跳过已配置和本机正在监听的端口。",
|
||||
"portLookupFailed": "无法获取可用端口，请稍后重试或手动选择",
|
||||
"callbackTitle": "在最终 OIDC 身份提供方的客户端中登记此回调地址",
|
||||
"callbackTip": "如果通过身份代理接入飞书，本地址登记在代理的 OIDC 客户端中，飞书应用应登记代理的上游回调。将公网入口的所有路径反向代理至本机 127.0.0.1:{port}；不由 :18080 处理。",
|
||||
"builtinCallbackTitle": "专线与飞书使用不同的回调地址", "builtinCallbackTip": "上方是 VPN 客户端回调，由 openvpn-auth-oauth2 处理；飞书应用中只登记下方的飞书应用回调。启动专线后在设置页同步 /oauth2/ 路由至本机 127.0.0.1:{port}。", "feishuCallbackLabel": "飞书应用回调",
|
||||
"builtinCallbackTitle": "专线与飞书使用不同的回调地址",
|
||||
"builtinCallbackTip": "上方是 VPN 客户端回调，由 openvpn-auth-oauth2 处理；飞书应用中只登记下方的飞书应用回调。启动专线后在「飞书 / OIDC 身份」页同步 /oauth2/ 路由至本机 127.0.0.1:{port}。",
|
||||
"feishuCallbackLabel": "飞书应用回调",
|
||||
"testTip": "安装 openvpn-auth-oauth2 与 OpenVPN ≥ 2.6.2 后启动专线；使用支持 WebAuth 的客户端试连（如 Windows OpenVPN Community、macOS Tunnelblick/Viscosity）。OpenVPN Connect v3 部分兼容，须实测。",
|
||||
"startFailed": "配置已生成，但专线未成功启动；处理下方错误后从专线列表重新启动",
|
||||
"fillRequired": "请先配置身份来源，并填写 OIDC 地址、VPN 客户端凭据和公网认证入口"
|
||||
@@ -349,8 +359,8 @@
|
||||
"installFailed": "{protocol} 安装失败"
|
||||
},
|
||||
"users": {
|
||||
"title": "管理用户",
|
||||
"clientLoginHint": "此处账号用于登录管理后台；桌面 VPN 客户端请使用“VPN 拨号用户”中的账号，并分配 WireGuard 专线。",
|
||||
"title": "管理员",
|
||||
"clientLoginHint": "此处账号用于登录管理后台；桌面 VPN 客户端请使用「拨号账号」中的账号，并分配 WireGuard 专线。",
|
||||
"batchImport": "批量导入",
|
||||
"ldapImport": "LDAP 导入",
|
||||
"addUser": "添加用户",
|
||||
@@ -428,7 +438,7 @@
|
||||
"empty": "暂无客户端设备登记"
|
||||
},
|
||||
"vpnUsers": {
|
||||
"title": "VPN 拨号用户",
|
||||
"title": "拨号账号",
|
||||
"mfaHint": "OpenVPN 双因素认证（TOTP / 静态挑战 / PIN+OTP）",
|
||||
"addUser": "添加用户",
|
||||
"bulkImport": "批量导入",
|
||||
@@ -454,7 +464,7 @@
|
||||
"lastOnline": "最近在线",
|
||||
"downloadConfig": "下载配置",
|
||||
"otpManagement": "OTP 管理",
|
||||
"addVpnUserTitle": "添加 VPN 拨号用户",
|
||||
"addVpnUserTitle": "添加拨号账号",
|
||||
"dialTunnel": "拨号隧道",
|
||||
"pickFromUsers": "从已有用户选",
|
||||
"displayNameLabel": "显示名",
|
||||
@@ -576,18 +586,65 @@
|
||||
"noAlerts": "暂无流量告警"
|
||||
},
|
||||
"identity": {
|
||||
"tab": "飞书身份", "title": "内置飞书身份服务", "description": "使用现有 HTTPS 域名签发 VPN 所需 OIDC 身份令牌。飞书 App 凭据仅用于飞书上游，VPN 客户端凭据由本平台生成。",
|
||||
"guideTitle": "飞书应用准备", "guideApp": "填入企业自建应用的 App ID 和 App Secret；按需开通下方三项权限。", "guidePermission": "", "guidePublish": "发布应用，并将 VPN 用户加入应用可用范围。", "guideCallback": "安全设置 → 重定向 URL：", "guideCallbackPending": "请先配置 HTTPS 域名。", "guideVerify": "", "guideManual": "", "guideScope": "",
|
||||
"tenantPermission": "tenant:tenant:readonly · 查询企业信息", "userPermission": "contact:user.base:readonly · 浏览器登录用户", "basicProfilePermission": "contact:user.basic_profile:readonly · 按 open_id 查询姓名（应用身份）", "permissionSteps": "在飞书开通应用身份权限并发布应用；成员登录后，到下方“飞书姓名查询”检查。", "openFeishuPermission": "打开飞书权限管理 ↗", "checkNamePending": "待检查姓名", "checking": "检测中", "checked": "已验证", "checkFailed": "检测失败", "checkPending": "待检测", "checkedByLogin": "登录已验证", "loginPending": "首次登录后验证",
|
||||
"appId": "飞书 App ID", "appSecret": "飞书 App Secret", "secretPlaceholder": "已保存可留空；更换密钥请填写", "tenant": "允许的飞书 tenant_key", "tenantPlaceholder": "自动读取，也可手填", "fetchTenant": "重新检测", "fetchingTenant": "正在检测（{seconds} 秒）…", "tenantFetched": "企业信息权限已验证", "tenantFailed": "检测企业信息权限失败", "tenantNotEnabled": "", "enabled": "启用内置发行者", "httpsOnly": "请通过 HTTPS 管理入口填写密钥。", "openHttps": "打开 HTTPS 管理入口",
|
||||
"httpsRequired": "请先完成公网域名 HTTPS 证书和站点配置，再启用身份服务。", "gatewayPending": "身份服务已保存，但 Nginx 尚未转发 /id/；请同步公网入口。",
|
||||
"addresses": "接入地址与客户端凭据", "issuer": "OIDC 发行者", "feishuCallback": "登记到飞书应用的回调", "vpnCallback": "VPN 客户端回调", "clientId": "VPN Client ID",
|
||||
"oneTimeSecret": "新 VPN Client Secret 只显示这一次，请立即妥善保存；现有专线的密钥轮换需另行安排。", "routeHint": "先同步身份路由；启动唯一一条使用当前域名的 OpenVPN OIDC 专线后，再同步一次以转发 /oauth2/ 到本机认证组件。",
|
||||
"syncGateway": "同步身份公网路由", "gatewaySynced": "公网路由已更新", "gatewayFailed": "公网路由更新失败", "loadFailed": "读取身份配置失败", "saved": "身份配置已保存", "saveFailed": "保存身份配置失败"
|
||||
"tab": "飞书身份",
|
||||
"title": "内置飞书身份服务",
|
||||
"description": "使用现有 HTTPS 域名签发 VPN 所需 OIDC 身份令牌。飞书 App 凭据仅用于飞书上游，VPN 客户端凭据由本平台生成。",
|
||||
"guideTitle": "飞书应用准备",
|
||||
"guideApp": "填入企业自建应用的 App ID 和 App Secret；按需开通下方三项权限。",
|
||||
"guidePermission": "",
|
||||
"guidePublish": "发布应用，并将 VPN 用户加入应用可用范围。",
|
||||
"guideCallback": "安全设置 → 重定向 URL：",
|
||||
"guideCallbackPending": "请先配置 HTTPS 域名。",
|
||||
"guideVerify": "",
|
||||
"guideManual": "",
|
||||
"guideScope": "",
|
||||
"tenantPermission": "tenant:tenant:readonly · 查询企业信息",
|
||||
"userPermission": "contact:user.base:readonly · 浏览器登录用户",
|
||||
"basicProfilePermission": "contact:user.basic_profile:readonly · 按 open_id 查询姓名（应用身份）",
|
||||
"permissionSteps": "在飞书开通应用身份权限并发布应用；成员登录后，到下方“飞书姓名查询”检查。",
|
||||
"openFeishuPermission": "打开飞书权限管理 ↗",
|
||||
"checkNamePending": "待检查姓名",
|
||||
"checking": "检测中",
|
||||
"checked": "已验证",
|
||||
"checkFailed": "检测失败",
|
||||
"checkPending": "待检测",
|
||||
"checkedByLogin": "登录已验证",
|
||||
"loginPending": "首次登录后验证",
|
||||
"appId": "飞书 App ID",
|
||||
"appSecret": "飞书 App Secret",
|
||||
"secretPlaceholder": "已保存可留空；更换密钥请填写",
|
||||
"tenant": "允许的飞书 tenant_key",
|
||||
"tenantPlaceholder": "自动读取，也可手填",
|
||||
"fetchTenant": "重新检测",
|
||||
"fetchingTenant": "正在检测（{seconds} 秒）…",
|
||||
"tenantFetched": "企业信息权限已验证",
|
||||
"tenantFailed": "检测企业信息权限失败",
|
||||
"tenantNotEnabled": "",
|
||||
"enabled": "启用内置发行者",
|
||||
"httpsOnly": "请通过 HTTPS 管理入口填写密钥。",
|
||||
"openHttps": "打开 HTTPS 管理入口",
|
||||
"httpsRequired": "请先完成公网域名 HTTPS 证书和站点配置，再启用身份服务。",
|
||||
"gatewayPending": "身份服务已保存，但 Nginx 尚未转发 /id/；请同步公网入口。",
|
||||
"addresses": "接入地址与客户端凭据",
|
||||
"issuer": "OIDC 发行者",
|
||||
"feishuCallback": "登记到飞书应用的回调",
|
||||
"vpnCallback": "VPN 客户端回调",
|
||||
"clientId": "VPN Client ID",
|
||||
"oneTimeSecret": "新 VPN Client Secret 只显示这一次，请立即妥善保存；现有专线的密钥轮换需另行安排。",
|
||||
"routeHint": "先同步身份路由；启动唯一一条使用当前域名的 OpenVPN OIDC 专线后，再同步一次以转发 /oauth2/ 到本机认证组件。",
|
||||
"syncGateway": "同步身份公网路由",
|
||||
"gatewaySynced": "公网路由已更新",
|
||||
"gatewayFailed": "公网路由更新失败",
|
||||
"loadFailed": "读取身份配置失败",
|
||||
"saved": "身份配置已保存",
|
||||
"saveFailed": "保存身份配置失败",
|
||||
"pageDescription": "配置飞书或 OIDC 身份源（App 凭据、租户、回调与通讯录同步）。专线准入名单仍在对应专线编辑页配置。"
|
||||
},
|
||||
"settings": {
|
||||
"pageDescription": "管理个人安全、公网认证入口与服务器环境。",
|
||||
"securityTab": "个人安全", "gatewayTab": "公网入口", "hostTab": "服务器环境",
|
||||
"securityTab": "个人安全",
|
||||
"gatewayTab": "公网入口",
|
||||
"hostTab": "服务器环境",
|
||||
"mustChangePassword": "首次登录或密码已被管理员重置，必须修改密码后才能使用其他功能",
|
||||
"changePassword": "修改密码",
|
||||
"oldPassword": "原密码",
|
||||
@@ -615,7 +672,7 @@
|
||||
"prodSuggestion": "生产建议",
|
||||
"prodSuggestionDesc": "经 Nginx/Caddy 反向代理终止 TLS 后暴露",
|
||||
"auditTitle": "操作审计（最近 100 条）",
|
||||
"auditMigrated": "审计日志已迁移至「日志中心」，支持分页、筛选和导出",
|
||||
"auditMigrated": "审计日志已迁移至「操作审计」，支持分页、筛选和导出",
|
||||
"noAuditLogs": "暂无审计日志",
|
||||
"mfaEnabledTitle": "MFA 已启用 — 请保存备用码",
|
||||
"backupCodesHint": "这些备用码仅显示一次，丢失手机时用于登录。请立即复制保存！",
|
||||
@@ -636,10 +693,12 @@
|
||||
"strengthWeak": "弱",
|
||||
"strengthFair": "一般",
|
||||
"strengthStrong": "较强",
|
||||
"strengthVeryStrong": "强"
|
||||
"strengthVeryStrong": "强",
|
||||
"identityMovedHint": "飞书 / OIDC 平台级配置已迁至侧栏独立页，设置里不再重复配置。",
|
||||
"identityMovedLink": "打开飞书 / OIDC 身份"
|
||||
},
|
||||
"plugins": {
|
||||
"title": "自定义协议插件",
|
||||
"title": "自定义协议插件（即将）",
|
||||
"registerPlugin": "注册插件",
|
||||
"commandHooks": "命令钩子",
|
||||
"pluginHint": "插件通过 {hooks} 实现统一协议契约：平台将专线配置 JSON 通过 stdin 传给钩子命令。",
|
||||
@@ -653,10 +712,11 @@
|
||||
"protocolIdPlaceholder": "如 myproto（字母数字）",
|
||||
"displayName": "显示名称",
|
||||
"optional": "可选",
|
||||
"protocolIdRequired": "协议标识与 Start 钩子必填"
|
||||
"protocolIdRequired": "协议标识与 Start 钩子必填",
|
||||
"soonHint": "协议插件为扩展能力，当前为早期可用版本，契约与稳定性仍在完善。"
|
||||
},
|
||||
"nodes": {
|
||||
"title": "节点管理",
|
||||
"title": "节点管理（即将）",
|
||||
"addNode": "添加节点",
|
||||
"nodeHint": "节点用于将专线部署到中继服务器。本机节点为内置默认节点；远程节点支持 SSH 凭证验证（密码/私钥），验证通过后状态显示为「已验证」。",
|
||||
"type": "类型",
|
||||
@@ -691,7 +751,8 @@
|
||||
"updated": "已更新",
|
||||
"verifySuccess": "验证成功：{msg}",
|
||||
"verifyFailed": "验证失败：{msg}",
|
||||
"deleteNodeConfirm": "确定删除节点「{name}」？该操作不可撤销。"
|
||||
"deleteNodeConfirm": "确定删除节点「{name}」？该操作不可撤销。",
|
||||
"soonHint": "节点管理为多中继能力的早期入口，当前为早期可用版本，请谨慎用于生产。"
|
||||
},
|
||||
"notFound": {
|
||||
"title": "404",
|
||||
@@ -760,20 +821,26 @@
|
||||
"createTunnel": "创建专线",
|
||||
"editTunnel": "编辑专线",
|
||||
"ipsecPeer": "IPSec 第三方对接",
|
||||
"nodes": "节点管理",
|
||||
"users": "用户管理",
|
||||
"vpnUsers": "VPN 拨号用户",
|
||||
"nodes": "节点管理（即将）",
|
||||
"users": "管理员",
|
||||
"vpnUsers": "拨号账号",
|
||||
"clientDevices": "客户端设备",
|
||||
"plugins": "协议插件",
|
||||
"plugins": "协议插件（即将）",
|
||||
"settings": "系统设置",
|
||||
"logs": "日志中心",
|
||||
"logs": "操作审计",
|
||||
"notFound": "页面不存在",
|
||||
"sidebarOps": "专线运维",
|
||||
"sidebarOps": "专线",
|
||||
"sidebarResource": "身份与设备",
|
||||
"sidebarSystem": "系统",
|
||||
"sidebarWorkspace": "工作台", "console": "管理控制台",
|
||||
"navigation": "主导航", "openNavigation": "打开导航", "closeNavigation": "关闭导航",
|
||||
"collapseNavigation": "收起侧栏", "expandNavigation": "展开侧栏"
|
||||
"sidebarWorkspace": "工作台",
|
||||
"console": "管理控制台",
|
||||
"navigation": "主导航",
|
||||
"openNavigation": "打开导航",
|
||||
"closeNavigation": "关闭导航",
|
||||
"collapseNavigation": "收起侧栏",
|
||||
"expandNavigation": "展开侧栏",
|
||||
"identityAccess": "飞书 / OIDC 身份",
|
||||
"sidebarIntegration": "对接与扩展"
|
||||
},
|
||||
"protocolIcon": {
|
||||
"custom": "自定义协议"
|
||||
@@ -781,20 +848,93 @@
|
||||
"tls": {
|
||||
"title": "域名与证书",
|
||||
"description": "配置公网域名，使用 Nginx / Certbot 申请并自动续签 HTTP-01 证书。",
|
||||
"domain": "配置域名", "activeDomain": "当前监听域名", "saveDomain": "保存域名", "restartRequired": "域名已保存，重启 opsx-vpn 后才会监听 80/443 并启用自动签发", "saveFailed": "保存域名失败", "dns": "DNS 解析", "certificate": "证书", "valid": "有效", "pending": "等待首次 HTTPS 请求签发",
|
||||
"notConfigured": "未启用", "saved": "域名配置已保存", "issuer": "颁发者", "expires": "到期时间", "renewal": "续签", "automatic": "自动（autocert）",
|
||||
"ports": "HTTP / HTTPS 端口", "externalPorts": "由外部 Nginx 管理，尚未检测监听状态", "setupHint": "保存域名或入口模式后需重启生效；切换为 Nginx 前须按部署文档完成安装、证书签发和配置校验。Go 模式证书缓存于 data/acme；保存配置本身不会签发证书。",
|
||||
"refresh": "刷新状态", "openHttps": "打开 HTTPS 健康检查", "loadFailed": "读取证书状态失败",
|
||||
"mode": "公网入口模式", "goMode": "Go 自动证书（进程监听 80/443）", "nginxMode": "Nginx 代理（外部监听 80/443）", "saveMode": "保存入口模式",
|
||||
"domain": "配置域名",
|
||||
"activeDomain": "当前监听域名",
|
||||
"saveDomain": "保存域名",
|
||||
"restartRequired": "域名已保存，重启 opsx-vpn 后才会监听 80/443 并启用自动签发",
|
||||
"saveFailed": "保存域名失败",
|
||||
"dns": "DNS 解析",
|
||||
"certificate": "证书",
|
||||
"valid": "有效",
|
||||
"pending": "等待首次 HTTPS 请求签发",
|
||||
"notConfigured": "未启用",
|
||||
"saved": "域名配置已保存",
|
||||
"issuer": "颁发者",
|
||||
"expires": "到期时间",
|
||||
"renewal": "续签",
|
||||
"automatic": "自动（autocert）",
|
||||
"ports": "HTTP / HTTPS 端口",
|
||||
"externalPorts": "由外部 Nginx 管理，尚未检测监听状态",
|
||||
"setupHint": "保存域名或入口模式后需重启生效；切换为 Nginx 前须按部署文档完成安装、证书签发和配置校验。Go 模式证书缓存于 data/acme；保存配置本身不会签发证书。",
|
||||
"refresh": "刷新状态",
|
||||
"openHttps": "打开 HTTPS 健康检查",
|
||||
"loadFailed": "读取证书状态失败",
|
||||
"mode": "公网入口模式",
|
||||
"goMode": "Go 自动证书（进程监听 80/443）",
|
||||
"nginxMode": "Nginx 代理（外部监听 80/443）",
|
||||
"saveMode": "保存入口模式",
|
||||
"nginxHint": "选择 Nginx 模式并保存域名后重启服务，再点击启用站点申请证书。端口 80/443 需允许公网访问。",
|
||||
"externalRenewal": "由 Certbot 管理", "previewNginx": "预览 Nginx 配置", "previewOnly": "以下为配置预览；HTTP 站点用于签发，HTTPS 站点在证书存在后启用。", "httpSite": "HTTP-01 站点", "httpsSite": "HTTPS 管理站点",
|
||||
"siteStage": "站点阶段", "stage_none": "未启用", "stage_http": "HTTP-01 已准备，证书待签发", "stage_https": "HTTPS 配置已启用", "activateSite": "启用站点并申请证书", "activateHint": "启用前会检查现有站点及端口；冲突时停止并提示。证书采用 Certbot 无邮箱注册，续签失败时不会收到邮件通知。", "siteReady": "HTTPS 站点与证书已就绪", "siteFailed": "站点或证书配置失败，请查看输出",
|
||||
"externalRenewal": "由 Certbot 管理",
|
||||
"previewNginx": "预览 Nginx 配置",
|
||||
"previewOnly": "以下为配置预览；HTTP 站点用于签发，HTTPS 站点在证书存在后启用。",
|
||||
"httpSite": "HTTP-01 站点",
|
||||
"httpsSite": "HTTPS 管理站点",
|
||||
"siteStage": "站点阶段",
|
||||
"stage_none": "未启用",
|
||||
"stage_http": "HTTP-01 已准备，证书待签发",
|
||||
"stage_https": "HTTPS 配置已启用",
|
||||
"activateSite": "启用站点并申请证书",
|
||||
"activateHint": "启用前会检查现有站点及端口；冲突时停止并提示。证书采用 Certbot 无邮箱注册，续签失败时不会收到邮件通知。",
|
||||
"siteReady": "HTTPS 站点与证书已就绪",
|
||||
"siteFailed": "站点或证书配置失败，请查看输出",
|
||||
"directPortWarning": "管理服务仍直接监听公网 18080，访问该端口会绕过 Nginx 的路径限制。请先迁移使用旧 HTTP 地址的客户端，再将管理服务改为仅监听 127.0.0.1:18080。",
|
||||
"setupTitle": "可选 · HTTPS 公网入口", "setupStepCheck": "检测系统", "setupStepInstall": "安装依赖", "setupStepConfigure": "配置入口与证书", "detectedSystem": "服务器系统", "setupUnsupported": "自动初始化仅支持以 root 运行的 Ubuntu 或 TencentOS Server 4", "setupScope": "仅在选择 Nginx 入口时点击：按需安装 Nginx / Certbot 并准备验证目录；不会安装 VPN 协议依赖、启用端口或签发证书。", "setupButton": "准备 Nginx / Certbot", "setupComplete": "依赖已准备，继续配置站点与证书", "setupFailed": "初始化失败，请查看输出", "setupInterrupted": "日志连接中断，请刷新状态；服务器上的安装可能仍在继续",
|
||||
"commonSetupTitle": "首次引导 · 通用网络环境", "commonSetupHint": "检查服务权限、默认出口和 IPv4 转发。仅按需开启通用转发；各专线协议的依赖在“创建专线”中分别安装。", "hostRoot": "运行权限", "hostRoute": "默认出口", "hostForward": "IPv4 转发", "enableForwarding": "开启 IPv4 转发", "forwardingEnabled": "IPv4 转发已开启"
|
||||
"setupTitle": "可选 · HTTPS 公网入口",
|
||||
"setupStepCheck": "检测系统",
|
||||
"setupStepInstall": "安装依赖",
|
||||
"setupStepConfigure": "配置入口与证书",
|
||||
"detectedSystem": "服务器系统",
|
||||
"setupUnsupported": "自动初始化仅支持以 root 运行的 Ubuntu 或 TencentOS Server 4",
|
||||
"setupScope": "仅在选择 Nginx 入口时点击：按需安装 Nginx / Certbot 并准备验证目录；不会安装 VPN 协议依赖、启用端口或签发证书。",
|
||||
"setupButton": "准备 Nginx / Certbot",
|
||||
"setupComplete": "依赖已准备，继续配置站点与证书",
|
||||
"setupFailed": "初始化失败，请查看输出",
|
||||
"setupInterrupted": "日志连接中断，请刷新状态；服务器上的安装可能仍在继续",
|
||||
"commonSetupTitle": "首次引导 · 通用网络环境",
|
||||
"commonSetupHint": "检查服务权限、默认出口和 IPv4 转发。仅按需开启通用转发；各专线协议的依赖在“创建专线”中分别安装。",
|
||||
"hostRoot": "运行权限",
|
||||
"hostRoute": "默认出口",
|
||||
"hostForward": "IPv4 转发",
|
||||
"enableForwarding": "开启 IPv4 转发",
|
||||
"forwardingEnabled": "IPv4 转发已开启"
|
||||
},
|
||||
"feishuSync": {
|
||||
"title": "飞书组织与成员", "publishAll": "请发布飞书应用，将可用范围设为“全体员工”，并开放通讯录部门范围。", "hint": "手动或每 30 分钟同步；导入不自动授予 VPN 权限。", "permissions": "需部门和成员列表读取权限；不足时显示飞书错误码。", "liveCheck": "权限检查", "recheck": "重新检测", "checking": "检测中…", "checkFailed": "权限检查失败", "liveVisibility": "应用可见：部门 {departments} · 单独成员 {users}（非企业总人数）", "scopeMissing": "部门不可见：检查部门读取权限及通讯录范围，发布后重试。", "permissionMissing": "部门：{department}；成员：{users}。请按错误码补全权限。", "apiReady": "接口可用；请在飞书确认已发布和“全体员工”。", "ok": "可用", "auto": "自动同步（30 分钟）", "run": "立即同步", "lastSuccess": "上次成功", "counts": "部门 {departments} · 成员 {members}", "visibility": "上次可见：部门 {departments} · 单独成员 {users}", "noDepartments": "部门尚不可见；请核对飞书应用权限和通讯录范围。", "numberName": "飞书接口仍返回“用户+编号”。同步已保存该值；若刚改名，请核对应用可见范围并稍后重试。", "name": "姓名", "departments": "部门 ID", "firstMembers": "仅显示前 500 位成员", "saved": "同步设置已保存", "started": "已开始同步", "done": "通讯录同步完成", "failed": "通讯录同步失败"
|
||||
"title": "飞书组织与成员",
|
||||
"publishAll": "请发布飞书应用，将可用范围设为“全体员工”，并开放通讯录部门范围。",
|
||||
"hint": "手动或每 30 分钟同步；导入不自动授予 VPN 权限。",
|
||||
"permissions": "需部门和成员列表读取权限；不足时显示飞书错误码。",
|
||||
"liveCheck": "权限检查",
|
||||
"recheck": "重新检测",
|
||||
"checking": "检测中…",
|
||||
"checkFailed": "权限检查失败",
|
||||
"liveVisibility": "应用可见：部门 {departments} · 单独成员 {users}（非企业总人数）",
|
||||
"scopeMissing": "部门不可见：检查部门读取权限及通讯录范围，发布后重试。",
|
||||
"permissionMissing": "部门：{department}；成员：{users}。请按错误码补全权限。",
|
||||
"apiReady": "接口可用；请在飞书确认已发布和“全体员工”。",
|
||||
"ok": "可用",
|
||||
"auto": "自动同步（30 分钟）",
|
||||
"run": "立即同步",
|
||||
"lastSuccess": "上次成功",
|
||||
"counts": "部门 {departments} · 成员 {members}",
|
||||
"visibility": "上次可见：部门 {departments} · 单独成员 {users}",
|
||||
"noDepartments": "部门尚不可见；请核对飞书应用权限和通讯录范围。",
|
||||
"numberName": "飞书接口仍返回“用户+编号”。同步已保存该值；若刚改名，请核对应用可见范围并稍后重试。",
|
||||
"name": "姓名",
|
||||
"departments": "部门 ID",
|
||||
"firstMembers": "仅显示前 500 位成员",
|
||||
"saved": "同步设置已保存",
|
||||
"started": "已开始同步",
|
||||
"done": "通讯录同步完成",
|
||||
"failed": "通讯录同步失败"
|
||||
},
|
||||
"feishuDirectory": {
|
||||
"title": "飞书姓名查询",
|
||||
@@ -1000,15 +1140,38 @@
|
||||
"desc": "标准 IP 协议 47 隧道，用于 Linux 与路由器、防火墙的点对点三层互联",
|
||||
"scenes": "网络设备互联 / 跨站点路由",
|
||||
"fields": {
|
||||
"local_endpoint": { "label": "本端公网 IP" },
|
||||
"remote_endpoint": { "label": "对端公网 IP" },
|
||||
"local_tunnel_ip": { "label": "本端隧道 IP", "tip": "建议使用 /30，例如 10.255.0.1/30" },
|
||||
"remote_tunnel_ip": { "label": "对端隧道 IP", "tip": "需与本端隧道 IP 位于同一子网" },
|
||||
"remote_subnet": { "label": "对端业务网段", "tip": "填写后自动添加经 GRE 对端的静态路由" },
|
||||
"enable_nat": { "label": "对端流量 NAT 出网", "tip": "仅当对端业务网段需要经本机访问互联网时启用" },
|
||||
"outbound_interface": { "label": "NAT 出站网卡" },
|
||||
"ttl": { "label": "TTL" },
|
||||
"mtu": { "label": "GRE MTU", "tip": "公网 GRE 常用 1476；链路有额外封装时可继续降低" }
|
||||
"local_endpoint": {
|
||||
"label": "本端公网 IP"
|
||||
},
|
||||
"remote_endpoint": {
|
||||
"label": "对端公网 IP"
|
||||
},
|
||||
"local_tunnel_ip": {
|
||||
"label": "本端隧道 IP",
|
||||
"tip": "建议使用 /30，例如 10.255.0.1/30"
|
||||
},
|
||||
"remote_tunnel_ip": {
|
||||
"label": "对端隧道 IP",
|
||||
"tip": "需与本端隧道 IP 位于同一子网"
|
||||
},
|
||||
"remote_subnet": {
|
||||
"label": "对端业务网段",
|
||||
"tip": "填写后自动添加经 GRE 对端的静态路由"
|
||||
},
|
||||
"enable_nat": {
|
||||
"label": "对端流量 NAT 出网",
|
||||
"tip": "仅当对端业务网段需要经本机访问互联网时启用"
|
||||
},
|
||||
"outbound_interface": {
|
||||
"label": "NAT 出站网卡"
|
||||
},
|
||||
"ttl": {
|
||||
"label": "TTL"
|
||||
},
|
||||
"mtu": {
|
||||
"label": "GRE MTU",
|
||||
"tip": "公网 GRE 常用 1476；链路有额外封装时可继续降低"
|
||||
}
|
||||
}
|
||||
},
|
||||
"frp": {
|
||||
|
||||
Reference in new issue
Block a user