{
  "common": {
    "appName": "VPN 管理平台",
    "confirm": "确认",
    "cancel": "取消",
    "save": "保存",
    "delete": "删除",
    "edit": "编辑",
    "add": "添加",
    "create": "创建",
    "close": "关闭",
    "search": "搜索",
    "refresh": "刷新",
    "back": "返回",
    "submit": "提交",
    "yes": "是",
    "no": "否",
    "enabled": "启用",
    "disabled": "禁用",
    "loading": "加载中",
    "operation": "操作",
    "status": "状态",
    "name": "名称",
    "description": "说明",
    "username": "用户名",
    "password": "密码",
    "email": "邮箱",
    "source": "来源",
    "local": "本地",
    "ldap": "LDAP",
    "remark": "备注",
    "protocol": "协议",
    "node": "节点",
    "time": "时间",
    "target": "对象",
    "action": "动作",
    "traffic": "流量 ↓ / ↑",
    "ipAddress": "IP 地址",
    "detail": "详情",
    "copy": "复制",
    "copied": "已复制",
    "download": "下载",
    "permanent": "永久",
    "saveSuccess": "已保存",
    "saveFailed": "保存失败",
    "deleteSuccess": "已删除",
    "deleteFailed": "删除失败",
    "loadFailed": "加载失败",
    "operationFailed": "操作失败",
    "deleteConfirm": "删除确认",
    "noData": "暂无数据",
    "never": "不",
    "copiedToClipboard": "已复制到剪贴板",
    "logout": "退出登录",
    "batchOperation": "批量操作"
  },
  "login": {
    "title": "VPN 专线管理平台",
    "subtitle": "统一管理多协议 VPN，配置简单、安全可控",
    "protocols": "WireGuard · IPSec · IKEv2 · L2TP · GRE · FRP · OpenVPN",
    "feature1Title": "多协议统一管理",
    "feature1Desc": "WireGuard / IPSec / IKEv2 / L2TP / GRE / OpenVPN",
    "feature2Title": "企业级安全",
    "feature2Desc": "密钥 AES-GCM 加密 + 双因素认证",
    "feature3Title": "一键创建配置",
    "feature3Desc": "向导式生成，客户端配置秒级下载",
    "feature4Title": "轻量零依赖",
    "feature4Desc": "单二进制交付，无需 Docker",
    "welcome": "欢迎登录",
    "welcomeHint": "请输入账号密码登录管理平台",
    "usernameLabel": "用户名",
    "usernamePlaceholder": "请输入用户名",
    "passwordLabel": "密码",
    "passwordPlaceholder": "请输入密码",
    "loginButton": "登 录",
    "defaultAccount": "默认账号 {account}，登录后请立即修改",
    "errorEmpty": "请输入用户名和密码",
    "loginSuccess": "登录成功",
    "changePasswordFirst": "首次登录请先修改密码",
    "loginFailed": "登录失败，请检查网络或联系管理员"
  },
  "dashboard": {
    "welcomeTitle": "欢迎使用 VPN 管理平台",
    "welcomeDesc": "还没有专线，3 步即可创建第一条：选择协议 → 填写参数 → 自动生成配置",
    "createNow": "立即创建专线",
    "totalTunnels": "专线总数",
    "running": "运行中",
    "onlineUsers": "在线用户",
    "totalTraffic": "累计流量 ↓↑",
    "protocolDistribution": "协议分布",
    "protocolEngineStatus": "协议引擎状态",
    "hostReadinessWarning": "主机运行前提未完全满足，VPN 转发或 NAT 可能无法正常工作",
    "readinessRoot": "服务未以 root 运行",
    "readinessForwarding": "IPv4 转发未启用",
    "readinessRoute": "未检测到默认出口路由",
    "depCheckResult": "系统依赖检测结果",
    "depReady": "已就绪",
    "demoMode": "演示模式",
    "deploy": "下载部署",
    "installCmd": "安装命令",
    "expiringTunnels": "即将到期的专线（7 天内）",
    "expiryTime": "到期时间",
    "noTunnels": "暂无专线",
    "deploySuccess": "{name} {version} 部署成功",
    "deployFailed": "{name} 部署失败",
    "contactAdmin": "请联系系统管理员安装",
    "recommendedCmd": "推荐命令",
    "otherDistros": "其他发行版",
    "copyRecommended": "复制推荐命令",
    "getInstallCmdFailed": "获取安装命令失败",
    "aptDefault": "apt 默认",
    "oneClickInstall": "一键安装",
    "oneClickFix": "一键修复",
    "fixSuccess": "已修复：{items}",
    "fixFailed": "修复失败：{items}",
    "fixNeedRoot": "需要以 root 运行才能修改系统配置",
    "fixNothing": "当前没有可自动修复的项"
  },
  "tunnels": {
    "searchPlaceholder": "搜索名称",
    "allProtocols": "全部协议",
    "allStates": "全部状态",
    "stateRunning": "运行中",
    "stateStopped": "已停止",
    "stateError": "异常",
    "stateUndeployed": "未部署",
    "createTunnel": "创建专线",
    "createFirst": "创建第一条专线",
    "noTunnels": "还没有专线",
    "expireTime": "到期时间",
    "localNode": "本机节点",
    "authMethod": "认证方式",
    "authUnknown": "未指定",
    "wgAuthPassword": "客户端账号 + 设备密钥",
    "wgAuthHint": "客户端账号用于领取设备授权；WireGuard 用密钥握手。手动添加的静态 Peer 仍凭密钥接入。",
    "start": "启动",
    "stop": "停止",
    "started": "已启动",
    "startFailed": "启动失败",
    "stopped": "已停止",
    "more": "更多",
    "viewLogs": "查看日志",
    "downloadConfig": "下载配置",
    "showQrCode": "显示二维码",
    "ipsecTest": "IPSec 对接测试",
    "delete": "删除",
    "detail": "详情",
    "protocol": "协议",
    "createTime": "创建时间",
    "autoStart": "自动启动",
    "runningParams": "运行参数",
    "clientConfig": "客户端配置",
    "noClientConfig": "该协议暂无客户端配置",
    "downloadClientConfig": "下载客户端配置",
    "ipsecParamCheck": "IPSec 参数检查与连通性测试",
    "trafficPolicy": "流量策略",
    "quotaGB": "配额(GB)",
    "quotaUnlimited": "0 = 不限。已用：{used}",
    "rateLimitMbps": "限速(Mbps)",
    "rateUnlimited": "0 = 不限",
    "exceedAction": "超额动作",
    "actionWarn": "仅告警",
    "actionBlock": "自动停止",
    "actionThrottle": "限速至1Mbps",
    "resetCycle": "重置周期",
    "resetNone": "不重置",
    "resetDaily": "每天",
    "resetMonthly": "每月",
    "savePolicy": "保存策略",
    "policySaved": "流量策略已保存",
    "peerList": "Peer 列表",
    "addPeer": "添加 Peer",
    "peerId": "Peer ID",
    "address": "地址",
    "peerOnline": "在线",
    "peerOffline": "离线",
    "config": "配置",
    "qrCode": "二维码",
    "scanQrTitle": "扫码导入 WireGuard 客户端",
    "scanQrHint": "使用 WireGuard App「从二维码添加」",
    "addPeerTitle": "添加 WireGuard Peer",
    "autoGenId": "留空自动生成 client-N",
    "peerNamePlaceholder": "手机 / 笔记本",
    "clientAddress": "客户端地址",
    "defaultAllowedIPs": "留空使用隧道默认",
    "externalPublicKey": "外部公钥",
    "externalKeyHint": "留空则平台托管生成密钥；填写则为外部设备",
    "logTitle": "实例日志 — {name}",
    "liveOutput": "● 实时输出中",
    "logStopped": "已停止",
    "pause": "暂停",
    "resume": "继续",
    "clearScreen": "清屏",
    "waitingLog": "等待日志输出...",
    "fillClientAddress": "请填写客户端地址",
    "peerAdded": "Peer 已添加",
    "addFailed": "添加失败",
    "deletePeerConfirm": "删除 Peer「{id}」？",
    "downloadFailed": "下载失败",
    "qrFailed": "生成二维码失败",
    "noClientConfigWarn": "无客户端配置",
    "deleteTunnelConfirm": "确定删除专线「{name}」？配置与密钥将一并清除。",
    "peerAlreadyAdded": "Peer 已添加",
    "stopFailed": "停止失败",
    "selected": "已选择 {count} 项",
    "batchStart": "批量启动",
    "batchStop": "批量停止",
    "batchDelete": "批量删除",
    "batchStartConfirm": "确认批量启动 {count} 条隧道？",
    "batchStopConfirm": "确认批量停止 {count} 条隧道？",
    "batchDeleteConfirm": "确认批量删除 {count} 条隧道？此操作不可撤销！",
    "batchStarted": "批量操作已提交，正在后台执行",
    "taskProgress": "任务进度",
    "taskPending": "等待中",
    "taskRunning": "执行中",
    "taskDone": "已完成",
    "taskFailed": "失败",
    "taskSuccess": "成功 {count}/{total}",
    "taskFailedCount": "失败 {count}",
    "taskInProgress": "进行中 ({done}/{total})",
    "taskComplete": "全部完成",
    "taskPartialFail": "部分失败",
    "viewTasks": "查看任务",
    "noTasks": "暂无任务记录",
    "trafficTrend": "流量趋势",
    "noTrafficData": "暂无流量数据（等待采样中…）"
  },
  "oidcGuide": {
    "title": "飞书 / OIDC 浏览器认证配置",
    "externalService": "需要 openvpn-auth-oauth2",
    "componentReady": "认证组件已安装 v{version}",
    "authEntryPending": "{domain} 的 HTTPS 已就绪；专线启动后还需在「飞书 / OIDC 身份」页同步认证入口路由。",
    "app": "创建应用",
    "appShort": "飞书开放平台",
    "identity": "填写身份信息",
    "identityShort": "OIDC 和应用凭据",
    "builtinIdentityShort": "在「飞书 / OIDC 身份」页填写飞书凭据",
    "callback": "设置公网回调",
    "callbackShort": "HTTPS 与反向代理",
    "test": "客户端试连",
    "testShort": "浏览器登录验证",
    "appTip": "先由飞书管理员在开放平台创建应用，启用身份登录所需能力，并发布应用。",
    "builtinAppTip": "飞书 App ID 和 App Secret 统一在「飞书 / OIDC 身份」页填写，不在专线里填写。",
    "openConsole": "打开飞书开放平台的应用管理",
    "appInstruction1": "创建企业自建应用，获取应用凭据，并启用登录所需的网页授权能力。",
    "appInstruction2": "在应用的安全/重定向地址设置中登记回调；若使用身份代理，这里应填代理给飞书的上游回调地址。",
    "builtinAppInstruction2": "在飞书应用的安全/重定向地址中登记下方“飞书应用回调”，不要登记 VPN 客户端回调。",
    "appInstruction3": "发布应用，并在可用范围中只授权允许使用此 VPN 的人员。",
    "scopeTip": "在飞书侧限定应用可用人员。现有 LDAP 拨号用户不会自动关联飞书身份。",
    "providerTip": "可使用「飞书 / OIDC 身份」页配置的内置飞书身份服务；使用外部发行者时仍需标准 OIDC discovery 与 ID Token。飞书应用地址本身不是发行者。",
    "source": "身份来源",
    "builtinSource": "内置飞书身份",
    "externalSource": "外部 OIDC",
    "configureBuiltIn": "尚未启用内置飞书身份服务；请先到「飞书 / OIDC 身份」页保存应用凭据并启用。",
    "manageFeishu": "前往「飞书 / OIDC 身份」",
    "builtinSummary": "飞书 App ID、App Secret 与租户标识在「飞书 / OIDC 身份」页统一管理；专线只引用 OIDC 发行者和专属认证入口。",
    "useBuiltIn": "使用内置飞书身份服务",
    "builtInSecret": "VPN Client Secret 由服务端自动关联，无需复制或填写飞书 App Secret。",
    "builtInGatewayPending": "内置身份入口尚未同步 Nginx；到「飞书 / OIDC 身份」页同步后再联调。",
    "issuer": "OIDC 发行者地址",
    "issuerTip": "填写能提供标准 OIDC discovery（/.well-known/openid-configuration）和 ID Token 的 HTTPS 地址；不要填写飞书授权页面地址。",
    "clientId": "OIDC Client ID",
    "clientIdTip": "从上方 issuer 对应的 OIDC 提供方获取：使用身份代理时填代理中创建的 VPN 客户端凭据，飞书 App ID/Secret 只填在代理的飞书上游配置中。",
    "clientSecret": "OIDC Client Secret",
    "copySecret": "从 OIDC 提供方复制，保存后不回显",
    "keepSecret": "留空保持原密钥",
    "secretTip": "仅保存在服务端加密存储与 0600 的认证服务配置文件内。",
    "baseUrl": "认证入口公网地址",
    "baseTip": "自动填写仅复用域名和证书；当前管理站点尚未转发认证组件的 OAuth2 路径。接通 Nginx 回调路由前不能完成登录。修改域名后需核对已保存专线的回调地址。",
    "builtinBaseTip": "自动使用系统 HTTPS 域名；认证组件仅监听本机，启动专线后到「飞书 / OIDC 身份」页同步公网路由。",
    "reuseDomain": "使用当前公网域名",
    "linkedDomain": "已引用系统设置中的 HTTPS 域名；可手动修改。",
    "listenPort": "本机认证服务端口",
    "portTip": "仅监听本机 127.0.0.1，无需公网开放。新建专线自动从 19090 起递增；加减或手动输入会跳过已配置和本机正在监听的端口。",
    "portLookupFailed": "无法获取可用端口，请稍后重试或手动选择",
    "callbackTitle": "在最终 OIDC 身份提供方的客户端中登记此回调地址",
    "callbackTip": "如果通过身份代理接入飞书，本地址登记在代理的 OIDC 客户端中，飞书应用应登记代理的上游回调。将公网入口的所有路径反向代理至本机 127.0.0.1:{port}；不由 :18080 处理。",
    "builtinCallbackTitle": "专线与飞书使用不同的回调地址",
    "builtinCallbackTip": "上方是 VPN 客户端回调，由 openvpn-auth-oauth2 处理；飞书应用中只登记下方的飞书应用回调。启动专线后在「飞书 / OIDC 身份」页同步 /oauth2/ 路由至本机 127.0.0.1:{port}。",
    "feishuCallbackLabel": "飞书应用回调",
    "testTip": "安装 openvpn-auth-oauth2 与 OpenVPN ≥ 2.6.2 后启动专线；使用支持 WebAuth 的客户端试连（如 Windows OpenVPN Community、macOS Tunnelblick/Viscosity）。OpenVPN Connect v3 部分兼容，须实测。",
    "startFailed": "配置已生成，但专线未成功启动；处理下方错误后从专线列表重新启动",
    "fillRequired": "请先配置身份来源，并填写 OIDC 地址、VPN 客户端凭据和公网认证入口"
  },
  "tunnelEditor": {
    "title": "编辑专线",
    "backToList": "返回列表",
    "sensitiveFieldHint": "密码、PSK、Token 等敏感字段不会回显；留空表示继续使用原值。",
    "tunnelName": "专线名称",
    "protocolType": "协议类型",
    "coreOptions": "核心接入配置",
    "advancedOptions": "详细配置",
    "trafficMode": "流量出口",
    "trafficGateway": "全流量经 VPN 网关",
    "trafficStatic": "仅静态路由",
    "trafficCustom": "自定义",
    "trafficGatewayTip": "客户端全部流量经 VPN 网关转发，并使用 NAT 出网。",
    "trafficStaticTip": "仅向客户端推送下方填写的目标网段，不改变其默认互联网出口。",
    "trafficCustomTip": "在详细配置中分别控制默认路由、静态路由与 NAT。",
    "keepOriginal": "留空保持原值",
    "expireTime": "到期时间",
    "expirePlaceholder": "留空为永久",
    "autoStart": "自动启动",
    "saveConfig": "保存配置",
    "loadFailed": "加载专线失败",
    "fillName": "请填写专线名称",
    "configSaved": "配置已保存"
  },
  "tunnelWizard": {
    "step1": "选择协议",
    "step2": "填写参数",
    "step3": "生成配置",
    "recommend": "推荐",
    "depReady": "✓ 依赖就绪",
    "notDeployed": "未部署",
    "oneClickInstall": "一键安装",
    "onDemandHint": "只检测各协议的依赖，不会自动安装。选用哪个协议，再点击该协议卡片上的“一键安装”使其就绪。",
    "installCmd": "安装命令",
    "customPlugin": "自定义协议插件",
    "customScene": "自定义对接",
    "tunnelName": "专线名称",
    "namePlaceholder": "例如：总部-分支互联",
    "protocolType": "协议类型",
    "reselect": "重新选择",
    "coreOptions": "核心接入配置",
    "trafficMode": "流量出口",
    "trafficGateway": "全流量经 VPN 网关",
    "trafficStatic": "仅静态路由",
    "trafficCustom": "自定义",
    "trafficGatewayTip": "客户端全部流量经 VPN 网关转发，并使用 NAT 出网。",
    "trafficStaticTip": "仅向客户端推送下方填写的目标网段，不改变其默认互联网出口。",
    "trafficCustomTip": "在详细配置中分别控制默认路由、静态路由与 NAT。",
    "advancedOptions": "高级选项",
    "expireTime": "到期时间",
    "expirePlaceholder": "留空为永久",
    "autoStartAfterCreate": "创建后自动启动",
    "previousStep": "上一步",
    "generateConfig": "生成配置",
    "createSuccess": "专线创建成功",
    "configGenerated": "「{name}」配置已生成",
    "clientConfig": "客户端配置",
    "downloadConfigFile": "下载配置文件",
    "showQrCode": "显示二维码",
    "goIpsecPeer": "前往 IPSec 对接页",
    "backToList": "返回列表",
    "installCmdTitle": "{name} 安装命令",
    "pkgManagerDetected": "检测到当前系统包管理器：{pm}，推荐使用以下命令",
    "noPkgManager": "未检测到系统包管理器，以下是各平台安装命令供参考",
    "aptDefault": "apt (默认)",
    "recommended": "推荐",
    "copyThisCmd": "复制此命令",
    "otherDistros": "其他发行版",
    "fillName": "请填写专线名称",
    "fillRequired": "请填写必填项：{label}",
    "createFailed": "创建失败",
    "installSuccess": "{protocol} {version} 安装成功 {method}",
    "methodPackageManager": "(包管理器安装)",
    "methodDownload": "(一键安装)",
    "installFailed": "{protocol} 安装失败"
  },
  "users": {
    "title": "管理员",
    "clientLoginHint": "此处账号用于登录管理后台；桌面 VPN 客户端请使用「拨号账号」中的账号，并分配 WireGuard 专线。",
    "batchImport": "批量导入",
    "ldapImport": "LDAP 导入",
    "addUser": "添加用户",
    "role": "角色",
    "roleAdmin": "管理员",
    "roleOperator": "运维",
    "roleViewer": "只读",
    "noUsers": "还没有用户",
    "ldapTitle": "LDAP / Active Directory",
    "ldapHint": "LDAP 用户可首次登录后自动同步，也可使用左侧「LDAP 导入」预先添加。",
    "ldapConfigHint": "配置 LDAP 服务器，实现统一身份认证",
    "ldapEnabled": "启用 LDAP",
    "ldapServerAddress": "LDAP 服务器地址",
    "ldapServerAddressPlaceholder": "例如 8.217.205.92 或 ldap.example.com",
    "ldapPort": "端口",
    "ldapProtocol": "连接协议",
    "ldapProtocolLDAPS": "LDAPS（推荐）",
    "ldapProtocolLDAP": "LDAP",
    "bindDn": "管理员 Bind DN",
    "bindPassword": "管理员密码",
    "keepOriginal": "留空保持原值",
    "baseDn": "Base DN（用户搜索基础）",
    "userFilter": "搜索过滤器（可选，%s 表示用户名）",
    "enableLdaps": "启用 LDAPS（SSL 加密）",
    "usernameAttr": "用户名属性",
    "testConnection": "测试连接",
    "editUser": "编辑用户",
    "loginUsername": "登录用户名",
    "keepUnchanged": "留空不修改",
    "min8Chars": "至少 8 位",
    "batchImportTitle": "批量导入用户",
    "batchHint": "每行一个用户，格式：用户名,密码  或仅用户名（自动生成密码）。密码至少 8 位。",
    "batchPlaceholder": "每行一个：用户名,密码（如 user1,Pass1234）；或仅用户名自动生成密码",
    "defaultRole": "默认角色",
    "startImport": "开始导入",
    "ldapImportTitle": "从 LDAP 导入用户",
    "ldapNotEnabled": "LDAP 未启用，请先在右侧配置并测试连接",
    "refreshUserList": "刷新用户列表",
    "userCount": "共 {count} 个用户，已选 {selected} 个",
    "fullName": "姓名",
    "imported": "已导入",
    "pendingImport": "待导入",
    "clickRefreshHint": "点击上方刷新加载 LDAP 用户",
    "ldapDisabled": "LDAP 未启用",
    "importSelected": "导入入选中 ({count})",
    "updated": "已更新",
    "fillUsername": "请填写用户名",
    "passwordMin8": "密码至少 8 位",
    "userCreated": "用户已创建",
    "deleteUserConfirm": "确定删除用户「{username}」？",
    "enterAtLeastOne": "请输入至少一行用户数据",
    "importResult": "成功 {success}，跳过 {skipped}，失败 {failed}",
    "importResultTitle": "导入结果",
    "importFailed": "导入失败",
    "ldapLoadFailed": "LDAP 加载失败",
    "ldapConfigSaved": "LDAP 配置已保存",
    "ldapConnected": "LDAP 连接成功",
    "ldapTestRequired": "请先测试 LDAP 连接，通过后才能保存",
    "ldapConnectFailed": "连接失败",
    "emptyUsername": "(空)",
    "errorDetails": "失败详情："
  },
  "clientDevices": {
    "title": "客户端设备",
    "hint": "桌面/移动客户端登记的接入设备；撤销后立即失去接入能力",
    "deviceName": "设备名",
    "platform": "平台",
    "tunnel": "所属线路",
    "address": "分配地址",
    "lastHandshake": "最近握手",
    "revoked": "已撤销",
    "revoke": "撤销",
    "revokeConfirm": "撤销后该设备立即断开且无法重连，确认撤销？",
    "revokeDone": "设备已撤销",
    "empty": "暂无客户端设备登记"
  },
  "vpnUsers": {
    "title": "拨号账号",
    "mfaHint": "OpenVPN 双因素认证（TOTP / 静态挑战 / PIN+OTP）",
    "addUser": "添加用户",
    "bulkImport": "批量导入",
    "bulkImportTitle": "批量导入平台用户",
    "bulkImportHint": "仅 OpenVPN 支持导入平台本地或 LDAP 用户；L2TP/IKEv2 请创建独立拨号账号。",
    "importSelected": "导入选中用户",
    "importedCount": "已导入 {count} 个用户",
    "importFailed": "批量导入失败",
    "selectOpenVPNTunnel": "选择 OpenVPN 隧道",
    "selectTunnelAndUsers": "请选择 OpenVPN 隧道和平台用户",
    "searchPlaceholder": "搜索用户名、姓名或邮箱",
    "allTunnels": "全部隧道",
    "selectedUsers": "已选择 {count} 个用户",
    "batchDelete": "批量删除",
    "batchDeleteConfirm": "确认删除选中的 {count} 个拨号用户？",
    "batchDeleteDone": "已删除选中拨号用户",
    "displayName": "姓名",
    "tunnel": "隧道",
    "otpMfa": "OTP / MFA",
    "bound": "已绑定",
    "unbound": "未绑定",
    "locked": "锁定",
    "lastOnline": "最近在线",
    "downloadConfig": "下载配置",
    "otpManagement": "OTP 管理",
    "addVpnUserTitle": "添加拨号账号",
    "dialTunnel": "拨号隧道",
    "pickFromUsers": "从已有用户选",
    "displayNameLabel": "显示名",
    "authSource": "认证来源",
    "min8Chars": "至少 8 位",
    "ldapDn": "LDAP DN",
    "create": "创建",
    "pickUserTitle": "选择已有平台用户",
    "noPlatformUsers": "暂无平台用户",
    "clickRowHint": "点击行即选中并自动填充",
    "otpDialogTitle": "双因素认证 — {username}",
    "otpHint": "基于 TOTP 的双因素认证（SHA1 / base32 / 30s / 6 位），兼容主流 Authenticator 应用。支持静态挑战二次输入与 PIN+OTP 组合模式。",
    "mfaNotEnabled": "尚未启用双因素认证",
    "mfaDisabledHint": "绑定验证器后，此用户登录 VPN 时需要额外输入动态验证码。",
    "mfaEnabledHint": "该用户登录 VPN 时需要密码和动态验证码。",
    "mfaSetupIntro": "为该用户绑定一个 Authenticator 应用，保护 VPN 拨号登录。",
    "manualSetup": "无法扫码？使用手动密钥",
    "verifySetup": "确认绑定",
    "verifySetupHint": "在 Authenticator 中扫描后，输入当前显示的 6 位验证码完成验证。",
    "securityDetails": "安全详情",
    "bindStatus": "绑定状态",
    "boundTotp": "已绑定 TOTP",
    "staticPin": "静态 PIN",
    "pinSet": "已设置",
    "pinNotSet": "未设置",
    "failCount": "失败次数",
    "lockStatus": "锁定",
    "lockedUntil": "是（至 {time}）",
    "lastOtpSuccess": "最近 OTP 成功",
    "compatible": "兼容",
    "totpCompatible": "TOTP 标准（兼容 Google/Microsoft Authenticator）",
    "bindAuthenticator": "绑定 Authenticator",
    "disableMfa": "关闭 MFA",
    "regenBackupCodes": "重新生成备用码",
    "setClearPin": "设置/清除 PIN",
    "unlock": "解锁",
    "exportKeys": "导出密钥",
    "scanHint": "使用 Google Authenticator / Microsoft Authenticator / FreeOTP 扫描",
    "base32Key": "base32 密钥：{key}",
    "input6DigitCode": "输入 6 位验证码确认绑定",
    "verifyAndEnable": "验证并启用",
    "clientConnectHint": "客户端连接方式：密码框填登录密码，第二因子填 6 位动态验证码（若设置了 PIN，则填 PIN+验证码，如 1234123456）。也支持密码后直接附加 6 位码。",
    "setPinTitle": "设置静态 PIN",
    "pinHint": "连接时第二因子需输入 PIN + 6 位动态验证码（无空格拼接）。留空保存可清除已设置的 PIN。",
    "pinPlaceholder": "4-32 位 PIN，留空清除",
    "userFilled": "已填充用户「{username}」信息",
    "vpnUserCreated": "拨号用户已创建",
    "createFailed": "创建失败",
    "downloadFailed": "下载失败",
    "mfaSetupFailed": "无法开始 MFA 设置",
    "inputCode": "请输入验证码",
    "mfaEnabledMsg": "双因素认证已启用。\n\n一次性备用码（请妥善保存，丢失手机时用于登录）：\n{codes}\n\n客户端连接方式：密码框填登录密码，第二因子填 6 位动态验证码（若设置了 PIN 则填 PIN+验证码）。",
    "bindSuccess": "绑定成功",
    "verifyFailed": "验证失败",
    "disableMfaConfirm": "关闭 {username} 的 MFA？",
    "mfaClosed": "MFA 已关闭",
    "backupCodesTitle": "备用码",
    "newBackupCodes": "新备用码（旧码失效）：\n\n{codes}",
    "generateFailed": "生成失败",
    "pinSetSuccess": "PIN 已设置",
    "pinCleared": "PIN 已清除",
    "unlocked": "已解锁",
    "unlockFailed": "解锁失败",
    "exportKeysTitle": "导出密钥",
    "otpSecretsMsg": "TOTP 密钥行（敏感信息，请勿泄露）：\n\n{line}\n\n格式说明：{format}",
    "exportFailed": "导出失败",
    "deleteVpnUserConfirm": "删除拨号用户 {username}？"
  },
  "sessions": {
    "title": "在线会话",
    "onlineCount": "{count} 个在线",
    "publicAddress": "公网地址",
    "vpnIp": "VPN IP",
    "connectedDuration": "已连接时长",
    "kickOffline": "踢下线",
    "noOnlineUsers": "当前无在线用户",
    "identityUnknown": "身份未识别",
    "trafficAlert": "⚠ 异常流量告警",
    "userTunnel": "用户/隧道",
    "alertType": "类型",
    "rateAlert": "突发流量",
    "quotaExceed": "配额超额",
    "auditLog": "连接审计日志",
    "event": "事件",
    "eventConnect": "连接",
    "eventDisconnect": "断开",
    "eventAuthFail": "认证失败",
    "eventQuotaExceed": "配额超额",
    "eventRateAlert": "突发流量",
    "seconds": "{n}秒",
    "minutes": "{n}分钟",
    "hoursMinutes": "{h}小时{m}分",
    "loadDataFailed": "加载数据失败",
    "kickConfirm": "确定踢用户「{username}」下线？",
    "kicked": "已踢下线"
  },
  "logs": {
    "auditTitle": "操作审计日志",
    "connTitle": "连接审计日志",
    "alertTitle": "流量告警",
    "statsTitle": "日志统计",
    "keywordPlaceholder": "搜索目标/详情",
    "startDate": "开始日期",
    "endDate": "结束日期",
    "exportCsv": "导出 CSV",
    "exportFailed": "导出日志失败，请重试",
    "eventType": "事件类型",
    "tunnelId": "隧道ID",
    "auditCount": "审计日志",
    "connCount": "连接日志",
    "sessionCount": "会话记录",
    "from": "从",
    "cleanup": "清理日志",
    "cleanupHint": "删除指定天数之前的日志数据",
    "cleanupPrompt": "保留最近多少天的日志？",
    "cleanupInputError": "请输入正整数",
    "cleanupDone": "清理完成：审计 {audit} 条、连接 {conn} 条、会话 {session} 条",
    "loadFailed": "加载日志失败",
    "noAlerts": "暂无流量告警"
  },
  "identity": {
    "tab": "飞书身份",
    "title": "内置飞书身份服务",
    "description": "使用现有 HTTPS 域名签发 VPN 所需 OIDC 身份令牌。飞书 App 凭据仅用于飞书上游，VPN 客户端凭据由本平台生成。",
    "guideTitle": "飞书应用准备",
    "guideApp": "填入企业自建应用的 App ID 和 App Secret；按需开通下方三项权限。",
    "guidePermission": "",
    "guidePublish": "发布应用，并将 VPN 用户加入应用可用范围。",
    "guideCallback": "安全设置 → 重定向 URL：",
    "guideCallbackPending": "请先配置 HTTPS 域名。",
    "guideVerify": "",
    "guideManual": "",
    "guideScope": "",
    "tenantPermission": "tenant:tenant:readonly · 查询企业信息",
    "userPermission": "contact:user.base:readonly · 浏览器登录用户",
    "basicProfilePermission": "contact:user.basic_profile:readonly · 按 open_id 查询姓名（应用身份）",
    "permissionSteps": "在飞书开通应用身份权限并发布应用；成员登录后，到下方“飞书姓名查询”检查。",
    "openFeishuPermission": "打开飞书权限管理 ↗",
    "checkNamePending": "待检查姓名",
    "checking": "检测中",
    "checked": "已验证",
    "checkFailed": "检测失败",
    "checkPending": "待检测",
    "checkedByLogin": "登录已验证",
    "loginPending": "首次登录后验证",
    "appId": "飞书 App ID",
    "appSecret": "飞书 App Secret",
    "secretPlaceholder": "已保存可留空；更换密钥请填写",
    "tenant": "允许的飞书 tenant_key",
    "tenantPlaceholder": "自动读取，也可手填",
    "fetchTenant": "重新检测",
    "fetchingTenant": "正在检测（{seconds} 秒）…",
    "tenantFetched": "企业信息权限已验证",
    "tenantFailed": "检测企业信息权限失败",
    "tenantNotEnabled": "",
    "enabled": "启用内置发行者",
    "httpsOnly": "请通过 HTTPS 管理入口填写密钥。",
    "openHttps": "打开 HTTPS 管理入口",
    "httpsRequired": "请先完成公网域名 HTTPS 证书和站点配置，再启用身份服务。",
    "gatewayPending": "身份服务已保存，但 Nginx 尚未转发 /id/；请同步公网入口。",
    "addresses": "接入地址与客户端凭据",
    "issuer": "OIDC 发行者",
    "feishuCallback": "登记到飞书应用的回调",
    "vpnCallback": "VPN 客户端回调",
    "clientId": "VPN Client ID",
    "oneTimeSecret": "新 VPN Client Secret 只显示这一次，请立即妥善保存；现有专线的密钥轮换需另行安排。",
    "routeHint": "先同步身份路由；启动唯一一条使用当前域名的 OpenVPN OIDC 专线后，再同步一次以转发 /oauth2/ 到本机认证组件。",
    "syncGateway": "同步身份公网路由",
    "gatewaySynced": "公网路由已更新",
    "gatewayFailed": "公网路由更新失败",
    "loadFailed": "读取身份配置失败",
    "saved": "身份配置已保存",
    "saveFailed": "保存身份配置失败",
    "pageDescription": "配置飞书或 OIDC 身份源（App 凭据、租户、回调与通讯录同步）。专线准入名单仍在对应专线编辑页配置。"
  },
  "settings": {
    "pageDescription": "管理个人安全、公网认证入口与服务器环境。",
    "securityTab": "个人安全",
    "gatewayTab": "公网入口",
    "hostTab": "服务器环境",
    "mustChangePassword": "首次登录或密码已被管理员重置，必须修改密码后才能使用其他功能",
    "changePassword": "修改密码",
    "oldPassword": "原密码",
    "newPassword": "新密码",
    "min8Chars": "至少 8 位",
    "confirmNewPassword": "确认新密码",
    "change": "修改",
    "mfaTitle": "双因素认证（MFA）",
    "mfaHint": "使用 Microsoft Authenticator、Google Authenticator 等应用扫描二维码。备用码可在丢失手机时登录。",
    "setupMfa": "设置 MFA",
    "disableMfa": "关闭 MFA",
    "input6DigitCode": "输入 App 显示的 6 位验证码",
    "verifyAndEnable": "验证并启用",
    "deployTitle": "部署说明",
    "deliveryForm": "交付形态",
    "deliveryDesc": "单二进制（前端已内嵌），无需 Docker",
    "dataDir": "数据目录",
    "dataDirDesc": "./data（可用 VPN_DATA_DIR 覆盖）",
    "listenAddr": "监听地址",
    "listenAddrDesc": ":8080（VPN_LISTEN_ADDR 覆盖）",
    "keyStorage": "密钥存储",
    "keyStorageDesc": "PSK / 私钥 AES-GCM 加密落库，配置文件 0600 权限",
    "systemDeps": "系统依赖",
    "systemDepsDesc": "wireguard-tools / strongswan / xl2tpd / openvpn / frp",
    "prodSuggestion": "生产建议",
    "prodSuggestionDesc": "经 Nginx/Caddy 反向代理终止 TLS 后暴露",
    "auditTitle": "操作审计（最近 100 条）",
    "auditMigrated": "审计日志已迁移至「操作审计」，支持分页、筛选和导出",
    "noAuditLogs": "暂无审计日志",
    "mfaEnabledTitle": "MFA 已启用 — 请保存备用码",
    "backupCodesHint": "这些备用码仅显示一次，丢失手机时用于登录。请立即复制保存！",
    "copyAll": "复制全部",
    "savedConfirm": "我已保存",
    "passwordMismatch": "两次新密码不一致",
    "passwordMin8": "新密码至少 8 位",
    "passwordChanged": "密码已修改",
    "changeFailed": "修改失败",
    "setupFailed": "设置失败",
    "verifyFailed": "验证失败",
    "mfaClosed": "MFA 已关闭",
    "closeFailed": "关闭失败",
    "mustChangeHint": "首次登录或密码已被重置，请先修改密码",
    "confirmChange": "确认修改",
    "strength": "强度：{level}",
    "strengthVeryWeak": "很弱",
    "strengthWeak": "弱",
    "strengthFair": "一般",
    "strengthStrong": "较强",
    "strengthVeryStrong": "强",
    "identityMovedHint": "飞书 / OIDC 平台级配置已迁至侧栏独立页，设置里不再重复配置。",
    "identityMovedLink": "打开飞书 / OIDC 身份"
  },
  "plugins": {
    "title": "自定义协议插件（即将）",
    "registerPlugin": "注册插件",
    "commandHooks": "命令钩子",
    "pluginHint": "插件通过 {hooks} 实现统一协议契约：平台将专线配置 JSON 通过 stdin 传给钩子命令。",
    "pluginContract": "契约：{contract}；Status 钩子 stdout 输出 {running} 或 {stopped}；Config 钩子 stdout 输出客户端配置文本。",
    "protocolId": "协议标识",
    "enabled": "启用",
    "disabled": "停用",
    "noPlugins": "还没有自定义协议插件",
    "editPlugin": "编辑插件",
    "registerPluginTitle": "注册协议插件",
    "protocolIdPlaceholder": "如 myproto（字母数字）",
    "displayName": "显示名称",
    "optional": "可选",
    "protocolIdRequired": "协议标识与 Start 钩子必填",
    "soonHint": "协议插件为扩展能力，当前为早期可用版本，契约与稳定性仍在完善。"
  },
  "nodes": {
    "title": "节点管理（即将）",
    "addNode": "添加节点",
    "nodeHint": "节点用于将专线部署到中继服务器。本机节点为内置默认节点；远程节点支持 SSH 凭证验证（密码/私钥），验证通过后状态显示为「已验证」。",
    "type": "类型",
    "typeLocal": "本机",
    "typeRemote": "远程",
    "sshUser": "SSH 用户",
    "authMethod": "认证方式",
    "authPassword": "密码",
    "authKey": "私钥",
    "statusReady": "就绪",
    "statusVerified": "已验证",
    "statusFailed": "验证失败",
    "statusUnverified": "未验证",
    "verify": "验证",
    "noNodes": "还没有远程节点，点击右上角添加",
    "editNode": "编辑节点",
    "namePlaceholder": "例如：北京中继节点",
    "addressPlaceholder": "IP 或域名，如 192.168.1.100",
    "sshPort": "SSH 端口",
    "remoteNode": "远程节点",
    "localNode": "本机节点",
    "defaultRoot": "默认 root",
    "keepUnchanged": "留空表示不修改",
    "sshPasswordPlaceholder": "SSH 登录密码",
    "privateKeyPlaceholder": "粘贴 OpenSSH/PEM 格式私钥内容",
    "testConnection": "测试连接",
    "determine": "确定",
    "fillAddressFirst": "请先填写地址",
    "requestFailed": "请求失败",
    "fillNameAndAddress": "请填写名称与地址",
    "added": "已添加",
    "updated": "已更新",
    "verifySuccess": "验证成功：{msg}",
    "verifyFailed": "验证失败：{msg}",
    "deleteNodeConfirm": "确定删除节点「{name}」？该操作不可撤销。",
    "soonHint": "节点管理为多中继能力的早期入口，当前为早期可用版本，请谨慎用于生产。"
  },
  "notFound": {
    "title": "404",
    "subtitle": "您访问的页面不存在或已被移除",
    "backHome": "返回首页"
  },
  "mfaVerify": {
    "title": "双因素认证",
    "hint": "请输入 Authenticator 应用中显示的 6 位动态验证码",
    "verifyAndLogin": "验证并登录",
    "backToLogin": "返回登录",
    "inputFullCode": "请输入完整的 6 位验证码",
    "sessionExpired": "登录会话已过期，请重新登录",
    "verifySuccess": "验证成功",
    "codeError": "验证码错误，请重试"
  },
  "ipsecPeer": {
    "localParams": "本端 IPSec 参数",
    "loadTemplate": "载入设备模板",
    "localPublicIp": "本端公网 IP",
    "remoteGateway": "对端网关",
    "localSubnets": "本端网段",
    "remoteSubnets": "对端网段",
    "psk": "预共享密钥",
    "phase1": "Phase 1（IKE SA）",
    "ikeVersion": "IKE 版本",
    "proposal": "提议",
    "localId": "本端 ID",
    "remoteId": "对端 ID",
    "phase2": "Phase 2（IPSec SA）",
    "espProposal": "ESP 提议",
    "pfsGroup": "PFS 组",
    "dpdPolicy": "DPD 策略",
    "dpdRestart": "restart（断线重连）",
    "dpdClear": "clear（清除）",
    "dpdTrap": "trap（按需触发）",
    "createIpsecTunnel": "创建 IPSec 专线",
    "paramConsistency": "双方参数一致性检查",
    "peerIkeVersion": "对端 IKE 版本",
    "peerPhase1": "对端 Phase1",
    "peerPhase2": "对端 Phase2",
    "peerPfsGroup": "对端 PFS 组",
    "peerLocalSubnets": "对端本端网段",
    "peerIkePlaceholder": "对端的 IKE 提议",
    "peerEspPlaceholder": "对端的 ESP 提议",
    "peerSubnetsPlaceholder": "对端视角的 local（=我方 remote）",
    "startCompare": "开始对比检查",
    "paramsConsistent": "双方参数一致，可以建立隧道",
    "paramsInconsistent": "发现参数不一致：",
    "connectivityTest": "一键连通性测试",
    "selectIpsecTunnel": "选择已有 IPSec 专线",
    "testConnectivity": "测试与对端网关连通性",
    "reachable": "可达",
    "unreachable": "不可达",
    "latency": "耗时",
    "templateLoaded": "已载入「{name}」模板：{note}",
    "fillRequiredFields": "请填写完整的必填项（网关/网段/PSK）",
    "ipsecCreated": "IPSec 专线已创建并启动",
    "createFailed": "创建失败",
    "testFailed": "测试失败"
  },
  "router": {
    "dashboard": "总览",
    "tunnels": "专线列表",
    "sessions": "在线会话",
    "createTunnel": "创建专线",
    "editTunnel": "编辑专线",
    "ipsecPeer": "IPSec 第三方对接",
    "nodes": "节点管理（即将）",
    "users": "管理员",
    "vpnUsers": "拨号账号",
    "clientDevices": "客户端设备",
    "plugins": "协议插件（即将）",
    "settings": "系统设置",
    "logs": "操作审计",
    "notFound": "页面不存在",
    "sidebarOps": "专线",
    "sidebarResource": "身份与设备",
    "sidebarSystem": "系统",
    "sidebarWorkspace": "工作台",
    "console": "管理控制台",
    "navigation": "主导航",
    "openNavigation": "打开导航",
    "closeNavigation": "关闭导航",
    "collapseNavigation": "收起侧栏",
    "expandNavigation": "展开侧栏",
    "identityAccess": "飞书 / OIDC 身份",
    "sidebarIntegration": "对接与扩展"
  },
  "protocolIcon": {
    "custom": "自定义协议"
  },
  "tls": {
    "title": "域名与证书",
    "description": "配置公网域名，使用 Nginx / Certbot 申请并自动续签 HTTP-01 证书。",
    "domain": "配置域名",
    "activeDomain": "当前监听域名",
    "saveDomain": "保存域名",
    "restartRequired": "域名已保存，重启 opsx-vpn 后才会监听 80/443 并启用自动签发",
    "saveFailed": "保存域名失败",
    "dns": "DNS 解析",
    "certificate": "证书",
    "valid": "有效",
    "pending": "等待首次 HTTPS 请求签发",
    "notConfigured": "未启用",
    "saved": "域名配置已保存",
    "issuer": "颁发者",
    "expires": "到期时间",
    "renewal": "续签",
    "automatic": "自动（autocert）",
    "ports": "HTTP / HTTPS 端口",
    "externalPorts": "由外部 Nginx 管理，尚未检测监听状态",
    "setupHint": "保存域名或入口模式后需重启生效；切换为 Nginx 前须按部署文档完成安装、证书签发和配置校验。Go 模式证书缓存于 data/acme；保存配置本身不会签发证书。",
    "refresh": "刷新状态",
    "openHttps": "打开 HTTPS 健康检查",
    "loadFailed": "读取证书状态失败",
    "mode": "公网入口模式",
    "goMode": "Go 自动证书（进程监听 80/443）",
    "nginxMode": "Nginx 代理（外部监听 80/443）",
    "saveMode": "保存入口模式",
    "nginxHint": "选择 Nginx 模式并保存域名后重启服务，再点击启用站点申请证书。端口 80/443 需允许公网访问。",
    "externalRenewal": "由 Certbot 管理",
    "previewNginx": "预览 Nginx 配置",
    "previewOnly": "以下为配置预览；HTTP 站点用于签发，HTTPS 站点在证书存在后启用。",
    "httpSite": "HTTP-01 站点",
    "httpsSite": "HTTPS 管理站点",
    "siteStage": "站点阶段",
    "stage_none": "未启用",
    "stage_http": "HTTP-01 已准备，证书待签发",
    "stage_https": "HTTPS 配置已启用",
    "activateSite": "启用站点并申请证书",
    "activateHint": "启用前会检查现有站点及端口；冲突时停止并提示。证书采用 Certbot 无邮箱注册，续签失败时不会收到邮件通知。",
    "siteReady": "HTTPS 站点与证书已就绪",
    "siteFailed": "站点或证书配置失败，请查看输出",
    "directPortWarning": "管理服务仍直接监听公网 18080，访问该端口会绕过 Nginx 的路径限制。请先迁移使用旧 HTTP 地址的客户端，再将管理服务改为仅监听 127.0.0.1:18080。",
    "setupTitle": "可选 · HTTPS 公网入口",
    "setupStepCheck": "检测系统",
    "setupStepInstall": "安装依赖",
    "setupStepConfigure": "配置入口与证书",
    "detectedSystem": "服务器系统",
    "setupUnsupported": "自动初始化仅支持以 root 运行的 Ubuntu 或 TencentOS Server 4",
    "setupScope": "仅在选择 Nginx 入口时点击：按需安装 Nginx / Certbot 并准备验证目录；不会安装 VPN 协议依赖、启用端口或签发证书。",
    "setupButton": "准备 Nginx / Certbot",
    "setupComplete": "依赖已准备，继续配置站点与证书",
    "setupFailed": "初始化失败，请查看输出",
    "setupInterrupted": "日志连接中断，请刷新状态；服务器上的安装可能仍在继续",
    "commonSetupTitle": "首次引导 · 通用网络环境",
    "commonSetupHint": "检查服务权限、默认出口和 IPv4 转发。仅按需开启通用转发；各专线协议的依赖在“创建专线”中分别安装。",
    "hostRoot": "运行权限",
    "hostRoute": "默认出口",
    "hostForward": "IPv4 转发",
    "enableForwarding": "开启 IPv4 转发",
    "forwardingEnabled": "IPv4 转发已开启"
  },
  "feishuSync": {
    "title": "飞书组织与成员",
    "publishAll": "请发布飞书应用，将可用范围设为“全体员工”，并开放通讯录部门范围。",
    "hint": "手动或每 30 分钟同步；导入不自动授予 VPN 权限。",
    "permissions": "需部门和成员列表读取权限；不足时显示飞书错误码。",
    "liveCheck": "权限检查",
    "recheck": "重新检测",
    "checking": "检测中…",
    "checkFailed": "权限检查失败",
    "liveVisibility": "应用可见：部门 {departments} · 单独成员 {users}（非企业总人数）",
    "scopeMissing": "部门不可见：检查部门读取权限及通讯录范围，发布后重试。",
    "permissionMissing": "部门：{department}；成员：{users}。请按错误码补全权限。",
    "apiReady": "接口可用；请在飞书确认已发布和“全体员工”。",
    "ok": "可用",
    "auto": "自动同步（30 分钟）",
    "run": "立即同步",
    "lastSuccess": "上次成功",
    "counts": "部门 {departments} · 成员 {members}",
    "visibility": "上次可见：部门 {departments} · 单独成员 {users}",
    "noDepartments": "部门尚不可见；请核对飞书应用权限和通讯录范围。",
    "numberName": "飞书接口仍返回“用户+编号”。同步已保存该值；若刚改名，请核对应用可见范围并稍后重试。",
    "name": "姓名",
    "departments": "部门 ID",
    "firstMembers": "仅显示前 500 位成员",
    "saved": "同步设置已保存",
    "started": "已开始同步",
    "done": "通讯录同步完成",
    "failed": "通讯录同步失败"
  },
  "feishuDirectory": {
    "title": "飞书姓名查询",
    "hint": "完成登录后可检查姓名。基础姓名接口需应用身份权限 contact:user.basic_profile:readonly，并发布应用。",
    "choose": "选择已登录成员",
    "check": "检查姓名",
    "found": "通讯录姓名：{name}",
    "basicUnavailable": "基础姓名接口未返回结果；请开通应用身份权限 contact:user.basic_profile:readonly 并发布应用。",
    "failed": "检查失败"
  },
  "feishuAdmission": {
    "title": "飞书成员准入",
    "mode": "允许连接的成员",
    "all": "同企业所有同事",
    "allowlist": "仅指定成员",
    "modeHint": "成员首次通过飞书登录后出现在下方。先添加成员，再切换为仅指定成员；撤销后下次登录生效。",
    "members": "已授权成员",
    "choose": "选择已完成飞书登录的成员",
    "add": "添加",
    "remove": "撤销",
    "empty": "暂无授权成员",
    "saveFirst": "先保存内置飞书专线，再管理授权成员。",
    "adminOnly": "仅管理员可管理授权成员。",
    "loadFailed": "无法加载飞书成员"
  },
  "protocols": {
    "wireguard": {
      "name": "WireGuard",
      "desc": "性能最好的现代 VPN，内核级实现，漫游友好",
      "scenes": "内部接入 / 移动办公",
      "fields": {
        "address": {
          "label": "服务端 VPN 网段地址",
          "tip": "服务端在 VPN 网段中的地址（CIDR）"
        },
        "auth_mode": {
          "label": "客户端认证方式",
          "tip": "账号验证后领取设备授权，隧道使用密钥握手。静态 Peer 仍凭密钥接入；飞书/OIDC 需独立实现客户端回调和用户授权映射。",
          "options": {
            "password": "客户端账号 + 设备密钥",
            "oidc": "第三方 OAuth2 / OIDC（尚未接入）"
          }
        },
        "listen_port": {
          "label": "监听端口"
        },
        "client_address": {
          "label": "首个客户端地址",
          "tip": "创建后可在详情中继续添加 Peer"
        },
        "public_endpoint": {
          "label": "公网接入点",
          "tip": "客户端连接用，公网 IP:端口"
        },
        "dns": {
          "label": "DNS"
        },
        "allowed_ips": {
          "label": "客户端 AllowedIPs",
          "tip": "全流量代理用 0.0.0.0/0；仅内网填内网网段"
        },
        "latency_probe": {
          "label": "隧道测速目标",
          "tip": "可经该专线访问的 IP:端口，如 10.88.0.1:22；未设置时测试公网 223.5.5.5:443。记录 TCP 建链耗时。"
        },
        "keepalive": {
          "label": "Keepalive(秒)",
          "tip": "NAT 后客户端建议 15–25"
        },
        "mtu": {
          "label": "MTU",
          "tip": "0 表示默认；跨公网常见 1280–1420"
        },
        "enable_nat": {
          "label": "启用 NAT 出网",
          "tip": "客户端需访问公网/其它网段时开启"
        },
        "egress_interface": {
          "label": "NAT 出口网卡",
          "tip": "留空则自动探测默认路由网卡"
        }
      }
    },
    "ipsec": {
      "name": "IPSec 站点互联",
      "desc": "与第三方设备（Cisco/华为/飞塔等）做站点到站点对接",
      "scenes": "第三方对接 / 站点互联",
      "fields": {
        "vendor_template": {
          "label": "厂商模板",
          "tip": "自动预填 Phase1/Phase2 提议，仍可手动改",
          "options": {
            "generic": "通用标准（推荐）",
            "cisco": "Cisco ISR/ASR",
            "fortigate": "FortiGate",
            "huawei": "华为 USG/AR",
            "h3c": "H3C"
          }
        },
        "public_endpoint": {
          "label": "本端公网 IP"
        },
        "remote_gateway": {
          "label": "对端网关地址"
        },
        "local_subnets": {
          "label": "本端网段",
          "tip": "多个网段用逗号分隔"
        },
        "remote_subnets": {
          "label": "对端网段"
        },
        "psk": {
          "label": "预共享密钥 PSK"
        },
        "ike_version": {
          "label": "IKE 版本",
          "options": {
            "ikev2": "IKEv2",
            "ikev1": "IKEv1"
          }
        },
        "ike_proposal": {
          "label": "Phase1 提议",
          "tip": "加密-认证-DH组，需与对端一致"
        },
        "esp_proposal": {
          "label": "Phase2 提议"
        },
        "pfs_group": {
          "label": "PFS DH 组"
        },
        "ike_lifetime": {
          "label": "IKE 生存期(秒)"
        },
        "local_id": {
          "label": "本端标识 ID"
        },
        "remote_id": {
          "label": "对端标识 ID"
        }
      }
    },
    "ikev2": {
      "name": "IKEv2 远程接入",
      "desc": "手机/笔记本原生拨号进内网，比 L2TP 更现代",
      "scenes": "员工远程办公 / 原生 VPN",
      "fields": {
        "public_endpoint": {
          "label": "服务器公网地址"
        },
        "local_id": {
          "label": "服务器 ID / 远程 ID",
          "tip": "客户端「远程 ID」与此一致"
        },
        "psk": {
          "label": "机器认证 PSK",
          "tip": "留空自动生成；iOS/Android 共享密钥"
        },
        "address_pool": {
          "label": "客户端地址池"
        },
        "dns": {
          "label": "下发 DNS"
        },
        "local_ts": {
          "label": "放行网段",
          "tip": "0.0.0.0/0 为全流量；可改为内网 CIDR"
        },
        "ike_proposal": {
          "label": "IKE 提议"
        },
        "esp_proposal": {
          "label": "ESP 提议"
        }
      }
    },
    "l2tp": {
      "name": "L2TP/IPSec",
      "desc": "兼容性最好，手机/老设备/路由器原生支持",
      "scenes": "移动设备 / 老设备兼容",
      "fields": {
        "public_endpoint": {
          "label": "服务器公网 IP"
        },
        "psk": {
          "label": "IPSec 预共享密钥",
          "tip": "留空将自动生成高强度随机密钥；请在创建后从客户端配置中安全获取"
        },
        "ip_range": {
          "label": "客户端地址池"
        },
        "local_ip": {
          "label": "服务端隧道地址"
        },
        "dns": {
          "label": "下发 DNS"
        }
      }
    },
    "gre": {
      "name": "GRE 隧道",
      "desc": "标准 IP 协议 47 隧道，用于 Linux 与路由器、防火墙的点对点三层互联",
      "scenes": "网络设备互联 / 跨站点路由",
      "fields": {
        "local_endpoint": {
          "label": "本端公网 IP"
        },
        "remote_endpoint": {
          "label": "对端公网 IP"
        },
        "local_tunnel_ip": {
          "label": "本端隧道 IP",
          "tip": "建议使用 /30，例如 10.255.0.1/30"
        },
        "remote_tunnel_ip": {
          "label": "对端隧道 IP",
          "tip": "需与本端隧道 IP 位于同一子网"
        },
        "remote_subnet": {
          "label": "对端业务网段",
          "tip": "填写后自动添加经 GRE 对端的静态路由"
        },
        "enable_nat": {
          "label": "对端流量 NAT 出网",
          "tip": "仅当对端业务网段需要经本机访问互联网时启用"
        },
        "outbound_interface": {
          "label": "NAT 出站网卡"
        },
        "ttl": {
          "label": "TTL"
        },
        "mtu": {
          "label": "GRE MTU",
          "tip": "公网 GRE 常用 1476；链路有额外封装时可继续降低"
        }
      }
    },
    "frp": {
      "name": "FRP 内网穿透",
      "desc": "国内刚需，TCP/UDP/HTTP 端口映射与反向代理",
      "scenes": "内网穿透 / 端口映射",
      "fields": {
        "mode": {
          "label": "运行模式",
          "tip": "server=frps（有公网），client=frpc（内网侧）",
          "options": {
            "server": "server (frps 公网侧)",
            "client": "client (frpc 内网侧)"
          }
        },
        "bind_port": {
          "label": "绑定端口(server)"
        },
        "public_endpoint": {
          "label": "公网地址(server)"
        },
        "dashboard_port": {
          "label": "管理面板端口(server)"
        },
        "dashboard_user": {
          "label": "管理面板账号(server)"
        },
        "dashboard_password": {
          "label": "管理面板密码(server)",
          "tip": "留空时自动生成强随机密码；编辑时留空保持原密码"
        },
        "vhost_http_port": {
          "label": "HTTP 虚拟主机端口",
          "tip": "0 表示不启用；HTTP 代理需 >0"
        },
        "vhost_https_port": {
          "label": "HTTPS 虚拟主机端口",
          "tip": "0 表示不启用"
        },
        "allow_ports": {
          "label": "允许映射端口范围",
          "tip": "限制 frpc 可申请的 remotePort"
        },
        "server_addr": {
          "label": "frps 地址(client)"
        },
        "server_port": {
          "label": "frps 端口(client)"
        },
        "token": {
          "label": "认证 Token",
          "tip": "留空自动生成"
        },
        "proxy_name": {
          "label": "代理名称"
        },
        "proxy_type": {
          "label": "代理类型",
          "options": {
            "tcp": "TCP",
            "udp": "UDP",
            "http": "HTTP",
            "https": "HTTPS",
            "stcp": "STCP（安全点对点）",
            "xtcp": "XTCP（P2P）"
          }
        },
        "local_ip": {
          "label": "内网目标 IP"
        },
        "local_port": {
          "label": "内网目标端口"
        },
        "remote_port": {
          "label": "公网映射端口"
        },
        "custom_domains": {
          "label": "绑定域名",
          "tip": "HTTP/HTTPS 代理必填"
        },
        "secret_key": {
          "label": "STCP/XTCP 密钥",
          "tip": "访问端与提供端需一致"
        }
      }
    },
    "openvpn": {
      "name": "OpenVPN",
      "desc": "最成熟的开源 VPN，兼容各类老项目与系统",
      "scenes": "老项目兼容 / 通用接入",
      "fields": {
        "public_endpoint": {
          "label": "公网接入地址"
        },
        "port": {
          "label": "端口"
        },
        "proto": {
          "label": "传输协议",
          "tip": "可随时在编辑中切换；切换后需重启专线，客户端需重新下载配置",
          "options": {
            "udp": "UDP（推荐，性能更好）",
            "tcp-server": "TCP（穿透限制网络更稳）"
          }
        },
        "subnet": {
          "label": "VPN 网段",
          "tip": "如 10.8.0.0 255.255.240.0 可容纳更多客户端（/20）"
        },
        "cipher": {
          "label": "加密算法",
          "options": {
            "AES-256-GCM": "AES-256-GCM",
            "AES-128-GCM": "AES-128-GCM",
            "AES-256-CBC": "AES-256-CBC"
          }
        },
        "auth_mode": {
          "label": "认证方式",
          "tip": "密码模式对齐生产 verify-client-cert none + username-as-common-name",
          "options": {
            "certificate": "仅证书",
            "password": "用户名 + 密码",
            "certificate+password": "证书 + 密码",
            "oidc": "第三方 OAuth2 / OIDC（飞书登录）"
          }
        },
        "mfa_mode": {
          "label": "拨号 MFA (2FA)",
          "tip": "static-challenge + TOTP；在拨号用户页管理 OTP",
          "options": {
            "off": "关闭",
            "optional": "可选（用户绑定后才校验）",
            "required": "强制（所有拨号用户必须 MFA）"
          }
        },
        "otp_slop": {
          "label": "OTP 时钟容差(秒)"
        },
        "otp_max_failures": {
          "label": "OTP 失败锁定次数"
        },
        "otp_lockout_sec": {
          "label": "OTP 锁定时长(秒)"
        },
        "otp_disallow_reuse": {
          "label": "禁止重复使用同码"
        },
        "dns": {
          "label": "下发 DNS"
        },
        "redirect_gateway": {
          "label": "全流量代理",
          "tip": "关闭后仅推送下方内网路由（生产常只推指定路由）"
        },
        "push_routes": {
          "label": "推送路由",
          "tip": "IP 或 CIDR，每行一个；支持 # 注释",
          "placeholder": "# VPC 网段\n172.16.0.0/16\n# 预发环境\n43.129.24.233",
          "format_error": "路由格式无效：{route}"
        },
        "enable_nat": {
          "label": "启用 NAT 出网"
        },
        "max_clients": {
          "label": "最大客户端数",
          "tip": "0 不限制；生产常见 1000"
        },
        "keepalive_interval": {
          "label": "Keepalive 间隔",
          "tip": "生产常用 keepalive 5 30"
        },
        "keepalive_timeout": {
          "label": "Keepalive 超时"
        },
        "tun_mtu": {
          "label": "tun-mtu",
          "tip": "生产常用 1500"
        },
        "tun_mtu_extra": {
          "label": "tun-mtu-extra"
        },
        "mssfix": {
          "label": "mssfix",
          "tip": "0=不设置；TCP 生产常用 1450，选 TCP 时默认 1450"
        },
        "duplicate_cn": {
          "label": "允许 duplicate-cn",
          "tip": "同用户名/证书多终端同时在线；密码模式默认会自动开启"
        },
        "reneg_sec": {
          "label": "reneg-sec",
          "tip": "0=禁用 TLS 重协商（生产/MFA 推荐）；证书-only 默认可 3600"
        },
        "run_as_user": {
          "label": "降权用户",
          "tip": "对应 user openvpn；需系统已有该用户，留空不降权"
        },
        "run_as_group": {
          "label": "降权组",
          "tip": "对应 group openvpn"
        }
      }
    },
    "custom": {
      "fields": {
        "endpoint": {
          "label": "接入地址"
        },
        "token": {
          "label": "认证凭据"
        },
        "extra": {
          "label": "扩展参数(JSON)"
        }
      }
    }
  }
}