{
"pages": {
"me": "Account",
"clients": "Clients",
"admin": {
"panel": "Admin Panel",
"general": "General",
"config": "Config",
"interface": "Interface",
"warp": "WARP",
"obfuscatorPresets": "Obfuscator presets",
"hooks": "Hooks"
}
},
"user": {
"email": "E-Mail"
},
"me": {
"currentPassword": "Current Password",
"enable2fa": "Enable Two Factor Authentication",
"enable2faDesc": "Scan the QR code with your authenticator app or enter the key manually.",
"2faKey": "TOTP Key",
"2faCodeDesc": "Enter the code from your authenticator app.",
"disable2fa": "Disable Two Factor Authentication",
"disable2faDesc": "Enter your password to disable Two Factor Authentication."
},
"general": {
"name": "Name",
"username": "Username",
"password": "Password",
"newPassword": "New Password",
"updatePassword": "Update Password",
"mtu": "MTU",
"allowedIps": "Allowed IPs",
"dns": "DNS",
"persistentKeepalive": "Persistent Keepalive",
"logout": "Logout",
"continue": "Continue",
"host": "Host",
"yes": "Yes",
"no": "No",
"confirmPassword": "Confirm Password",
"loading": "Loading...",
"2fa": "Two Factor Authentication",
"2faCode": "TOTP Code"
},
"setup": {
"welcome": "Welcome to your first setup of PhobosWG",
"welcomeDesc": "You have found the easiest way to deploy a resilient WireGuard",
"existingSetup": "Do you have an existing setup?",
"createAdminDesc": "Please first enter an admin username and a strong secure password. This information will be used to log in to your administration panel.",
"setupConfigDesc": "Please enter the public hostname or address. It is used for display and TLS; clients connect via the obfuscator port.",
"setupMigrationDesc": "Please provide the backup file if you want to migrate your data from your previous wg-easy version to your new setup.",
"upload": "Upload",
"migration": "Restore the backup:",
"createAccount": "Create Account",
"successful": "Setup successful",
"hostDesc": "Public hostname or IP (e.g. for the web UI and certificates)",
"tls": {
"title": "HTTPS / TLS Certificate",
"desc": "Configure a TLS certificate to enable secure HTTPS access. Without HTTPS, login is blocked by default.",
"selfSigned": "Self-signed certificate",
"selfSignedDesc": "Generated instantly for your host. Browser will show a security warning — click Advanced → Proceed.",
"selfSignedHstsWarning": "If your browser blocks the page with an HSTS error and no 'Proceed' option, it has cached an HSTS policy from a previous certificate on this domain. Open the URL in a private/incognito window, or clear the HSTS entry at chrome://net-internals/#hsts (Delete domain).",
"import": "Import existing certificate",
"importDesc": "Paste your own PEM certificate and private key.",
"importPath": "Import certificate from file paths",
"importPathDesc": "Provide absolute paths to existing certificate and key files on disk (e.g. /etc/letsencrypt/live/example.com/*.pem). Files must be readable from inside the container.",
"certPathLabel": "Certificate file path (PEM fullchain)",
"keyPathLabel": "Private key file path (PEM)",
"importPathHint": "Files are symlinked, not copied. When the source files change on disk (e.g. after certbot renew), the server detects it within ~30s and restarts automatically to pick up the new certificate. The container has read-only access to the following host directories: /etc/letsencrypt (certbot), /root/cert (3x-ui), /root/.acme.sh (acme.sh).",
"skip": "Skip (no HTTPS)",
"skipDesc": "Stay on HTTP.",
"certLabel": "Certificate (PEM fullchain)",
"keyLabel": "Private key (PEM)",
"generate": "Generate certificate",
"apply": "Apply",
"restarting": "Certificate applied. Server is restarting with HTTPS...",
"redirectPrompt": "Open the secure version:",
"openLink": "Open HTTPS",
"skipWarning": "Without a TLS certificate the web interface is only accessible over HTTP.",
"errorCert": "Certificate validation failed",
"errorKey": "Private key validation failed"
}
},
"theme": {
"dark": "Dark theme",
"light": "Light theme",
"system": "System theme"
},
"layout": {
"toggleCharts": "Show/hide Charts",
"donate": "Donate"
},
"header": {},
"login": {
"signIn": "Sign In",
"rememberMe": "Remember me",
"rememberMeDesc": "Stay logged after closing the browser",
"2faRequired": "Two Factor Authentication is required",
"2faWrong": "Two Factor Authentication is wrong"
},
"client": {
"empty": "There are no clients yet.",
"newShort": "New",
"sort": "Sort",
"create": "Create Client",
"created": "Client created",
"new": "New Client",
"name": "Name",
"expireDate": "Expire Date",
"expireDateDesc": "Date the client will be disabled. Blank for permanent",
"delete": "Delete",
"deleteClient": "Delete Client",
"deleteDialog1": "Are you sure you want to delete",
"deleteDialog2": "This action cannot be undone.",
"enabled": "Enabled",
"address": "Address",
"serverAllowedIps": "Server Allowed IPs",
"copyInstallLink": "Copy install command",
"installLinkCopied": "Install command copied to clipboard",
"installLinkFailed": "Failed to generate install link",
"downloadPackage": "Download install package",
"permanent": "Permanent",
"createdOn": "Created on ",
"lastSeen": "Last seen on ",
"totalDownload": "Total Download: ",
"totalUpload": "Total Upload: ",
"newClient": "New Client",
"disableClient": "Disable Client",
"enableClient": "Enable Client",
"noPrivKey": "This client has no known private key. Cannot create Configuration.",
"showQR": "Show QR Code",
"allowedIpsDesc": "Which IPs will be routed through the VPN (overrides global config)",
"serverAllowedIpsDesc": "Which IPs the server will route to the client",
"mtuDesc": "Sets the maximum transmission unit (packet size) for the VPN tunnel",
"persistentKeepaliveDesc": "Sets the interval (in seconds) for keep-alive packets. 0 disables it",
"hooks": "Hooks",
"hooksDescription": "Hooks only work with wg-quick",
"hooksLeaveEmpty": "Only for wg-quick. Otherwise, leave it empty",
"dnsDesc": "DNS server clients will use (overrides global config)",
"notConnected": "Client not connected",
"endpoint": "Endpoint",
"endpointDesc": "IP of the client from which the WireGuard connection is established",
"search": "Search clients...",
"config": "Configuration",
"viewConfig": "View Configuration",
"firewallIps": "Firewall Allowed IPs",
"firewallIpsDesc": "Destination IPs/CIDRs this client can access (server-side enforcement). Leave empty to use Allowed IPs. Supports optional port and protocol filtering. See docs for syntax.",
"downloadPng": "Download PNG",
"copyLink": "Copy phobos:// link",
"linkShort": "Link",
"linkCopied": "phobos:// link copied to clipboard",
"linkFailed": "Failed to copy phobos:// link",
"preset": "Obfuscator preset",
"protocol": "Protocol",
"presetDesc": "Choose which obfuscator preset routes this client. A preset's protocol (WireGuard or SOCKS5) determines which fields below apply — e.g. the SOCKS5 login/password only appear for a SOCKS5-mode preset, since WireGuard doesn't use them. Leave on default to follow the server's default (WireGuard) preset.",
"presetUseDefault": "Use default preset",
"socks5Login": "SOCKS5 login",
"socks5Password": "SOCKS5 password",
"socks5CredentialsHint": "Enter this login and password in the client's own SOCKS5 application settings (browser, curl, etc.) — the obfuscator itself only encrypts the traffic, it does not store or check these credentials.",
"socks5ConfigNote": "This client uses a SOCKS5-mode preset, so the config below is a SOCKS5 obfuscator client block, not WireGuard. Configure the SOCKS5 login/password shown on this client's page in your SOCKS5 application itself.",
"nameHint": "Latin letters, digits, hyphen, dot and {'@'} only; up to 32 characters; must be unique.",
"nameError": {
"tooLong": "Name must not exceed {max} characters.",
"invalidChars": "Only Latin letters, digits, hyphen, dot and {'@'} are allowed (no spaces or other special characters).",
"duplicate": "A client with this name already exists."
}
},
"dialog": {
"change": "Change",
"cancel": "Cancel",
"create": "Create",
"delete": "Delete"
},
"toast": {
"success": "Success",
"saved": "Saved",
"error": "Error",
"unknown": "Unknown error. See console for more details"
},
"form": {
"actions": "Actions",
"save": "Save",
"revert": "Revert",
"sectionGeneral": "General",
"sectionAdvanced": "Advanced",
"noItems": "No items",
"nullNoItems": "No items. Using global config",
"add": "Add"
},
"admin": {
"general": {
"sessionTimeout": "Session Timeout",
"sessionTimeoutDesc": "Session duration for Remember Me (seconds)",
"metrics": "Metrics",
"metricsPassword": "Password",
"metricsPasswordDesc": "Bearer password for the metrics endpoint. Leave blank to keep the current password.",
"metricsPasswordSet": "Password is set — leave blank to keep it",
"metricsPasswordUnset": "No password set",
"json": "JSON",
"jsonDesc": "Route for metrics in JSON format",
"prometheus": "Prometheus",
"prometheusDesc": "Route for Prometheus metrics"
},
"config": {
"connection": "Connection",
"hostDesc": "Public hostname or IP (invalidates client-related config)",
"allowedIpsDesc": "Allowed IPs clients will use (global config)",
"dnsDesc": "DNS server clients will use (global config)",
"mtuDesc": "MTU clients will use (only for new clients)",
"persistentKeepaliveDesc": "Interval in seconds to send keepalives to the server. 0 = disabled (only for new clients)"
},
"tls": {
"title": "TLS Certificate",
"desc": "Replace the active HTTPS certificate or switch to plain HTTP.",
"current": "Active certificate",
"apply": "Apply TLS configuration",
"applied": "TLS configuration applied. Server is restarting.",
"appliedRestart": "TLS configuration applied. Server is restarting; reopen {url} in a few seconds.",
"externalManaged": "TLS is managed by an external reverse proxy (TLS_TERMINATION=external). The certificate must be issued and rotated outside of PhobosWG.",
"origin": {
"self-signed": "Self-signed",
"imported": "Imported (inline PEM)",
"imported-path": "Imported from path (symlinked, auto-reloaded)",
"none": "None (HTTP)"
}
},
"interface": {
"cidrSuccess": "Changed CIDR",
"device": "Device",
"deviceDesc": "Ethernet device the wireguard traffic should be forwarded through",
"mtuDesc": "MTU WireGuard will use",
"changeCidr": "Change CIDR",
"restart": "Restart Interface",
"restartDesc": "Restart the WireGuard interface",
"restartWarn": "Are you sure to restart the interface? This will disconnect all clients.",
"restartSuccess": "Interface restarted",
"subnet": "WireGuard subnet",
"ipv4Cidr": "WireGuard IPv4 subnet (CIDR)",
"ipv4CidrDesc": "Address pool for clients (e.g. 10.8.0.0/24). Widen the mask (e.g. /16) to allow more clients or different ranges. Changing it reassigns every client's IPv4 address.",
"ipv6Cidr": "WireGuard IPv6 subnet (CIDR)",
"ipv6CidrDesc": "IPv6 address pool for clients. Changing it reassigns every client's IPv6 address.",
"firewall": "Traffic Filtering",
"firewallEnabled": "Enable Per-Client Firewall",
"firewallEnabledDesc": "Restrict client traffic to specific destination IPs using iptables. When enabled, each client can be configured with allowed destinations.",
"publicAddress": "Public address",
"publicIpV4": "Server public IPv4",
"publicIpV4Desc": "Used as target in client obfuscator config.",
"publicIpV6": "Server public IPv6",
"publicIpV6Desc": "Optional IPv6 target.",
"publicDomain": "Server public domain",
"publicDomainDesc": "When set, used as obfuscator target in client config instead of IPv4/IPv6.",
"egress": "Egress",
"egressWarp": "Route client traffic through WARP",
"egressWarpDesc": "When enabled, clients exit via Cloudflare WARP instead of the server's WAN, hiding the server IP. Requires a registered WARP configuration. A lower client MTU may be needed."
},
"obfuscatorPresets": {
"title": "Obfuscator presets",
"desc": "Each preset runs its own wg-obfuscator listener with independent port, key and masking. The default preset is used by every client that has no explicit assignment. WireGuard presets use UDP ports 51822-51861, SOCKS5 presets use TCP ports 51862-51891 — the ranges published by docker-compose.",
"add": "Add preset",
"addDesc": "Enter a name only. Port, key and other parameters get sensible defaults and can be edited in the preset afterwards.",
"default": "default",
"setAsDefault": "Set as default",
"deleteConfirm": "Delete this preset? Clients using it will fall back to the default preset.",
"regenerateKey": "Regenerate key",
"regeneratePort": "Pick free port",
"nameLabel": "Name",
"nameDesc": "Display name of the preset. Used only in the panel.",
"modeLabel": "Protocol (mode)",
"modeDesc": "WireGuard: obfuscates the WireGuard UDP handshake. SOCKS5: runs a real SOCKS5 proxy (with optional RFC1929 login/password per client) tunneled over an obfuscated TCP link.",
"sourceLportLabel": "source-lport (external UDP port)",
"sourceLportLabelSocks5": "source-lport (external TCP port)",
"sourceLportDesc": "Public UDP port the server obfuscator listens on. Must be within 51822-51861 — the range published by docker-compose, otherwise clients cannot reach it.",
"sourceLportDescSocks5": "Public TCP port the SOCKS5 server listens on. Must be within 51862-51891 — the range published by docker-compose, otherwise clients cannot reach it.",
"targetLabel": "target",
"targetDesc": "Where the server obfuscator forwards decapsulated traffic. Leave empty to use the local WireGuard endpoint (127.0.0.1:[wg-port]). Format: host:port.",
"targetPlaceholder": "127.0.0.1:[wireguard port] (default)",
"sourceIfLabel": "source-if",
"sourceIfDesc": "IP of the interface the server obfuscator binds to. Default 0.0.0.0 (all interfaces).",
"keyLabel": "Obfuscation key (key)",
"keyDesc": "Shared obfuscation key, identical on both sides. Generated randomly (200-254 chars). 1-255 characters.",
"maskingLabel": "Masking mode (masking)",
"maskingDesc": "DPI-evasion mode. STUN: wraps traffic as STUN. MEDIA: masks as RTP/H.264 media, set explicitly on both sides. AUTO: server auto-detects, client uses STUN. NONE: masking off (XOR stays).",
"maskingDescSocks5": "DPI-evasion mode. STUN: wraps traffic as STUN. MEDIA: masks as RTP/H.264 media, set explicitly on both sides. TLS: masks as HTTPS records. NONE: masking off (XOR stays). AUTO is not available for SOCKS5 presets.",
"obfuscateBytesLabel": "obfuscate-bytes",
"obfuscateBytesDesc": "How many leading bytes to XOR. 0 = whole packet. >0 disables dummy padding. Must match on both sides. For MEDIA: 0 auto-applies 16, minimum 4.",
"dummyLabel": "Max dummy bytes (max-dummy)",
"dummyDesc": "Maximum random padding added per packet (0-1024). Default 40.",
"dummyDisabledNote": "Not used with MEDIA or when obfuscate-bytes > 0.",
"mediaSsrcDisabledNote": "Applies only with the MEDIA masking mode.",
"verboseLabel": "verbose (log level)",
"verboseDesc": "Log verbosity. error/warn/info/debug/trace. error is recommended in production; debug/trace heavily load the CPU.",
"clientLocalPortLabel": "Client-side WireGuard local port",
"clientLocalPortDesc": "Local UDP port the client WireGuard sends to (Endpoint 127.0.0.1:[port]) and the client obfuscator's source-lport. Default 13255.",
"clientLocalPortSocks5Label": "Client-side SOCKS5 local port",
"clientLocalPortSocks5Desc": "Local TCP port the client-side SOCKS5 obfuscator listens on. Point your app's SOCKS5 proxy setting at 127.0.0.1:[port]. Default 1080.",
"mediaSsrcLabel": "RTP SSRC (media-ssrc)",
"mediaSsrcDesc": "Fixed SSRC token used to reliably recognize MEDIA-masked frames on both sides. Auto-filled when MEDIA is selected; 0 = unset.",
"clientCount": "{n} client(s)"
},
"introText": "Welcome to the admin panel.\n\nHere you can manage general settings, configuration, the interface, obfuscator presets and the hooks.\n\nStart by choosing one of the sections in the sidebar.",
"warp": {
"title": "Cloudflare WARP",
"intro": "Register a free Cloudflare WARP account to use it as the egress for your clients. Clients will exit with a Cloudflare IP instead of the server IP.",
"register": "Get WARP",
"registerSuccess": "WARP registered",
"status": "Status",
"connection": "Connection",
"online": "Online",
"offline": "Offline",
"checkNow": "Check connection",
"checking": "Checking…",
"checkOnline": "WARP is online",
"checkOffline": "WARP is offline",
"deviceId": "Device ID",
"addressV4": "IPv4 address",
"addressV6": "IPv6 address",
"endpoint": "Endpoint",
"notActiveEgress": "WARP is not active as egress",
"notActiveEgressTip": "Enable \"Route client traffic through WARP\" in the Network interface section to use and test the WARP tunnel.",
"license": "WARP+ license",
"licenseKey": "License key",
"licenseKeyDesc": "Enter a WARP+ license key to enable WARP+.",
"licenseSet": "License is set",
"licenseUnset": "No license",
"applyLicense": "Apply license",
"licenseSuccess": "License applied",
"autoRotate": "Automatic IP rotation",
"intervalDays": "Interval (days)",
"intervalDaysDesc": "0 to disable. Rotates the WARP IP automatically.",
"changeIp": "Change IP",
"changeIpSuccess": "WARP IP changed",
"delete": "Delete WARP",
"deleteSuccess": "WARP configuration deleted",
"importConfig": "Edit Config",
"importTitle": "Manual WARP Configuration",
"importDesc": "Paste a WireGuard config. The system will test the connection — if a handshake is established, the configuration will be saved. Table, PostUp and PostDown are managed automatically and should not be included.",
"importApply": "Apply",
"importSuccess": "WARP configuration applied"
}
},
"zod": {
"generic": {
"required": "{0} is required",
"validNumber": "{0} must be a valid number",
"validNumberRange": "{0} must be a valid number or number range",
"validString": "{0} must be a valid string",
"validBoolean": "{0} must be a valid boolean",
"validArray": "{0} must be a valid array",
"stringMin": "{0} must be at least {1} Character",
"numberMin": "{0} must be at least {1}"
},
"client": {
"id": "Client ID",
"name": "Name",
"expiresAt": "Expires At",
"address4": "IPv4 Address",
"address6": "IPv6 Address",
"serverAllowedIps": "Server Allowed IPs",
"firewallIps": "Firewall Allowed IPs",
"firewallIpsInvalid": "Invalid firewall IP entry. See docs for supported syntax.",
"presetId": "Obfuscator preset ID",
"nameTooLong": "Client name must not exceed 32 characters.",
"nameInvalidChars": "Client name may contain only Latin letters, digits, hyphen, dot and {'@'} (no spaces or other special characters)."
},
"obfuscatorPreset": {
"id": "Obfuscator preset ID",
"name": "Preset name",
"mode": "Protocol",
"extPort": "External port (WireGuard/UDP 51822-51861, SOCKS5/TCP 51862-51891)",
"key": "Obfuscator key",
"masking": "Masking mode",
"maskingAutoSocks5": "AUTO masking is not available for SOCKS5-mode presets",
"maskingTlsWireguard": "TLS masking is only available for SOCKS5-mode presets",
"sourceIf": "Listen interface (IP)",
"target": "Target must be host:port",
"obfuscateBytes": "Obfuscate bytes (0-1024)",
"obfuscateBytesMedia": "For MEDIA the minimum is 4 (or 0 for the default 16)",
"verbose": "Log level",
"idle": "Idle timeout",
"dummy": "Max dummy bytes",
"clientWgLocalPort": "Client-side WireGuard local port",
"mediaSsrc": "RTP SSRC",
"clientLocalPort": "Client-side local port (1-65535)"
},
"user": {
"username": "Username",
"password": "Password",
"remember": "Remember",
"name": "Name",
"email": "Email",
"emailInvalid": "Email must be a valid email",
"passwordMatch": "Passwords must match",
"totpEnable": "TOTP Enable",
"totpEnableTrue": "TOTP Enable must be true",
"totpCode": "TOTP Code"
},
"userConfig": {
"host": "Host"
},
"general": {
"sessionTimeout": "Session Timeout",
"metricsEnabled": "Metrics",
"metricsPassword": "Metrics Password"
},
"interface": {
"cidr": "CIDR",
"device": "Device",
"cidrValid": "CIDR must be valid",
"egressMode": "Egress mode",
"domainValid": "Domain must be a valid hostname"
},
"installLink": {
"token": "Install token"
},
"obfuscator": {
"extPort": "Obfuscator external port",
"key": "Obfuscator key",
"masking": "Masking mode",
"idle": "Obfuscator idle timeout",
"dummy": "Max dummy bytes",
"publicIpV4": "Server public IPv4",
"publicIpV6": "Server public IPv6"
},
"stringMalformed": "String is malformed",
"body": "Body must be a valid object",
"hook": "Hook",
"enabled": "Enabled",
"mtu": "MTU",
"persistentKeepalive": "Persistent Keepalive",
"address": "IP Address",
"dns": "DNS",
"allowedIps": "Allowed IPs",
"file": "File",
"warp": {
"key": "WireGuard key",
"endpoint": "Endpoint (host:port)",
"addressV4": "IPv4 address",
"addressV6": "IPv6 address",
"license": "WARP+ license key (min 26 chars)",
"interval": "Update interval (days)"
}
},
"hooks": {
"preUp": "PreUp",
"postUp": "PostUp",
"preDown": "PreDown",
"postDown": "PostDown"
},
"copy": {
"notSupported": "Copy is not supported",
"copied": "Copied!",
"failed": "Copy failed",
"copy": "Copy",
"copyConfig": "Click to copy config to clipboard"
}
}