xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-08-25 12:27:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
7a595cb46d05ee4cc6a66996fad8b7093b26a770
3x-ui/internal/web/translation/es-ES.json
T
Kuzz007 effcccceac feat(amneziawg): add native AmneziaWG protocol support (#6105) 
* feat(amneziawg): add native AmneziaWG protocol backend

AmneziaWG (WireGuard plus DPI-resistant obfuscation) needs no Docker
here — it runs as a genuine kernel interface via awg-quick/awg, managed
the same way internal/mtproto manages mtg: one Inbound row is one
desired Instance, and a Manager reconciles running interfaces toward
the database every 10s (internal/web/job/amneziawg_job.go) plus
immediately after a client edit (applyLocalAmneziaWG).

Clients reuse model.Client verbatim (the same PrivateKey/PublicKey/
PreSharedKey/AllowedIPs fields WireGuard already uses), so bulk
operations, the QR/share-link modal and subscriptions come from the
shared inbound infrastructure instead of a parallel implementation.
internal/amneziawg owns the obfuscation param generator/validator
(ported from coinman-dev/3ax-ui, upgraded to AmneziaWG 2.0's S3/S4
padding and I1 signature packet) and the exec wrapper around
awg-quick/awg, with fingerprint-based reconcile (noop / reload-via-
syncconf / full restart) mirroring mtproto.Manager so a same-protocol
edit doesn't force an unnecessary interface bounce that would drop
every peer's connection.

Frontend and install.sh's DKMS/awg-tools setup are tracked separately;
this is backend-only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): add frontend support and fix a Go->Zod generator gap

Wires the amneziawg protocol through the panel UI the same way every
other protocol is registered: a Zod settings schema (nested
{server, clients}, matching the Go JSON exactly), the protocol enum,
the inbound-form's per-protocol fields component and its
tab-visibility allowlist, the default-settings factory, the client
schema dispatcher, and the sniffing-capability exclusion (no Xray
inbound exists for amneziawg, same as mtproto).

Client key/allowedIPs fields are reused rather than duplicated: since
AmneziaWG clients are wire-identical to WireGuard clients (same
model.Client fields), ClientFormModal renders one shared field block
for both, switching only the visible label by which protocol is
active. The private-key input also gets a live public-key sync via a
new useEffect, because unlike WireGuard's Xray-native inbound (which
re-derives its public key at runtime and never stores one),
AmneziaWG's server.publicKey is a real persisted field the Go backend
reads directly — free-typing a new private key without this would
silently save a mismatched keypair.

Adds a downloadable per-client .conf (amneziawgConfig.ts, mirroring
wireguardConfig.ts) with the obfuscation lines, and an
InboundOption.AwgServer field on the Go side so the config builder
gets the full server block in one round trip.

Along the way, running tools/openapigen surfaced a real bug: it
doesn't flatten anonymously-embedded Go structs the way encoding/json
does, so ServerSettings embedding Obfuscation20 produced a Zod schema
with a nested `obfuscation20` key that never matches the real wire
JSON. Fixed by un-embedding (flat fields + an accessor method) and
registering internal/amneziawg in the generator's own package list,
which had been silently emitting a dangling schema reference.

English and Russian translations are complete; the other 10 locale
files still fall back to English for the new keys.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): complete frontend parity for the Inbounds list page

The Clients page (form, CRUD, QR/config) already worked from the
prior commit; this closes the remaining gap on the Inbounds side and
in a couple of protocol allowlists that a plain search for existing
wireguard/mtproto handling turned up.

lib/xray/inbound-link.ts gets amneziawg-specific link/config builders
(genAmneziaWGLink/genAmneziaWGConfig, plus the *s fan-out variants)
mirroring the wireguard ones — AmneziaWG has no legacy peers-array to
fall back to, so these read settings.clients directly and add the
obfuscation lines every client must share with the server. Wired into
genInboundLinks generically, and into three consumers that call the
wireguard builders directly rather than through that dispatcher:
QrCodeModal, InboundInfoModal, and InboundsPage's bulk export.

ClientInfoModal, ClientBulkAddModal, and the bulk attach/detach modals
each had their own protocol allowlist that needed amneziawg added
alongside wireguard/mtproto.

Two real gaps surfaced by grepping every remaining 'wireguard' /
Protocols.WIREGUARD hit in frontend/src rather than trusting the
checklist was exhaustive:
- useInbounds.ts's TRACKED_PROTOCOLS gates the deactive/depleted/
  expiring/online client counts shown per inbound on the list page;
  without amneziawg those counts would silently read zero.
- inbound-tag.ts is an explicit client-side mirror of the Go backend's
  port_conflict.go (the file says so itself: "Keep in sync"). It still
  only special-cased wireguard for UDP, so an amneziawg inbound would
  have fallen through to the TCP default and disagreed with the
  backend's own port-conflict math.

Also finishes translating the AmneziaWG UI strings into the 11 locale
files that were still falling back to English (ar-EG, es-ES, fa-IR,
id-ID, ja-JP, pt-BR, tr-TR, uk-UA, vi-VN, zh-CN, zh-TW), matching
en-US/ru-RU key-for-key (26 new keys, verified by count in every file).

Not run anywhere: npm run typecheck / build. This machine has neither
Node nor npm, so nothing here has compiled — reviewed by hand plus
brace/paren balance checks and cross-referencing the generated Zod/TS
types. Treat this as needing a real typecheck before shipping.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(install): note that AmneziaWG kernel module install is still manual

Tracked separately (not yet ported into this script) — see
coinman-dev/3ax-ui's install_amneziawg for the reference approach
(ppa:amnezia/ppa). Also serves as a real, path-filter-matching change
to get the previous empty commit's CI trigger to actually fire —
release.yml's push trigger is paths-scoped and an empty commit changes
no files, so it never matched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): add a button to randomize obfuscation parameters

Mirrors the existing key-regenerate button next to the private key
field. Client-side randomization matches the ranges/constraints of
GenerateObfuscation20's "default" preset (internal/amneziawg/params.go)
closely enough for a form suggestion — the user can still hand-edit any
field afterward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(install): auto-install the AmneziaWG DKMS module + amneziawg-tools

Ports install_amneziawg from coinman-dev/3ax-ui's install.sh, adapted to
this script's broader distro coverage and NONINTERACTIVE convention:

- Ubuntu/Debian/Armbian: ppa:amnezia/ppa (primary, tested path), with a
  reachability pre-check for the Launchpad PPA host — often blocked by
  hosting providers, especially Russian VPS — so a flaky network skips
  the feature instead of hanging apt through several retries.
- Fedora/RHEL-family, Arch/Manjaro/Parch: best-effort fallback to plain
  wireguard-tools (+ AUR amneziawg-dkms via yay/paru when available),
  with a manual-install pointer.
- Everything else: manual-install pointer only.

Also installs ndppd and persists IPv4/IPv6 forwarding (for the future
IPv6/NDP phase, not yet wired into the panel) and adds a Secure Boot
warning at the end of the run, since a DKMS-built module is unsigned
and won't load while it's enabled — a common trap on cloud VPS images.

Never fatal: the panel installs and runs fine either way, an AmneziaWG
inbound just won't bring up its tunnel until the module is present.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): resolve all 3 real CI failures (typecheck/lint/codegen)

Found by checking the fork's Actions tab after the last two pushes —
the release build passed (it doesn't run these checks) but the
separate CI workflow caught three real issues:

- golangci-lint (noctx): every internal/amneziawg/manager.go exec.Command
  call is now exec.CommandContext with a 30s timeout, so a hung
  awg-quick/awg invocation can't block the reconcile job indefinitely
  (mirrors internal/mtproto/process.go's own CommandContext usage).
- tsc --noEmit: frontend/src/schemas/client.ts's hand-maintained
  InboundOptionSchema (used by the useClients hook, separate from the
  auto-generated one in generated/) never got an awgServer field added
  when the AmneziaWG frontend work was done — every read of
  inbound.awgServer.* in amneziawgConfig.ts was typing as {}. Added
  AwgServerOptionSchema, nested (not flattened like wg*) to match what
  amneziawgConfig.ts already expects. Also guarded server.publicKey in
  inbound-link.ts's genAmneziaWGLink against the schema's optional type.
- codegen staleness: frontend/public/openapi.json is produced by a Node
  script (gen:api) this machine can't run; hand-applied the exact diff
  the CI failure log already showed (amneziawg protocol enum entry,
  ServerSettings schema, InboundOption.awgServer, one example payload),
  verified as valid JSON.

Also confirmed independently by this run: install_amneziawg (previous
commit) installed and loaded the DKMS module successfully on both amd64
and arm64 CI runners. The two "Deploy Smoke Tests" failures are
unrelated to this change — this fork has only ever published the
dev-latest pre-release, and GitHub's /releases/latest API deliberately
excludes pre-releases, so the smoke test's no-argument install path
(which resolves "latest") has nothing to find. Not a regression; needs
an actual tagged release whenever that's wanted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): Phase 2a — IPv6 support + NDP proxy

Adds native dual-stack IPv6 to AmneziaWG inbounds, ported from
coinman-dev/3ax-ui's approach:

- ServerSettings gets ipv6Enabled/ipv6Subnet/ipv6ExternalInterface;
  Instance carries the server's own IPv6 address (first host of the
  subnet) alongside its IPv4 one.
- defaultAmneziaWGClients allocates an IPv6 host address per client
  (second AllowedIPs entry) when the server has IPv6 enabled, reusing
  allocateWireguardAddress — which needed a real fix along the way: it
  always suffixed "/32" regardless of address family, which is wrong
  for an IPv6 host address (needs /128). Now family-aware.
- generateServerConfig's PostUp/PostDown gains IPv6 forward-accept
  rules, proxy_ndp sysctl, and one `ip -6 neigh add/del proxy` entry per
  enabled peer with an IPv6 address — the lightweight per-client
  method, not the ndppd-daemon whole-subnet method (not worth the
  config-file-management complexity at this scale; ndppd itself is
  still installed by install.sh in case that changes later).
- ValidateIPv6Subnet rejects a malformed subnet before save.
- Frontend: ipv6Enabled/ipv6Subnet/ipv6ExternalInterface fields on the
  AmneziaWG inbound form, EN+RU translations, openapi.json/generated/*
  regenerated (the latter via `go run ./tools/openapigen`, pure Go).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): fill in IPv6 fields missed by the Phase 2a commit

Two real gaps the CI caught (both new fields, both my miss):

- inbound-defaults.ts's createDefaultAmneziawgInboundSettings() built a
  server object literal predating ipv6Enabled/ipv6Subnet/
  ipv6ExternalInterface — AmneziawgServer's inferred type now requires
  them (zod .default() fields are non-optional post-parse), so this
  didn't typecheck at all.
- openapi.json's ipv6Enabled property was missing the description the
  real generator attaches (the Go doc comment covering all three IPv6
  fields is attached to the first one) — a one-line diff, but git
  diff --exit-code doesn't care how small.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): Phase 2b — per-client port-forwarding

Admins can now set a per-client ForwardedPorts string (e.g. "80, 443,
8000-8100") that gets DNAT'd + FORWARD'd to that peer's tunnel address
via iptables rules in PostUp/PostDown, ported and simplified from
coinman-dev/3ax-ui's shared/portfwd.

Two decisions worth flagging for future readers:

- The iptables --comment tag on each rule is awg-fwd-<fnv32a(email)>,
  not the raw client email. Email is admin/API-supplied free text that
  ends up embedded in a shell-executed PostUp/PostDown line; a hash
  can never carry a shell metacharacter through where raw
  interpolation could.
- The reconcile manager gained a third fingerprint (portFwdFP, next to
  the existing structural/peers ones). `awg syncconf` only touches the
  WireGuard peer table — it never re-applies PostUp/PostDown iptables
  rules — so a port-forward-only change has to force a full
  awg-quick down+up bounce, same as a structural change, rather than
  the lighter sync a plain peer add/remove can use.

Also fixes a real pre-existing bug found while wiring up IPv6 client
allocation in the previous commit's spirit: allocateWireguardAddress
always suffixed "/32" regardless of address family, which produced
invalid host bits for IPv6 (needs "/128").

ForwardedPorts flows through model.Client -> model.ClientRecord
(gorm column wg_forwarded_ports, auto-migrated) -> ToRecord/ToClient/
MergeClientRecord, mirroring the awgServer field's earlier lesson
that new fields need checking against a second, hand-maintained
persistence-layer struct.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): route a client's traffic through Xray via the Routing page

Every enabled AmneziaWG inbound gets its own Xray TPROXY bridge
automatically, with no toggle to enable first: a loopback
dokodemo-door inbound (sockopt.tproxy) tagged with the AmneziaWG
inbound's own real tag, so it's already selectable in the existing
Routing page's inbound-tag picker — the same trick the mtproto
sidecar's own bridge already relies on (InboundService.GetInboundTags
is a plain, protocol-blind SELECT over every inbound row's tag, no
dedicated UI plumbing needed).

internal/amneziawg's defaultPostUpDown TPROXYs every peer's traffic
into that bridge unconditionally; the bridge's port is derived
deterministically from the inbound's id (EgressPortForInbound) so the
kernel-side reconcile loop and the Xray-config generator never need to
negotiate a runtime value between them.

injectAmneziawgEgress never generates a routing rule itself — whether
a client's traffic goes anywhere beyond Xray's default routing is
entirely up to whatever rules the admin adds through the existing
Routing UI (pick the AmneziaWG inbound's tag as source, optionally a
specific peer's IP via that page's own Source-IP field, and an
outbound), exactly the same workflow as routing any other protocol.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): recover orphaned interfaces after an ungraceful exit

Two gaps left an AmneziaWG interface stuck outside the manager's
control after a crash (kill -9/OOM/panic skips StopAll):

- ensureRestart's teardown was gated on the in-memory `exists` map,
  which is always empty on a fresh process, so a survived interface
  never got interfaceDown before interfaceUp tried `ip link add`
  against a name the kernel already had — failing forever and never
  populating m.ifaces, so traffic accounting silently stopped and the
  inbound could never be removed. Gate on isInterfaceUp instead, which
  checks real kernel state rather than this process's own bookkeeping.

- An inbound deleted from the database entirely while the panel was
  down has no entry in `desired` ever again, so it never reaches the
  per-id cleanup loop in Reconcile (which only walks m.ifaces). Add a
  one-time sweepOrphansLocked scan of configDir, mirroring
  mtproto.Manager.sweepOrphansLocked, that tears down and removes any
  leftover interface/config not in the current desired set.

Found by the automated review on MHSanaei/3x-ui#6105 (Finding 1).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* i18n(amneziawg): backfill IPv6/obfuscation/port-forwarding keys in 11 locales

Only en-US/ru-RU ever got these 9 keys as each AmneziaWG feature landed
(the regenerate-obfuscation button, then Phase 2a's IPv6 fields, then
Phase 2b's per-client ForwardedPorts) — the other 11 locale files were
never backfilled, so i18next has been silently falling back to English
for all of them since Phase 1. Cosmetic-only (never broke anything),
but now closed for every shipped locale.

* fix(amneziawg): resolve 7 Medium findings from the automated PR review

Each is independently reproducible; fixed together since one review pass
found all of them.

- manager.go: the shared "ip rule add fwmark" policy route had no
  existence check, so it duplicated in "ip rule show" on every interface
  bounce (which hostRulesFingerprint forces on any client add/remove/
  re-IP). Now checked via "ip rule list | grep -q ..." first. (Finding 2)

- params.go: ExternalInterface, IPv6ExternalInterface, and subnetIp/
  subnetCidr are interpolated unescaped into a shell-executed PostUp/
  PostDown line, but only obfuscation and the IPv6 subnet were validated
  before save. Added ValidateInterfaceName (a strict charset+length
  pattern) and ValidateSubnetIPv4 (netip.ParsePrefix), wired into
  normalizeAmneziaWGSettings. (Finding 3)

- amneziawg_job.go: IsAwgInstalled() existed but nothing ever called it,
  so a host without awg/awg-quick (the Docker image, RHEL, Arch, a failed
  install.sh PPA step) logged a reconcile failure every 10s forever. Now
  checked once an inbound actually needs it, warning once instead of
  spamming. (Finding 4)

- client_inbound_apply.go: the WireGuard/AmneziaWG credential
  carry-forward (added so a metadata-only client edit doesn't rotate
  keys) never covered ForwardedPorts, so a partial edit -- an API call or
  Telegram-bot toggle that omits the field -- silently wiped a client's
  port-forwarding spec. Carried forward and written back the same way the
  key fields already are. (Finding 5)

- manager.go: hostRulesFingerprint keyed each peer on its IPv4 address
  only, and structuralFingerprint omitted IPv6Enabled/IPv6ExternalInterface
  entirely, so an IPv6-only change could pick the syncconf reload path
  (which never re-runs PostUp, leaving a stale NDP-proxy entry) or be a
  complete no-op. Both fingerprints now cover the IPv6 fields. (Finding 6)

- port_conflict.go: the AmneziaWG egress bridge (injectAmneziawgEgress)
  binds 127.0.0.1:63100+id with no collision check anywhere, since it
  isn't a database row the ordinary port-conflict query can see -- same
  blind spot the reserved Xray API port already has its own check for.
  Added the equivalent check for the AmneziaWG bridge port. (Finding 7)

- install.sh: install_amneziawg ran unconditionally for every install/
  update, building a DKMS kernel module and enabling host-wide IPv4/IPv6
  forwarding whether or not the feature is ever used. Gated behind a new
  should_install_amneziawg (XUI_INSTALL_AMNEZIAWG=true/false, or an
  interactive y/N prompt defaulting to no). Also replaced the deprecated
  apt-key adv with a dedicated keyring + signed-by= on the Debian branch,
  and guarded its sources.list appends against duplication on a retried
  install. (Finding 8)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): make the Xray TPROXY bridge a per-inbound opt-in

Addresses Finding 10 from the automated PR review: an always-on TPROXY
bridge makes every AmneziaWG tunnel hard-depend on Xray being up (all
traffic, including DNS, drops whenever Xray restarts), and forces a full
awg-quick down+up bounce on any client add/remove/re-IP, permanently
losing the syncconf fast path.

Adds ServerSettings.RouteThroughXray (off by default):

- defaultPostUpDown only emits the TPROXY/policy-route rules when it's
  on; a plain AmneziaWG tunnel now has zero Xray dependency out of the
  box.
- structuralFingerprint covers it (toggling it changes whether PostUp/
  PostDown contain any TPROXY rules at all -- structural, not a
  per-peer host-rule). hostRulesFingerprint's IPv4 tracking is now
  itself conditional on RouteThroughXray (and IPv6 tracking on
  IPv6Enabled), so an instance that never uses either keeps the
  syncconf fast path for a plain peer re-IP.
- injectAmneziawgEgress only creates a bridge for inbounds that opted
  in; checkAmneziawgEgressConflict (the Finding-7 fix) now parses each
  candidate through InstanceFromInbound so a non-routed inbound's port
  is correctly never treated as reserved.
- New inbound-level Switch in the AmneziaWG form; the actual outbound
  decision is still made entirely through the panel's stock Routing
  page, same as before -- only whether the bridge exists at all is now
  a choice.

Translation keys added to all 13 locales in the same commit this time,
not backfilled later (see Finding 9's lesson).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): resolve 4 Low findings from the automated PR review

- manager.go: serverAddress assumed subnetIp always ends in ".0"; a
  base like "10.8.1.5" was used verbatim as the server's own address,
  eventually colliding with peer allocation (which starts at .2
  upward). Now derives the first host of the actual subnetIp/subnetCidr
  network via netip, matching serverAddressV6's own approach. A /32
  base (no host bits at all) is still used as-is. (Finding 12, partial
  -- the /16 pool-widening half of this finding only exists on the
  upstream-pr/amneziawg branch's merged client_wireguard.go, not here;
  handled separately on that branch.)

- manager.go: ensureLocked carried the previous per-peer traffic
  counters (`last`) forward even through a full restart, but
  awg-quick down+up resets the kernel's own counters to zero -- the
  next CollectTraffic computed a large negative delta (clamped to 0),
  silently discarding real traffic. Extracted the decision into
  nextTrafficBaseline: only a reload (syncconf) preserves the
  baseline. (Finding 13)

- portfwd.go: exported ForwardedPortsInclude; inbound_amneziawg.go's
  new checkForwardedPortsConflict uses it to reject, at save time, a
  client's forwardedPorts that would DNAT the panel's own port or
  another enabled inbound's port to the tunnel client --
  portForwardLines has no destination restriction, so this collision
  was previously silent. Wired into both the single-client update path
  and the add-client path (client_inbound_apply.go), plus
  normalizeAmneziaWGSettings for the whole-inbound save path. (Finding 14)

- inbound.go: InboundOption.AwgServer sent the whole ServerSettings
  struct including PrivateKey to GetInboundOptions callers -- a
  shared, admin-wide dropdown-filling endpoint the frontend's own
  AwgServerOptionSchema never reads that field from. Redacted it
  before assigning. (Finding 11)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): don't widen the peer address pool past AmneziaWG's own subnet

Completes Finding 12 from the automated PR review (the serverAddress half
of this finding was already fixed on main and cherry-picked here). This
half is specific to this branch: allocateWireguardAddress's /16
pool-widening fallback is an independent addition from upstream's own
main that this branch inherited during the cherry-pick rebase -- it
doesn't exist on the fork's own main at all, so this fix can't be
cherry-picked the normal way and is committed directly here.

Widening is safe for WireGuard's own Xray-native inbound (AllowedIPs
isn't tied to a strict kernel interface subnet), but AmneziaWG's kernel
interface Address is exactly the configured subnet -- an address
allocated from the containing /16 once the /24 fills up would be
silently unroutable. allocateWireguardAddress now takes an explicit
allowWidening bool: WireGuard's own caller passes true (unchanged
behavior), AmneziaWG's passes false (fails loudly on exhaustion instead).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(docker): note that AmneziaWG doesn't work in this image

Investigated: the image is Alpine-based, and AmneziaWG's own packaging
(DKMS module + amneziawg-tools) doesn't target Alpine/musl at all --
unlike the Debian/Ubuntu/Fedora/Arch paths install.sh already handles,
there's no package to apk add even with full host network/capabilities.
The panel already degrades gracefully (IsAwgInstalled() logs one warning
instead of retrying forever), so no code change is needed -- just made
the reason explicit at the point where a user would reach for cap_add/
network_mode to try to work around it.

* fix(sub): include amneziawg inbounds in subscription links

getInboundsBySubId's SQL protocol allowlist never had 'amneziawg' added,
so every AmneziaWG client was silently excluded from all three
subscription formats (plain/individual links, JSON, Clash) and from the
Telegram bot's QR/individual-link buttons, which fetch through the same
path. genAmneziaWGLink itself was already fully implemented and already
wired into GetLink's dispatch switch -- it just never got a chance to
run. Same bug shape as the earlier TRACKED_PROTOCOLS frontend gap: a
hardcoded protocol list one entry short.

Found while investigating whether the Telegram bot needed AmneziaWG-
specific client-management code -- it doesn't (the bot itself is fully
protocol-agnostic), but this is the actual root cause of "can't share
an AmneziaWG client's config via the bot."

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(inbound): enforce node-eligibility server-side, not just in the UI

Investigated multi-node interaction with AmneziaWG: the master's own
reconcile (DesiredAmneziaWGInstances) and Xray config generation
(injectAmneziawgEgress, the GenXrayInboundConfig protocol skip) all
correctly filter on NodeID IS NULL, so a node-assigned AmneziaWG (or
MTProto) inbound would never be managed by the master. But nothing
stopped one from being created that way: NODE_ELIGIBLE_PROTOCOLS
(frontend/src/pages/inbounds/form/InboundFormModal.tsx) only hides the
node picker client-side -- a direct API call could set nodeId on an
AmneziaWG inbound, which every node then reconciles as an ordinary
local inbound (nodes run the identical binary, full cron suite
included), leaving it running unmanaged and untracked by the master's
own AmneziaWG bookkeeping.

Added isNodeEligibleProtocol (inbound_protocol.go), mirroring the
frontend's allowlist, and enforced it in both AddInbound (the actually
exploitable path -- nodeId comes straight from the request) and
UpdateInbound (defense in depth; NodeID is already restored from the
stored row there before this check, so it mainly guards against a
protocol change on an existing node-hosted inbound).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): allow TPROXY-marked traffic through a default-deny INPUT chain

TPROXY never rewrites a packet's own destination address, only the routing
decision. A default-deny firewall whose INPUT chain sanity-checks "is this
destination actually local" (UFW's ufw-not-local, via addrtype --dst-type
LOCAL, is a concrete example) silently drops the redirected packet before
Xray's socket ever sees it -- RouteThroughXray looked fully configured
(TPROXY rule present and counting, Xray listening with IP_TRANSPARENT set)
yet every peer's traffic vanished with no trace on either side.

Adds an idempotent, never-torn-down "iptables -I INPUT 1 -m mark --mark
<fwmark> -j ACCEPT" alongside the existing shared policy route, so this
works regardless of which firewall manager owns the rest of the INPUT chain.

* fix(frontend): give AmneziaWG the same UDP tag and its own tag color

The Inbounds list only special-cased isWireguard/isHysteria for the "UDP"
network badge, so an AmneziaWG row showed just the bare protocol tag with
no transport badge next to it. Added the missing isAmneziawg flag (mirrors
isWireguard exactly) and wired it into the same branch.

Client-row protocol-color maps in ClientsPage/HostList had no amneziawg
entry, silently falling back to grey -- ClientInfoModal already had
amneziawg: 'yellow' from earlier work, these two just never got it.

* feat(logs): show which AmneziaWG client an access-log line belongs to

The dokodemo-door TPROXY bridge every AmneziaWG peer's traffic is routed
through has no per-user identity, so Xray's own access log never carries an
"email:" token for these lines -- the Access Logs modal showed a blank
Email column for every in-*-udp row, even though every other protocol's
rows show the client normally.

The peer's decapsulated tunnel IP does survive as the log's "from" address,
and that IP deterministically maps to exactly one configured peer. Builds a
"<inbound tag>|<ip>" -> email index from the same AmneziaWG inbounds already
parsed elsewhere (amneziawg.InstanceFromInbound), and fills in Email from it
whenever the raw log line didn't have one.

* fix(amneziawg): enable sniffing on the TPROXY bridge

Domain-based Routing rules could never match RouteThroughXray traffic: an
AmneziaWG peer resolves DNS itself, through the tunnel, before ever sending
a packet, so the decapsulated traffic TPROXY hands to the bridge is already
a bare destination IP with no domain name attached at the network layer.
Every other inbound recovers this via sniffing (confirmed working for the
stock wireguard inbound, which does have it configured); the bridge never
got a sniffing block at all, so only tag/IP/network-based rules could ever
match it -- any domain rule above it in the list was silently unreachable.

* docs: add an AmneziaWG config page and list it as a supported protocol

Closes the PR checklist gap: the feature shipped with zero mention on
the docs site. Mirrors reality.mdx's structure (key settings, setup
steps, config excerpt) and notes the Docker/multi-node/Telegram-bot
caveats the PR itself is honest about not having confirmed.

* fix: address the fresh review round on PR #6105 (8 findings)

1. hostRulesFingerprint didn't account for ForwardedPorts when
   RouteThroughXray was off, so re-IPing a peer with port-forwarding
   configured left stale DNAT rules pointing at an address the next
   peer could be handed.
2. Server/client config values (keys, email, I1) were never validated
   for control characters before being written into the generated
   .conf; a newline could smuggle a PostUp hook into awg-quick's
   parser. Added ValidateConfigValue at save time and a
   sanitizeConfigValue backstop at render time.
3. checkForwardedPortsConflict didn't scope to node_id IS NULL, so a
   port used only on a different node produced a false collision; also
   hoisted the panel-port/inbounds lookup out of the per-client loop
   (portConflictContext) so N clients cost one query, not N.
4. PostDown commands were ";"-joined and abort on the first failure;
   appendOrTrue makes teardown best-effort so an external firewall
   flush can't leave DNAT rules to accumulate across bounces.
5. The "ip rule list | grep -q" existence check could SIGPIPE under
   pipefail and re-add a duplicate rule; switched to grep -c >/dev/null.
6. Ported the vpn:// share-link format (base64url of the plain .conf
   text, matching the real AmneziaVPN app) onto this branch -- it had
   only ever landed on our own fork's main, so this PR branch was still
   on the old amneziawg://+query-params scheme our own docs no longer
   described. Also corrected the docs' install.sh claim (opt-in/
   interactive, not automatic) and stale pre-opt-in comments in
   route_egress.go.
7. install.sh: Arch's ndppd install used pacman -Syu (full system
   upgrade) instead of -Sy like every other call in the script; and
   should_install_amneziawg re-prompted on every `x-ui update` even
   when awg was already installed.
8. CollectTraffic could clobber a concurrent restart's freshly-reset
   (empty) traffic baseline with stale pre-restart counters, since
   getPeerStats runs lock-free; now checks pointer identity before
   writing back. sweepOrphansLocked permanently disabled itself on a
   transient os.ReadDir failure instead of allowing a retry.

go build/vet/test and frontend typecheck/lint/build/vitest all pass.

* fix(install.sh): check the live sysctl value, not sysctl.conf text

Reviewer feedback (cherts, PR #6105): grepping /etc/sysctl.conf for the
setting name is unreliable -- many distros split sysctl config across
/etc/sysctl.d/*.conf, and /etc/sysctl.conf can be a symlink into that
directory, so the check can miss an already-active setting (harmless
duplicate append) or match a disabled/commented line (forwarding
silently stays off). Query the live value via `sysctl -n` instead,
which is accurate regardless of which file set it. Applied the same
fix to both the IPv6 and IPv4 checks for consistency.

* fix: update inbound_amneziawg.go to the split buildInboundForLocalRuntime

Same fork-only-file blind spot as the one caught on our own main after
the 3.6.0 sync: upstream split buildRuntimeInboundForAPI into
buildInboundForNodePush / buildInboundForLocalRuntime (part of the
node-sync client-deletion fix, 5bc81dfd), updating every call site it
could see. This file doesn't exist upstream, so it kept calling the
old name even after the branch merged in that commit.

* fix(frontend): recognize AmneziaWG's vpn:// scheme in share-link labels

The shared link-tag/label helper (used by the client info modal, QR
modal, and subscription page) had no entry for the vpn:// scheme
AmneziaWG links use, so it fell through to the generic fallback: a
plain "Vpn" tag with no color, and an empty remark/port that made the
row's title fall back to "Link N" instead of the inbound's actual
name:port — unlike every other protocol, which shows its real tag and
label.

vpn:// links are base64url of a plain .conf text (matching the real
AmneziaVPN app's own share-link format), not a structured URL, so
there's no query string or #hash to read a remark/port from. Decode
the payload and pull the remark/endpoint back out of the .conf text
directly instead.

* fix(xray): force a full restart for TPROXY inbounds, never hot-add them

Real incident: an AmneziaWG inbound with RouteThroughXray enabled lost
all internet on that connection after a migration. Root-caused on the
live box -- iptables TPROXY counters were incrementing (packets
correctly redirected to 127.0.0.1:63110), but nothing was actually
listening there (ss showed nothing on that port) until a full
`systemctl restart x-ui`, after which the bridge came up immediately.

Xray-core's gRPC AddInbound reports success for a new sockopt.tproxy
inbound (internal/amneziawg's own Xray egress bridge is the only kind
this fork ever generates) but doesn't reliably bind a working listener
for it outside of process startup -- the bridge silently never comes
up, and RouteThroughXray traffic goes nowhere until the next full
restart happens to occur for an unrelated reason.

diffInbounds already has this exact defensive pattern for REALITY
inbounds ("a gRPC remove+add does not reliably rebuild the REALITY
authenticator"), just never extended to TPROXY, and only in the
already-existing-then-changed branch -- the "brand new inbound" branch
had no such guard at all, which is exactly the path a freshly-enabled
RouteThroughXray bridge takes. Added inboundUsesTproxy and wired it
into both branches.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): flag Xray for resync when a peer edit changes qualifying state

Real production bug, root-caused on iiadmin-vps: updateAmneziaWGInbound/
AddInbound/DelInbound only ever updated the kernel interface via
amneziawg.GetManager() -- they never called SetNeedRestart the way every
other protocol's mutation path does (client_crud.go, inbound.go, etc. all
do). injectAmneziawgEgress's TPROXY bridge inbound depends on
InstanceFromInbound finding at least one qualifying peer plus
RouteThroughXray, so an edit that flips that (first peer added, last one
removed, RouteThroughXray toggled on) previously required a full panel
restart before the bridge actually got created, with no error anywhere:
the kernel interface would handshake fine, but traffic redirected into the
bridge's TPROXY port went nowhere because nothing was listening there.

diffInbounds/inboundUsesTproxy already correctly force a full restart for
a brand new TPROXY inbound (bdee0a20) -- that part was never the bug. The
gap was entirely upstream: nothing ever told Xray a resync was even needed.

* fix(clients): reject AllowedIPs already used on another WireGuard/AmneziaWG inbound

defaultWireguardClients/defaultAmneziaWGClients only ever checked uniqueness
against their own inbound's client list, so two inbounds sharing a subnet
(same protocol or not) could silently hand out or accept the same address --
the exact scenario behind a real duplicate-IP incident where a WireGuard and
an AmneziaWG client both ended up on the same address. otherTunnelAllowedIPs
now collects every address already claimed on every other tunnel inbound and
folds it into both the auto-allocation pool and the manual-entry collision
check, naming the other inbound in the error when it fires.

* fix(frontend): add the missing AmneziaWG config download on the sub page

The subscription page already gave WireGuard links their own "Config"
block (copy/download/QR of the actual .conf, via wireguardConfigFromLink
reversing the wireguard:// query params) but had no equivalent for
AmneziaWG's vpn:// links -- its isWireguardLink gate never matched them,
and no reverse-parse helper existed for this page specifically. Every
other surface (InboundInfoModal, ClientInfoModal, ClientQrModal) already
had this parity; this was the one page that didn't.

Fixed by adding amneziawgConfigFromLink (inbound-link.ts), simpler than
its WireGuard counterpart since a vpn:// payload already *is* the plain
.conf text -- just base64url-decode it, no query-param reconstruction
needed -- and wiring it into SubPage.tsx alongside the existing WireGuard
block, reusing the same pages.clients.amneziaWgConfig label the other
three surfaces already use.

* fix(xray): force a full restart for password-auth SOCKS5 hot-apply

Real production incident: editing a client under an AmneziaWG inbound
left its embedded SOCKS5 relay's settings byte-different (a new account
list), and Xray's gRPC remove+add hot swap silently dropped the account
for a peer whose email contained non-ASCII characters -- its tunnel kept
handshaking fine but all its traffic got rejected at the SOCKS5 layer,
while every other peer on the same relay was unaffected. A full restart
(reading the same JSON straight from disk) always produced the correct
account list. socks isn't in userDiffableProtocols (that only covers
vless/vmess/trojan's clients+email shape, not accounts+user), so any
settings drift on this inbound fell through to the generic remove+add
path. Forces a restart instead, the same defensive choice already made
for REALITY and TPROXY -- scoped to auth:"password" specifically so the
other, noauth SOCKS5 bridges (panel/node/mtproto egress) keep the cheaper
hot path.

* Fix Attach reusing one identity's address across wg/awg inbounds

ClientService.Attach deliberately copies one identity's stored
AllowedIPs into every WireGuard/AmneziaWG inbound it's attached to
in the same call, so the same person gets the same tunnel address
on every protocol they use. Its loop calls addInboundClient once per
inbound, and each of those independently computes
otherTunnelAllowedIPs -- so by the second inbound in the batch, the
first inbound's just-written copy of this identity's own address
looked like a cross-inbound collision against itself.

Real production symptom this caused: detaching then re-attaching a
client to both wg and awg failed with "wireguard: allowedIPs entry
X is already used by a client on inbound 'awg' (#N)" -- the exact
address the identity is supposed to keep, rejected as if it belonged
to someone else.

Add a selfEmails exclusion to otherTunnelAllowedIPs and populate it
from the client(s) being processed at the one real call site. Safe
unconditionally: ClientRecord.Email is globally unique, so a match
can only ever be this same identity's own entry on a sibling inbound,
never a genuine different client's address.

Reproduced the underlying mechanism live (manual entry correctly
rejected as a cross-inbound collision; fresh auto-allocation
correctly avoided a used address) before writing the fix, to confirm
the guard itself works and the bug is specifically in how Attach's
per-inbound calls interact with it.

* Attach: allocate fresh when re-attaching with no active tunnel

The previous fix (82cc69f5) made Attach's own address-reuse
correctly not collide with itself across inbounds -- but it still
always reused an identity's stored AllowedIPs verbatim, even when
that identity currently has zero WireGuard/AmneziaWG attachments at
all. A real report from testing this live: an identity fully
detached from both its wg and awg inbounds, then re-attached, got
its old address back even though several lower addresses were free
-- because nothing about being fully detached ever cleared the
stored value Attach copies from.

Add hasTunnelAttachment, checked once against the identity's CURRENT
inbound set before Attach's loop runs: if none of its current
inbounds is WireGuard/AmneziaWG, clear the stored AllowedIPs so this
attach allocates fresh (matching what a brand-new client would get)
instead of resurrecting an address nothing reserves anymore. Left
alone when the identity already has an active tunnel elsewhere, so
extending it to a second protocol still keeps a consistent address.

* Fix TestOtherTunnelAllowedIPsExcludesSelfEmail's own test setup

CI caught this: the "genuinely different client" (other@wg) was
seeded onto the SAME inbound passed as excludeID, which
otherTunnelAllowedIPs already excludes entirely regardless of the
selfEmails fix -- so the assertion that its address is still
reported could never have passed, proving nothing either way. Move
it onto the sibling inbound alongside shared@id, which is what the
test actually needs to exercise (two clients on one sibling, one
excluded by email, one not).

* Attach: never inherit an address that doesn't fit the target inbound

hasTunnelAttachment (from the earlier fix, commit 51067f16) only
asked "does this identity have ANY tunnel attachment", treating that
as license to reuse its stored address verbatim on every inbound
being attached. Real production case this missed: an identity's
stored address came from WireGuard's own fallback subnet
(10.0.0.0/24, used when that inbound has no other clients to infer a
base from), then got attached to a second, AmneziaWG inbound
configured for a completely different subnet (10.8.1.0/24).
defaultAmneziaWGClients's already-set-AllowedIPs branch only checks
for collisions, never subnet membership, so the mismatched address
was accepted silently -- producing a peer that can never actually
connect, since an AmneziaWG address must fall inside the kernel
interface's own configured subnet to be routable at all.

Add addressesFitAmneziaWGInbound, checked per inbound inside Attach's
loop: if the inherited address doesn't fit the SPECIFIC inbound being
attached, clear it just for that one so it gets a fresh, valid
allocation instead, while other already-attached inbounds keep their
existing values. WireGuard has no equivalent strict subnet
requirement (allocateWireguardAddress can widen to a fallback pool
for it), so this only ever constrains AmneziaWG targets.

* Give WireGuard an explicit, admin-configurable subnet field

WireGuard previously had no configurable subnet at all -- only an
implicit one, either inferred from existing clients' own addresses
(wireguardAllocationBase) or a hardcoded 10.0.0.0/24 fallback when
none exist yet. AmneziaWG, by contrast, has always had a real
server.subnetIp/subnetCidr field in its settings, editable in the
UI. User request: give WireGuard the same treatment.

Backend: explicitWireguardSubnetBase reads an optional subnetIp/
subnetCidr pair from the inbound's own settings JSON (mirroring
AmneziaWG's defaultAmneziaWGSubnetBases). defaultWireguardClients
checks it first; only when unset does it fall back to today's
inference-from-existing-clients behavior, so an inbound saved before
this field existed keeps working exactly as it always has.

Frontend: subnetIp/subnetCidr added to WireguardInboundSettingsSchema
and the inbound form (mirroring AmneziaWG's own field layout/labels),
with a real default (10.0.0.0/24, the same value the backend already
fell back to) seeded for newly created inbounds so the field starts
populated and editable rather than blank. Translated across all 13
locales.

This also structurally closes the class of bug fixed in
82cc69f5/291c47b3: with wg and awg subnets explicit and
independently controllable, an admin who wants matching addresses
across both protocols can configure them to actually agree, instead
of one silently inheriting the other's incompatible range.

* Split the client edit form's AllowedIPs into per-protocol fields

A client attached to both WireGuard and AmneziaWG shared one AllowedIPs
form field with a dynamically-switching label, so its two genuinely
different addresses could never both be shown or edited correctly.
Worse, Update/Create broadcast that one shared value to every attached
wg/awg inbound with no subnet-fit check, so an ordinary edit save could
silently overwrite one protocol's address with the other's -- the same
bug class already fixed for Attach, but reachable from any client edit.

model.Client gains an optional AllowedIPsByInbound map so a caller can
send distinct values per inbound; Update/Create honor it and, when it's
absent, clear a shared value that doesn't fit an AmneziaWG inbound's own
subnet instead of writing it through. A new TunnelAllowedIPsByInbound
read path feeds the real per-inbound address to the client edit form via
GET, which now renders two separate, correctly-labeled fields whenever
both protocols are attached (unchanged single dynamic field otherwise).

* Regenerate openapi.json for the new allowedIPsByInbound field

Follow-up to 878ee839: gen:zod (frontend/src/generated) was already
regenerated and committed, but gen:api (frontend/public/openapi.json)
wasn't, so CI's codegen drift check failed.

* Fix build breakage from merging upstream main: Update() gained a limitHwid param

Two of our own AllowedIPs tests (not present upstream, so the merge never
flagged them as conflicting) still called the old 3-arg Update(inboundSvc,
id, client) -- upstream's hardware-ID-limit feature added a required
limitHwid parameter that every other caller in this package already
passes. Also drop createDefaultInboundSettings from InboundsPage.tsx: the
merge conflict resolution kept the import, but upstream's clone-payload
refactor (buildClonePayload, inbound-clone.ts) already calls it
internally now -- this file doesn't need it directly anymore.

* Fix real bug: AmneziaWG clients rejected as "empty client ID" in 3 places

Three switch statements on inbound.Protocol handle "wireguard" explicitly
(checking client.PublicKey) but fall through to the default case for
"amneziawg" (checking client.ID, which AmneziaWG clients never set --
they use PublicKey/Email like WireGuard, not the VMess/VLESS UUID field).
This is what the 4 AllowedIPs tests were actually catching:
UpdateInboundClient's newClientId derivation hit this same default branch,
so every Update() on an AmneziaWG client returned "empty client ID"
before ever reaching the AllowedIPs logic being tested.

Fixed by adding "amneziawg" alongside "wireguard" in each switch:
addInboundClient's per-client validation, UpdateInboundClient's
newClientId derivation, and AddInbound's per-client validation (the
third one wasn't hit by these tests, but has the identical bug -- creating
a brand-new AmneziaWG inbound with a client attached would fail the
same way).

* refactor(amneziawg): rename Obfuscation20 to Obfuscation31, drop the dead mobile preset

Mechanical rename ahead of the AmneziaWG 3.1 parameter work: the type,
generator and prose all said 2.0, and the "mobile" generator preset was
reachable only from its own test. No behavior change.

* feat(amneziawg): AmneziaWG 3.1 obfuscation parameters (backend + generated schemas)

Adds the 3.1 parameter surface to the inbound settings and both Go config
emitters: I2-I5 signature packets, HeaderProtectionKey (base64 32-byte,
shared server<->client), ContentPaddingAddition, the five handshake-timing
randomization ranges (RekeyAfterTime/RekeyTimeout/RejectAfterTime/
KeepaliveTimeout/MaxHandshakeAttempts), and the RandomTrailers/
DisableCookies switches. Freshly generated sets fill everything except
I2-I5 (matching Amnezia's own generator) with jittered ranges bracketing
WireGuard's stock timing constants; every reject window starts >= 30s
above the rekey window by construction. Empty fields stay off the wire,
so blanking a field disables just that feature.

Validation generalizes the H1-H4 range checker for the new uint32-range
fields, requires min 1 on timers, cross-checks rekey-vs-reject, and
demands a real 32-byte base64 header-protection key. The manager warns
once per process when the installed awg tools predate 3.1 but an inbound
uses 3.1 parameters (awg-quick rejects unknown keys with a generic
error otherwise); apply still proceeds.

Requires amneziawg-tools v3.1.20260812+ / module or amneziawg-go
v3.1.20260814+ on the host.

* feat(amneziawg): emit and randomize 3.1 parameters in the frontend

Both client-config emitters (the vpn:// link builder and the clients-page
.conf builder) now carry the 3.1 [Interface] lines in the same order as
the Go emitters. The obfuscation randomizer moves out of InboundFormModal
into a shared lib/xray/amneziawg-obfuscation.ts that also fills the new
fields, and createDefaultAmneziawgInboundSettings switches from static
values to that generator — a fresh inbound now really gets the unique
fingerprint the docs promise instead of the same jc=5/jmin=10 set on
every install.

Schema parse-time defaults for the new fields stay ''/false on purpose:
real values come only from the generator, so resaving an inbound never
mutates its stored parameters. A new parity test pins the hand-written
AmneziawgServerSchema to the generated ServerSettings key set, so a field
added on one side can no longer silently vanish from configs.

* feat(amneziawg): 3.1 form fields and translations

Inbound form gains inputs for I2-I5, HeaderProtectionKey (filled by the
existing obfuscation Regenerate button), ContentPaddingAddition, the five
timing ranges, and the RandomTrailers/DisableCookies switches; the MTU
input picks up the min=1 its schema already enforced. All 13 locales get
the 19 new keys and drop the "2.0" branding from the s3/s4/i1 labels.

* docs(amneziawg): document 3.1 parameters; install.sh kernel/version notes

The AmneziaWG page's obfuscation section moves from the 2.0 to the 3.1
parameter set: table rows for I2-I5, HeaderProtectionKey,
ContentPaddingAddition, the timing-randomization ranges and the
RandomTrailers/DisableCookies switches, a requirements callout (tools
v3.1.20260812+, module/awg-go v3.1.20260814+, Linux 6.7+ for the DKMS
path), and a sample client .conf that matches what the panel actually
emits (including the DNS defaults and PersistentKeepalive it always had).

install.sh warns before a DKMS build on a pre-6.7 kernel and after any
install that left pre-3.1 amneziawg-tools on PATH.

Also updates the hosts API operation paths ({id} -> {groupId}) in the
stale ru/zh/fa reference pages: syncing docs/public/openapi.json for the
new AmneziaWG schema fields surfaced that rename, which had never been
copied over, and the docs build fails on paths missing from the spec.

* fix(amneziawg): reject control characters and canonicalize 3.1 range values

Adversarial review of the 3.1 work surfaced a validation gap:
base64.DecodeString silently ignores CR/LF, so a header-protection key
that picked up a line wrap in transit decoded to a valid 32 bytes,
passed validation, and was emitted verbatim into every client config —
where the orphan second line breaks the import while the server (whose
emitter strips control chars) keeps running with the correct key. The
key and range validators now reject control characters outright.

Also from the same review: range values are canonicalized on save
("110 - 140" -> "110-140", whitespace-only collapses to feature-off,
closing a case where the server conf rendered an invalid blank-value
line the client emitters omitted); the rekey/reject invariant is now
enforced against WireGuard's 120s/180s defaults when only one side is
set; and the structural fingerprint joins on "\n" instead of "|",
which is a legal I1-I5 character and made adjacent free-text fields
join-ambiguous.

* fix(install): resolve latest release tag via web redirect to dodge API rate limits

The non-interactive install smoke test resolved the release version through
the unauthenticated GitHub API (api.github.com/.../releases/latest), which
allows only 60 requests/hour per IP. The test installs twice in one run, and
on shared CI runner IPs the second call gets rate-limited, returns no
tag_name, and install.sh treats an empty version as fatal (exit 1) — the same
"Failed to fetch x-ui version" real users hit behind CGNAT/shared addresses.

resolve_latest_tag() now reads the tag from the github.com releases/latest
web redirect (not subject to the API rate limit), falling back to the API
only if the redirect yields nothing. Verified with the real
deploy/test/smoke-noninteractive.sh (two installs, both green).

* fix(amneziawg): three review findings on #6105, plus a comment trim

1. A peer's allowedIPs reached the generated .conf unvalidated and
   unsanitized, unlike email/publicKey/preSharedKey which
   normalizeAmneziaWGSettings already guards. A newline in an entry let a
   following "[Interface]" re-open the interface section, whose "PostUp = ..."
   awg-quick then runs as root on the next apply. Reproduced end to end
   against generateServerConfig. The save path now rejects and canonicalizes
   through normalizeWireguardAllowedIPs, and the render path sanitizes as a
   backstop for rows predating the validation (an upgrade, a restored backup,
   a direct DB edit). H1-H4 get the same render-time sanitize, and the two NIC
   name fields a plausibility check, since stripping control characters alone
   would still let a shell metacharacter into a root-executed PostUp line.

2. EgressPortForInbound is 63100 + inbound id, so an id past 2435 derives a
   port above 65535 -- and Xray rejects the whole generated config over one
   invalid port, taking every other protocol down with it. It now reports
   ok=false past the range, and both the Xray bridge and its TPROXY rules are
   skipped instead of emitting an impossible port.

3. The downloadable AmneziaWG .conf read ClientRecord.allowedIPs, a single
   shared column that holds the WireGuard address for an identity attached to
   both protocols -- the exact ambiguity tunnelAllowedIPs was added to resolve
   for the edit form. The info and QR modals already hydrate that field, so
   they now pass this inbound's own address to the builder.

Also trims the comment blocks in the files touched here to the 2-line
guidance in CLAUDE.md: internal/amneziawg alone carried 423 comment lines in
over-long blocks against 118 for the comparable internal/mtproto, and is now
at 110. Every non-obvious constraint is kept (the kernel S1/S2 rule, why
PostDown is best-effort, why grep -c and not -q, why the fingerprints split
three ways); the narration is gone. Two hot_diff.go comments pointed at an
internal/amneziawgnet package and an injectAmneziawgnetSocks function that
exist nowhere in the tree; the checks themselves are unchanged.

* feat(logs): add an AmneziaWG log view to the overview

The overview has an access-log view for Xray but nothing for AmneziaWG, so
when a tunnel misbehaves there is no way to see it from the panel at all. A
kernel tunnel logs no per-request lines, so the equivalent view is built from
the two things it does expose:

- Live per-peer activity from `awg show <iface> dump`, joined to the client
  email through the desired peer set: last handshake, endpoint, allowed IPs,
  cumulative transfer and online state, newest handshake first.
- The panel's own AmneziaWG event lines (interface up/down, awg-quick
  failures, the pre-3.1 tools warning), which are what actually explain a peer
  being absent from the table.

POST /panel/api/server/amneziawglogs/:count serves both, with the same
count + filter contract GetXrayLogs uses, and the modal mirrors XrayLogModal's
toolbar, auto-update, mobile cards and download. The action-bar button is
gated on a new status.amneziawg.configured, which stays true while an inbound
exists but its interface is down -- exactly when the event lines matter.

Verified against a running panel: the endpoint returns the peer table and
real event lines ("awg/awg-quick not found on PATH", "create config dir:
permission denied"), and count and filter both narrow as documented.

One of those lines surfaced a Debugf that had been rendering as
"for inbound1:amneziawg:"; fixed here since it is now user-visible.

* fix(amneziawg): stop double-counting a routed inbound's traffic

injectAmneziawgEgress tags its Xray bridge with the AmneziaWG inbound's own
tag, so the stock Routing page can target it. Xray therefore reports that
bridge's bytes under the inbound's tag, and XrayTrafficJob feeds them to
AddTraffic -- which accumulates -- on top of the same bytes AmneziaWGJob
already reported from `awg show dump`. An inbound with routeThroughXray on
counted roughly twice its real traffic, which also inflates the quota checks
that read the same counters.

The awg counters are the complete measure: every peer, whether or not TPROXY
routed it, and the same wire bytes the per-client totals are built from, so
they stay and the Xray rows are dropped. Per-client stats were never affected
-- a dokodemo-door bridge has no per-user identity, so Xray emits no
user>>>email rows for it.

Filtering happens before every consumer, so the DB totals, the external
traffic inform and the dashboard's live speed all read one source per inbound.
The set of bridge tags now comes from a predicate shared with
injectAmneziawgEgress itself, with a test that pins the two together -- naming
one tag too few doubles the traffic again, one too many makes real traffic
vanish.

* fix(amneziawg): align the three .conf emitters on one peer field order

The panel builds an AmneziaWG client .conf in three independent places, and
they disagreed: buildAmneziaWGClientConfig put PresharedKey right after
PublicKey (wg-quick(8)'s own order, and what both WireGuard emitters on the
clients side already use), while genAmneziaWGConfig and the Go
amneziaWGConfigText put it after Endpoint. A user comparing a subscription
link against a downloaded .conf sees the difference immediately, and the
generators are exactly the kind of parallel implementation CLAUDE.md warns
about drifting.

Moves the two outliers onto the wg-quick order. Also drops the stray trailing
newline that only appeared when PersistentKeepalive was set, so a config now
always ends on its last set field whichever that is -- the same shape all
three emitters produce for the same client.

Parsing is unaffected either way (the format is order-insensitive, and the
AmneziaVPN app reads it as a flat key-value bag), so this changes only the
rendered text. Adds a test on each side that pins the peer block's field
order, since nothing previously asserted it.

* refactor(amneziawg): switch to the embedded amneziawg-go/gVisor architecture

Replaces the kernel-module (DKMS) + awg-quick + TPROXY backend with the
fork's own embedded design: amneziawg-go runs in-process over a userspace
gVisor netstack, and each peer's decapsulated traffic relays into its own
loopback Xray SOCKS5 inbound, so Xray's native stats/sniffing/routing work
for free instead of through hand-rolled bridges. No kernel module, no DKMS,
no Secure Boot conflicts, works the same in a container as on bare metal.

- internal/amneziawgnet: new package (Device/UAPI, gVisor netstack, TCP/UDP
  forwarding, SOCKS5 relay, peer identity, IPv6 host-alias egress identity,
  per-client port-forwarding) - amneziawg-go v3.1.20260814 + gvisor.
- internal/amneziawg: keep the reusable protocol-shape types/validation
  (Instance/Peer/Obfuscation, InstanceFromInbound); drop the OS-shellout
  half (awg-quick, TPROXY policy routing, NDP proxy, peer-stats parsing).
- internal/web/service: rewire the 5 integration points (job, runtime,
  client-apply, web shutdown, xray config) from the old manager to the new
  one; the AmneziaWG log view is rebuilt on the embedded Device's own UAPI
  dump (extended to carry endpoint/AllowedIPs) instead of `awg show dump`.
- install.sh: drop DKMS/ndppd/TPROXY/Secure-Boot installer code (~250
  lines) - an entire recurring class of installer fragility goes away.
- frontend: drop the now-meaningless routeThroughXray toggle (the relay is
  always on); keep the field in the Zod schema, unexposed, so it isn't
  silently stripped from stored settings on next save - two regression
  tests deliberately depend on the Go struct still carrying it.
- docs/i18n: rewrite amneziawg.mdx for the new architecture; drop the
  dead routeThroughXray translation keys across all 13 locales.

Real production throughput (embedded core datapath, isolated bench, same
box the kernel-module path was measured on): ~296 Mbit/s up, ~640 Mbit/s
down, vs. 414.69 MB/s (~3.3 Gbit/s) for the kernel module on the same
hardware - a real gap, tempered by this being single-stream/no-SOCKS5-hop
and most VPN traffic being latency-bound rather than throughput-saturating.

* fix(amneziawg): restore the branch's own Obfuscation31 shape + 2 CodeQL findings

The previous push's wholesale-copy of types.go/params.go from the fork's
main branch pulled in that branch's own independent (and incompatible)
naming for the same AWG 3.1 feature set: Obfuscation20/GenerateObfuscation20
instead of this branch's already-shipped Obfuscation31/GenerateObfuscation31,
and a missing CanonicalizeUintRange -- broke every Go CI job (the whole
matrix fails to compile when any one package doesn't, which is why govulncheck/
golangci/postgres-durable-first/race all failed identically, not just go-test).

Restores params.go/params_test.go verbatim from this branch's own last
commit (a strict superset of validation: it already cross-checks rekey vs.
reject timing windows, which the copied version never did) and folds the
3.0/3.1 fields (HeaderProtectionKey, ContentPaddingAddition, the 5 timing
fields, RandomTrailers/DisableCookies) into Obfuscation31 itself, matching
the original struct exactly instead of as separate top-level Instance
fields. instance.go, the two amneziawgnet call sites, and 7 amneziawgnet
test files updated to match. Also drops the one test (sanitizeConfigValue)
that only ever served the retired kernel-module .conf writer -- correctly
not ported, so the test testing it shouldn't have been copied either.

Also fixes 2 CodeQL findings the same push surfaced: a clamped uint64->int64
conversion for the new log view's live byte counters (server.go), and an
unneeded len+len sum feeding a slice pre-size in the v6-egress outbound
merge (xray.go) -- append already grows correctly without it.

* chore(amneziawg): regenerate frontend schemas for updated doc comments

npm run gen was missed after the previous commit's types.go doc-comment
edits (Obfuscation20 -> Obfuscation31, ValidateHeaderProtection ->
ValidateObfuscation in the prose) -- openapigen bakes those comments
into the generated schema's description field, so the committed
frontend/src/generated/schemas.ts and openapi.json still had the old
wording. codegen's git-diff-exit-code check caught it correctly.

* fix(amneziawg): narrow 2 test fixtures that collided with MaxForwardedPorts

TestCheckForwardedPortsConflict_CollidesWithEnabledInboundPort and
..._NoCollisionWhenPortsDontOverlap used "8000-8100"/"9000-9100" as their
ForwardedPorts fixture -- 101 ports each, one over MaxForwardedPorts (100).
The cap check (checkForwardedPortsConflict, added this session alongside
the SOCKS-phantom-port check) fires first, so both tests got "more than
100 forwarded ports" instead of ever reaching the collision logic they're
actually testing. The cap itself has its own dedicated boundary test
already; these two just needed a narrower range that still covers/misses
port 8080 as intended -- 8075-8085 and 9075-9085, 11 ports each.

* fix(amneziawg): checkAmneziawgnetSocksConflict had no receiver in its new home

My merge-conflict resolution kept this as a method call (s.checkAmneziawgnetSocksConflict)
inside checkPortConflictTx, a plain function with no *InboundService receiver --
upstream's #6225 fix moved the port-conflict check out of the (s *InboundService)
method and into this new tx-scoped free function, and I didn't notice the call
site needed to change shape too. CI caught it immediately (undefined: s); nothing
in this specific package can be locally verified past internal/database's own
unrelated, pre-existing CGO build issue on this dev machine.

Since the signature had to change either way, folded in the fix already flagged
as a separate follow-up: checkAmneziawgnetSocksConflict now takes the caller's
db handle instead of fetching its own via database.GetDB(), so it actually runs
inside the same serialized transaction #6225 introduced -- previously it sat
right next to that race fix without benefiting from it.

* fix: address the review findings on the embedded AmneziaWG PR

5 blocking findings:

- Floor S3/S4 at 12 in both obfuscation generators (Go and frontend) and
  reject a hand-edited value below that when HeaderProtectionKey is set --
  IpcSet requires it, and ~39% of previously-generated sets violated it
  silently.
- Guard PrivateKey/PrimaryDNS/SecondaryDNS/remark against newline injection
  in the AmneziaWG .conf builder (both the Go subscription-link path and
  the frontend downloadable-config path) -- unguarded, any of them could
  inject an arbitrary config line into a subscriber's client.
- Bound the derived AmneziaWG SOCKS relay port to <= 65535 once an
  inbound's id is known, and check the reverse direction (does the relay
  port collide with an existing inbound's port) on both create and update
  -- previously only port -> relay collisions were checked, not relay ->
  port.
- Gate injectAmneziawgV6Egress on the same V6AliasesActive predicate
  desiredV6Aliases already uses, so the two can't disagree about whether a
  peer's IPv6 identity is actually active at the OS level.

2 minor findings:

- Fix the forwarded-ports cap check's off-by-one (a spec covering exactly
  the cap was rejected as if it were over it).
- Correct docker-compose.yml's stale comment describing the retired
  DKMS/kernel-module architecture.

* chore: retrigger CI

build (armv5) failed on a transient Go module proxy network error
(INTERNAL_ERROR stream reset on sagernet/sing), unrelated to this PR's
changes.

* docs: fix doc comments still describing the retired DKMS/awg-quick design

A few doc comments (and one illustrative test log line) survived the
embedded-architecture cutover unchanged and now contradict the code
they sit next to:

- internal/amneziawg/types.go's package comment claimed this package
  still owns a Manager that reconciles OS-level interfaces via
  awg-quick/DKMS -- that Manager was removed; the reconcile loop lives
  in internal/amneziawgnet now, and this package is protocol-shape-only.
- internal/amneziawg/params.go's ValidateObfuscation/ValidateConfigValue
  comments cited "awg-quick up" / "awg-quick executes as root" as the
  reason to validate -- the server itself never calls awg-quick in this
  architecture; the same value still reaches a real rendered .conf that
  a client app or an admin's own awg-quick CLI applies downstream, so
  the validation is still warranted, just for a different consumer.
  Mirrored the same fix in inbound_amneziawg.go's matching comment and
  its test's comment.
- internal/amneziawgnet/manager.go's Manager doc comments (x3) pointed
  readers at "internal/amneziawg.Manager" for comparison -- that type no
  longer exists in this diff at all. Repointed at internal/mtproto.Manager,
  the pattern this was actually modeled on and the one that's still real.
- Swapped one test's illustrative "awg-quick up awg2 failed" log line for
  a message shaped like this architecture's actual amneziawgnet logging,
  so a reader skimming the test doesn't wonder whether the server still
  shells out to awg-quick.

No behavior change.

* fix(docs): re-run codegen for xray-settings.mdx after conflict merge

The automated conflict-resolution hand-merge for this generated file
was content-correct but didn't byte-match a real regen (different
YAML long-string folding style). Re-ran npm run gen + docs' gen:api
and kept that canonical output instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): drop the dead access-log email backfill

amneziawgEmailIndex keyed peers by "<tag>|<tunnel IP>", a scheme built
for the retired TPROXY bridge where the peer's decapsulated tunnel
address survived as the access log's from-address. The embedded
architecture relays through a loopback SOCKS5 dial, so every AmneziaWG
log line's from-address is 127.0.0.1:<ephemeral> and the lookup could
never match: the index was rebuilt on every log view just to miss.
Remove the index, its GetXrayLogs wiring and its test. If per-line
emails are wanted back, the relay would have to publish a
local-port->email registry for the viewer to resolve loopback sources.

* fix(api): generate AmneziaWGLogs/PeerActivity schemas instead of hand-writing them

The amneziawglogs endpoint's response structs were missing from
openapigen's StructAllow, so they were silently absent from every
generated schema/example, the endpoints.ts entry carried a hand-written
response, and AmneziaWGLogModal.tsx duplicated the shapes as local
interfaces - the exact drift the allowlist rule exists to prevent.
Allowlist both structs with example tags, point the endpoint at the
generated schema, import the generated types in the modal, and sync
docs/public/openapi.json.

* chore(amneziawg): drop the unreferenced quiccapture package

Nothing imports internal/amneziawg/quiccapture and no route exposes it;
its package doc justifies the code as a port of
frontend/src/lib/xray/i1Generators.ts, which does not exist in this
repository, and promises an API round-trip that also does not exist.
1,110 lines of unreachable code with misleading provenance claims.
Revert this commit to bring the package back when the live-capture I1
feature and its frontend counterpart actually land.

* fix(clients): re-run cross-inbound conflict checks on the serialized writer

The new client-level checks - cross-inbound AllowedIPs collisions and
AmneziaWG forwardedPorts conflicts - read a fresh DB snapshot, decide,
and only then enter runSerializedTx, while lockInbound only serializes
writers on the SAME inbound. Two concurrent client creates on two
different tunnel inbounds both passed the read and both committed,
yielding two peers with one address: the exact check-then-claim race
81cfd857 (#6225) closed for AddInbound, which this PR's own
checkAmneziawgnetSocksReverseConflict already cites. Keep the pre-tx
pass for fail-fast UX and re-validate inside the transaction, where the
single writer makes the answer authoritative. The race test drives two
goroutines at two inbounds and demands exactly one winner; it fails
with committed=2 when the in-tx re-check is removed.

* fix(amneziawg): hot-apply depletion disables like mtproto does

applyTrafficMutationBatch special-cases MTProto so a quota/expiry
depletion cuts the sidecar immediately, but AmneziaWG fell through to
runtime AddUser/RemoveUser - explicit no-ops for this protocol - so a
depleted peer kept tunneling until the next 10s reconcile tick. Route
it through applyLocalAmneziaWG, whose own contract (re-read committed
settings, filter depleted clients, push to the interface) is exactly
this case; the comment claiming it mirrors applyLocalMtproto is now
true for the depletion path too.

* fix(amneziawg): persist cleared DNS fields instead of resurrecting defaults

PrimaryDNS/SecondaryDNS marshaled with omitempty, so clearing them
persisted settings with no key at all - and the frontend re-parses
stored settings through a Zod schema whose .default('8.8.8.8') /
.default('8.8.4.4') fire on missing keys, silently repopulating the
form on every load and re-persisting the defaults on the next save.
Blank is a documented, meaningful state (no DNS line in client
configs); drop omitempty so a cleared value survives the round-trip.
The regression test normalizes a server block with cleared DNS and
fails when the keys are dropped.

* fix(amneziawg): accept cleared numeric obfuscation/subnet fields in the form

AntD InputNumber emits null when cleared, Zod .default() only replaces
undefined, and unlike wireguard.ts - whose optionalClearedInt comment
documents exactly this failure mode - the AmneziaWG schema declared
subnetCidr and jc/jmin/jmax/s1-s4 as bare z.number() defaults. Clearing
any of the eight fields made safeParse reject the null and block the
save until the user retyped a value. Absorb null into undefined while
keeping each field's schema default, so a cleared field refills its
documented default and legacy blobs with absent keys behave as before.

* fix(amneziawg): guard the third .conf emitter against newline injection

The review-round fix added the newline guard to amneziaWGConfigText (Go)
and buildAmneziaWGClientConfig, but genAmneziaWGConfig in inbound-link.ts
- the third of the three emitters its own comment says must not drift -
still rendered privateKey/primaryDns/secondaryDns/remark unescaped, so a
newline there injected a config line (e.g. a rogue PostUp) into the
inbound form's downloaded .conf. Add the same guard, plus the regression
tests the original fix shipped without: all four fields on the Go and
both frontend emitters go red if any guard is removed.

* test(amneziawg): pin the S3/S4 floors the TS drift guard claims to mirror

The test's docstring says it mirrors internal/amneziawg/params_test.go,
but it asserted S3>=8/S4>=4 while the Go test and both generators pin
12/12 - the floor ValidateObfuscation enforces whenever a header
protection key is set, which this generator always sets. A regression
narrowing the TS floors into 8-11/4-11 would have passed the drift
guard and produced configs the backend rejects on save.

* docs: restore the pia repo-map entry and document the AmneziaWG subsystem

Merging main dropped CLAUDE.md's internal/pia/ bullet (added by #6272)
while resolving the repo-map conflict - the package itself is untouched.
Restore it, add the missing map entries for the two packages this branch
introduces (internal/amneziawg/, internal/amneziawgnet/), bump the cron
count, and give amneziawg_job its row in architecture.md's 5.4 table.

* chore(amneziawg): correct comments stranded by the architecture pivot

ae77c7e9's cutover to the embedded gVisor path deleted the kernel-module
code but left several comments describing it in the present tense:
hot_diff.go cited the removed service.amneziawgEgressStreamSettings and
wrongly claimed AmneziaWG is the only sockopt.tproxy source (tunnel's
TProxy mode is the live one the guard protects), socks_config.go pointed
at the deleted EgressBasePort/EgressPortForInbound, manager.go referred
to the deleted Manager and its fingerprinting as live code, web.go's
cron registration claimed the job scrapes traffic (its own doc says it
does not), and types.go capped ContentPaddingAddition at uint16 when
validation and upstream both use uint32.

* style(lint): satisfy gofumpt/goimports so make verify is green

json_service.go's two 'Tag: "proxy"}' literals came in with main's own
cc245a90 formatting commit and fail the repo's gofumpt gate for everyone;
the import grouping in inbound_amneziawg.go is from the serialized-writer
fix on this branch.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
2026-08-24 02:41:15 +02:00

2253 lines
136 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"username": "Nombre de Usuario",
"password": "Contraseña",
"login": "Acceder",
"confirm": "Confirmar",
"cancel": "Cancelar",
"close": "Cerrar",
"save": "Guardar",
"logout": "Cerrar Sesión",
"create": "Crear",
"add": "Añadir",
"remove": "Quitar",
"update": "Actualizar",
"copy": "Copiar",
"copied": "Copiado",
"more": "más",
"download": "Descargar",
"regenerate": "Regenerar",
"jsonEditor": "Editor JSON",
"downloadImage": "Descargar imagen",
"sort": "Ordenar",
"remark": "Notas",
"enable": "Habilitar",
"protocol": "Protocolo",
"search": "Buscar",
"filter": "Filtrar",
"all": "Todos",
"from": "Desde",
"to": "Hasta",
"done": "Hecho",
"loading": "Cargando...",
"refresh": "Actualizar",
"clear": "Borrar",
"second": "Segundo",
"minute": "Minuto",
"hour": "Hora",
"day": "Día",
"check": "Verificar",
"indefinite": "Indefinido",
"unlimited": "Ilimitado",
"none": "Ninguno",
"qrCode": "Código QR",
"info": "Más Información",
"edit": "Editar",
"delete": "Eliminar",
"reset": "Restablecer",
"noData": "Sin datos",
"copySuccess": "Copiado exitosamente",
"sure": "Seguro",
"encryption": "Encriptación",
"transmission": "Transmisión",
"host": "Host",
"path": "Ruta",
"camouflage": "Ofuscación",
"status": "Estado",
"enabled": "Habilitado",
"disabled": "Deshabilitado",
"depleted": "Agotado",
"depletingSoon": "Agotándose",
"offline": "Sin conexión",
"online": "En línea",
"domainName": "Nombre de dominio",
"monitor": "Listening IP",
"certificate": "Certificado Digital",
"fail": "Falló",
"comment": "Comentario",
"success": "Éxito",
"lastOnline": "Última conexión",
"lastSubFetch": "Última descarga de suscripción",
"getVersion": "Obtener versión",
"install": "Instalar",
"clients": "Clientes",
"usage": "Uso",
"twoFactorCode": "Código",
"remained": "Restante",
"security": "Seguridad",
"emptyDnsDesc": "No hay servidores DNS añadidos.",
"emptyFakeDnsDesc": "No hay servidores Fake DNS añadidos.",
"emptyBalancersDesc": "No hay balanceadores añadidos.",
"somethingWentWrong": "Algo salió mal",
"subscription": {
"title": "Información de suscripción",
"subId": "ID de suscripción",
"status": "Estado",
"downloaded": "Descargado",
"uploaded": "Subido",
"expiry": "Caducidad",
"totalQuota": "Cuota total",
"individualLinks": "Enlaces individuales",
"active": "Activo",
"inactive": "Inactivo",
"unlimited": "Ilimitado",
"noExpiry": "Sin caducidad",
"copyAllConfigs": "Copiar Todas las Configuraciones",
"copyAllConfigsCopied": "Todas las configuraciones copiadas",
"email": "Email"
},
"menu": {
"theme": "Tema",
"dashboard": "Estado del Sistema",
"inbounds": "Entradas",
"clients": "Clientes",
"groups": "Grupos",
"nodes": "Nodos",
"settings": "Ajustes del panel",
"xray": "Configuración Xray",
"routing": "Enrutamiento",
"outbounds": "Salidas",
"apiDocs": "Documentación de la API",
"donate": "Donar",
"hosts": "Hosts",
"docs": "Documentación",
"openMenu": "Abrir menú",
"pinSidebar": "Fijar barra lateral",
"unpinSidebar": "Desfijar barra lateral",
"subFormats": "Sub Formats"
},
"pages": {
"login": {
"hello": "Hola",
"title": "Bienvenido",
"loginAgain": "El límite de tiempo de inicio de sesión ha expirado. Por favor, inicia sesión nuevamente.",
"toasts": {
"invalidFormData": "El formato de los datos de entrada es inválido.",
"emptyUsername": "Por favor ingresa el nombre de usuario.",
"emptyPassword": "Por favor ingresa la contraseña.",
"wrongUsernameOrPassword": "Nombre de usuario, contraseña o código de dos factores incorrecto.",
"successLogin": "Has iniciado sesión en tu cuenta correctamente."
}
},
"index": {
"cpu": "CPU",
"swap": "Swap",
"storage": "Almacenamiento",
"memory": "Memoria",
"xrayStatus": "Xray",
"stopXray": "Detener",
"restartXray": "Reiniciar",
"xraySwitch": "Versión",
"xrayUpdates": "Actualizaciones de Xray",
"xraySwitchClickDesk": "Elige sabiamente, ya que las versiones anteriores pueden no ser compatibles con las configuraciones actuales.",
"updatePanel": "Actualizar panel",
"panelUpdateDesc": "Esto actualizará 3X-UI a la última versión y reiniciará el servicio del panel.",
"currentPanelVersion": "Versión actual del panel",
"latestPanelVersion": "Última versión del panel",
"panelUpToDate": "El panel está actualizado",
"devChannel": "Canal de desarrollo",
"devChannelWarning": "Las compilaciones de desarrollo siguen cada commit en main y no son versiones estables; no hay reversión automática.",
"currentCommit": "Commit actual",
"latestCommit": "Último commit",
"updateChannelChanged": "Canal de actualización cambiado",
"xrayStatusUnknown": "Desconocido",
"xrayStatusRunning": "En ejecución",
"xrayStatusStop": "Detenido",
"xrayStatusError": "Error",
"systemHistoryTitle": "Historial del Sistema",
"historyTitleCpu": "Uso de CPU",
"historyTitleMem": "Uso de Memoria",
"historyTitleNetwork": "Ancho de Banda de Red",
"historyTitlePackets": "Paquetes de Red",
"historyTitleDisk": "E/S de Disco",
"historyTitleOnline": "Clientes en Línea",
"historyTitleLoad": "Carga Media del Sistema (1 / 5 / 15 min)",
"historyTitleConnections": "Conexiones Activas (TCP / UDP)",
"historyTitleDiskUsage": "Uso del Espacio en Disco",
"historyTabBandwidth": "Ancho de Banda",
"historyTabPackets": "Paquetes",
"historyTabDisk": "Disco I/O",
"historyTabOnline": "En línea",
"historyTabLoad": "Carga",
"historyTabConnections": "Conexiones",
"historyTabDiskUsage": "Uso de Disco",
"xrayMetricsTitle": "Métricas de Xray",
"xrayTitleHeap": "Memoria Heap Asignada",
"xrayTitleSys": "Memoria Reservada del SO",
"xrayTitleObjects": "Objetos Heap Activos",
"xrayTitleGcCount": "Ciclos de GC Completados",
"xrayTitleGcPause": "Duración de Pausa de GC",
"xrayTitleObservatory": "Estado de Conexiones Salientes",
"xrayTabHeap": "Heap",
"xrayTabSys": "Sys",
"xrayTabObjects": "Objetos",
"xrayTabGcCount": "Recuento GC",
"xrayTabGcPause": "Pausa GC",
"xrayTabObservatory": "Observatorio",
"xrayMetricsDisabled": "Endpoint de métricas de Xray no configurado",
"xrayMetricsHint": "Añade un bloque metrics de nivel superior a la configuración de xray con tag metrics_out y listen 127.0.0.1:11111, luego reinicia xray.",
"xrayObservatoryEmpty": "Aún no hay datos de Observatory",
"xrayObservatoryHint": "Añade un bloque observatory a la configuración de xray listando los tags de outbound a sondear, luego reinicia xray.",
"xrayObservatoryTagPlaceholder": "Seleccionar outbound",
"xrayObservatoryAlive": "Activo",
"xrayObservatoryDead": "Caído",
"xrayObservatoryLastSeen": "Visto por última vez",
"xrayObservatoryLastTry": "Último intento",
"connectionCount": "Número de Conexiones",
"ipAddresses": "Direcciones IP",
"toggleIpVisibility": "Alternar visibilidad de la IP",
"overallSpeed": "Velocidad general",
"upload": "Subida",
"download": "Descargar",
"sent": "Enviado",
"received": "Recibido",
"xraySwitchVersionDialog": "¿Realmente deseas cambiar la versión de Xray?",
"xraySwitchVersionDialogDesc": "Esto cambiará la versión de Xray a #version#.",
"xraySwitchVersionPopover": "Xray se actualizó correctamente",
"panelUpdateDialog": "¿Deseas actualizar el panel?",
"panelUpdateDialogDesc": "Esto actualizará 3X-UI a la versión #version# y reiniciará el servicio del panel.",
"panelUpdateStartedPopover": "Actualización del panel iniciada",
"panelUpdateFailedTitle": "Error al actualizar el panel",
"panelUpdateFailedDesc": "La actualización no se completó correctamente. Revisa los registros del servidor o ejecuta 'x-ui update' desde la línea de comandos.",
"panelUpdateUnknownTitle": "No se pudo confirmar si la actualización terminó",
"panelUpdateUnknownDesc": "El panel no informó un resultado a tiempo. Recarga la página para comprobar la versión actual, o revisa los registros del servidor.",
"geofileUpdateDialog": "¿Realmente deseas actualizar el geofichero?",
"geofileUpdateDialogDesc": "Esto actualizará el archivo #filename#.",
"geofilesUpdateDialogDesc": "Esto actualizará todos los archivos.",
"geofilesUpdateAll": "Actualizar todo",
"geofileUpdatePopover": "Geofichero actualizado correctamente",
"geodataTitle": "Actualización automática de Geodata",
"geodataHint": "Xray descarga estos archivos según la programación y los recarga en caliente sin reiniciar. Las URL deben ser HTTPS. Cada archivo debe existir previamente en la carpeta bin para que Xray pueda actualizarlo.",
"geodataCron": "Programación (cron)",
"geodataOutbound": "Descargar a través de outbound (opcional)",
"geodataFile": "Nombre de archivo",
"geodataAddFile": "Añadir archivo",
"geodataSaveRestart": "Guardar y reiniciar Xray",
"geodataConfirmTitle": "¿Guardar la configuración de geodata?",
"geodataConfirmContent": "Se actualizará la plantilla de configuración de Xray y se reiniciará Xray.",
"geodataInvalidUrl": "Cada archivo necesita una URL HTTPS.",
"geodataInvalidFile": "El nombre de archivo debe ser simple, p. ej. geosite_custom.dat (sin rutas).",
"geodataInvalidCron": "Cron debe tener 5 campos, p. ej. 0 4 * * *",
"geodataEmpty": "No hay archivos configurados. En las reglas de enrutamiento se referencian como ext:geosite_custom.dat:category.",
"dontRefresh": "La instalación está en progreso, por favor no actualices esta página.",
"logs": "Registros",
"accessLogs": "Registros de acceso",
"autoUpdate": "Actualización automática",
"amneziawgLogs": "Registros de AmneziaWG",
"amneziawgHandshake": "Último handshake",
"amneziawgInterface": "Interfaz",
"amneziawgInbound": "Entrada",
"amneziawgEndpoint": "Endpoint",
"amneziawgIdle": "Inactivo",
"amneziawgEvents": "Eventos",
"amneziawgNoPeers": "No hay peers de AmneziaWG activos",
"amneziawgNoEvents": "Aún no hay eventos de AmneziaWG registrados",
"config": "Configuración",
"backupTitle": "Copia & Restauración",
"exportDatabase": "Copia de seguridad",
"exportDatabaseDesc": "Haz clic para descargar un archivo .db que contiene una copia de seguridad de tu base de datos actual en tu dispositivo. El mismo archivo también puede restaurarse en un panel que funcione con PostgreSQL.",
"importDatabase": "Restaurar",
"importDatabaseDesc": "Haz clic para seleccionar y cargar una copia de seguridad .db o un volcado de migración (.dump) desde tu dispositivo para restaurar tu base de datos.",
"importDatabaseSuccess": "La base de datos se ha importado correctamente",
"importDatabaseError": "Ocurrió un error al importar la base de datos",
"readDatabaseError": "Ocurrió un error al leer la base de datos",
"getDatabaseError": "Ocurrió un error al obtener la base de datos",
"getConfigError": "Ocurrió un error al obtener el archivo de configuración",
"backupPostgresNote": "Este panel funciona con PostgreSQL. «Copia de seguridad» descarga un archivo pg_dump (.dump) y «Restaurar» lo vuelve a cargar con pg_restore. «Restaurar» también acepta una base de datos SQLite (.db) o un volcado de migración de SQLite e importa sus datos a PostgreSQL. El servidor necesita tener instaladas las herramientas cliente de PostgreSQL (pg_dump y pg_restore).",
"exportDatabasePgDesc": "Haz clic para descargar un volcado de PostgreSQL (.dump) de tu base de datos actual en tu dispositivo.",
"importDatabasePgDesc": "Haz clic para seleccionar y subir una copia de seguridad de PostgreSQL (.dump), una base de datos SQLite (.db) o un volcado de migración de SQLite para restaurar tu base de datos. Esto reemplaza todos los datos actuales.",
"migrationDownload": "Descargar migración",
"migrationDownloadPgDesc": "Haz clic para descargar una base de datos SQLite .db creada a partir de tus datos de PostgreSQL, lista para ejecutar este panel en SQLite.",
"avg": "media",
"peak": "pico",
"free": "libre",
"openSockets": "sockets abiertos",
"throughputSub": "Total de la interfaz",
"avgWindow": "Media del periodo",
"healthWarm": "{list} — algo elevado",
"healthCritical": "{list} — crítico",
"panel": "Panel",
"threads": "Hilos",
"uptime": "Tiempo activo",
"logLevelDebug": "Debug",
"logLevelInfo": "Info",
"logLevelNotice": "Notice",
"logLevelWarning": "Warning",
"logLevelError": "Error",
"accessDirect": "DIRECT",
"accessBlocked": "BLOCKED",
"accessProxy": "PROXY",
"importKeepHostSettings": "Mantener la configuración de esta máquina",
"importKeepHostSettingsDesc": "Conserva las direcciones de escucha, los puertos, la ruta base, los certificados y la identidad de nodo de este panel en lugar de tomarlos del archivo subido."
},
"inbounds": {
"totalDownUp": "Subidas/Descargas Totales",
"totalUsage": "Uso Total",
"inboundCount": "Número de Entradas",
"operate": "Menú",
"enable": "Habilitar",
"remark": "Notas",
"node": "Nodo",
"deployTo": "Desplegar en",
"localPanel": "Panel local",
"fallbacks": {
"title": "Fallbacks",
"empty": "Aún no hay fallbacks",
"add": "Añadir fallback",
"pickInbound": "Selecciona un inbound",
"matchAny": "cualquiera",
"destPlaceholder": "automático (listen:puerto del hijo)",
"needsTls": "Los fallbacks estarán disponibles al seleccionar TLS o Reality en la pestaña de Seguridad (solo VLESS/Trojan sobre RAW)."
},
"protocol": "Protocolo",
"port": "Puerto",
"portMap": "Asignación de puertos",
"traffic": "Tráfico",
"speed": "Velocidad",
"expireDate": "Fecha de Expiración",
"createdAt": "Creado",
"updatedAt": "Actualizado",
"resetTraffic": "Restablecer tráfico",
"addInbound": "Agregar Entrada",
"generalActions": "Acciones Generales",
"modifyInbound": "Modificar Entrada",
"deleteConfirmTitle": "¿Eliminar el inbound \"{remark}\"?",
"deleteConfirmContent": "Esto elimina el inbound y todos sus clientes. No se puede deshacer.",
"resetConfirmTitle": "¿Restablecer el tráfico de \"{remark}\"?",
"resetConfirmContent": "Restablece los contadores de subida/bajada a 0 para este inbound.",
"selectedCount": "{count} seleccionado(s)",
"selectAll": "Seleccionar todo",
"bulkDeleteConfirmTitle": "¿Eliminar {count} inbounds?",
"bulkDeleteConfirmContent": "Esto elimina los inbounds seleccionados y todos sus clientes. No se puede deshacer.",
"cloneConfirmTitle": "¿Clonar el inbound \"{remark}\"?",
"cloneConfirmContent": "Crea una copia con un puerto nuevo y una lista de clientes vacía.",
"delAllClients": "Eliminar todos los clientes",
"delAllClientsConfirmTitle": "¿Eliminar los {count} clientes de \"{remark}\"?",
"delAllClientsConfirmContent": "Elimina todos los clientes de este inbound y sus registros de tráfico. El inbound se mantiene. Esto no se puede deshacer.",
"attachClients": "Asociar clientes a…",
"addClientsToGroup": "Añadir clientes al grupo…",
"attachClientsTitle": "Asociar clientes desde «{remark}»",
"attachClientsDesc": "Asocia los mismos {count} cliente(s) (mismo UUID/contraseña y tráfico compartido) a las entradas seleccionadas. Permanecen también en esta entrada.",
"attachClientsTargets": "Entradas objetivo",
"attachClientsNoTargets": "No hay otras entradas compatibles disponibles para asociar.",
"attachClientsResult": "Asociados {attached}, omitidos {skipped}.",
"attachClientsResultMixed": "Asociados {attached}, omitidos {skipped}, errores {errors}.",
"attachClientsSelectLabel": "Clientes para asociar",
"attachClientsSearchPlaceholder": "Buscar email o comentario",
"attachClientsStatusDisabled": "Deshabilitado",
"attachClientsSelectedCount": "{selected} de {total} seleccionado(s)",
"attachExistingClients": "Asociar clientes existentes…",
"attachExistingTitle": "Asociar clientes existentes a «{remark}»",
"attachExistingDesc": "Asocia los clientes existentes ({count} disponibles) a esta entrada: mismo UUID/contraseña y tráfico compartido. Los clientes que ya están en ella se omiten.",
"attachExistingNoClients": "Aún no hay clientes. Cree clientes primero y luego asócielos aquí.",
"attachExistingStatusAttached": "Ya asociado",
"detachClients": "Desasociar clientes",
"detachClientsTitle": "Desasociar clientes de «{remark}»",
"detachClientsDesc": "Quita el cliente o clientes seleccionados solo de esta entrada. Los registros se conservan (usa Delete para eliminar por completo). El origen tiene {count} cliente(s) en total.",
"detachClientsResult": "Desasociados {detached}, omitidos {skipped}.",
"detachClientsResultMixed": "Desasociados {detached}, omitidos {skipped}, errores {errors}.",
"detachClientsSelectLabel": "Clientes para desasociar",
"exportLinksTitle": "Exportar enlaces del inbound",
"exportSubsTitle": "Exportar enlaces de suscripción",
"exportAllLinksTitle": "Exportar todos los enlaces de inbound",
"exportAllSubsTitle": "Exportar todos los enlaces de suscripción",
"exportAllLinksFileName": "Todas-las-entradas",
"exportAllSubsFileName": "Todas-las-entradas-Subs",
"inboundJsonTitle": "JSON de entrada",
"resetTrafficContent": "¿Confirmar restablecimiento de tráfico?",
"copyLink": "Copiar Enlace",
"address": "Dirección",
"network": "Red",
"destinationPort": "Puerto de Destino",
"targetAddress": "Dirección de Destino",
"monitorDesc": "Dejar en blanco por defecto",
"meansNoLimit": "= Ilimitado. (unidad: GB)",
"totalFlow": "Flujo Total",
"leaveBlankToNeverExpire": "Dejar en Blanco para Nunca Expirar",
"certificatePath": "Ruta Cert",
"certificateContent": "Datos Cert",
"publicKey": "Clave Pública",
"privatekey": "Clave Privada",
"client": "Cliente",
"export": "Exportar Enlaces",
"clone": "Clonar",
"resetAllTraffic": "Restablecer Tráfico de Todas las Entradas",
"resetAllTrafficTitle": "Restablecer tráfico de todas las entradas",
"resetAllTrafficContent": "¿Estás seguro de que deseas restablecer el tráfico de todas las entradas?",
"email": "Email",
"IPLimit": "Límite de IP",
"IPLimitlog": "Registro de IP",
"IPLimitlogclear": "Limpiar el Registro",
"setDefaultCert": "Establecer certificado desde el panel",
"setDefaultCertEmpty": "No hay certificado configurado para el panel. Configura uno en Ajustes primero.",
"streamTab": "Transmisión",
"securityTab": "Seguridad",
"sniffingTab": "Inspección",
"sniffingMetadataOnly": "Solo metadatos",
"sniffingRouteOnly": "Solo enrutamiento",
"sniffingIpsExcluded": "IPs excluidas",
"sniffingDomainsExcluded": "Dominios excluidos",
"decryption": "Descifrado",
"encryption": "Cifrado",
"vlessAuthX25519": "X25519 (native)",
"vlessAuthMlkem768": "ML-KEM-768 (native)",
"vlessAuthX25519Xorpub": "X25519 (xorpub)",
"vlessAuthX25519Random": "X25519 (random)",
"vlessAuthMlkem768Xorpub": "ML-KEM-768 (xorpub)",
"vlessAuthMlkem768Random": "ML-KEM-768 (random)",
"vlessAuthCustom": "Personalizado",
"vlessAuthSelected": "Seleccionado: {auth}",
"vlessAuthGenerate": "Generar claves",
"vlessAuthGenerateButton": "Generar",
"advanced": {
"title": "Secciones JSON del inbound",
"subtitle": "JSON completo del inbound y editores específicos para settings, sniffing y streamSettings.",
"all": "Todo",
"allHelp": "Objeto inbound completo con todos los campos en un solo editor.",
"settings": "Ajustes",
"settingsHelp": "Envoltorio del bloque settings de Xray:",
"sniffing": "Sniffing",
"sniffingHelp": "Envoltorio del bloque sniffing de Xray:",
"stream": "Stream",
"streamHelp": "Envoltorio del bloque stream de Xray:"
},
"subSortIndex": "Orden sub",
"inboundInfo": "Información de entrada",
"exportInbound": "Exportación entrante",
"import": "Importar",
"importInbound": "Importar un entrante",
"periodicTrafficResetTitle": "Reset de Tráfico",
"periodicTrafficResetDay": "Día de reinicio mensual",
"periodicTrafficReset": {
"never": "Nunca",
"daily": "Diariamente",
"weekly": "Semanalmente",
"monthly": "Mensualmente",
"hourly": "Cada hora"
},
"toasts": {
"obtain": "Recibir",
"updateSuccess": "La actualización fue exitosa",
"logCleanSuccess": "El registro ha sido limpiado",
"inboundUpdateSuccess": "Entrada actualizada correctamente",
"inboundCreateSuccess": "Entrada creada correctamente",
"bulkDeleted": "{count} inbounds eliminados",
"bulkDeletedMixed": "{ok} eliminados, {failed} fallidos",
"clonedMany": "{count} inbounds clonados",
"clonedMixed": "{ok} clonados, {failed} fallidos",
"inboundDeleteSuccess": "Entrada eliminada correctamente",
"inboundClientAddSuccess": "Cliente(s) de entrada añadido(s)",
"inboundClientDeleteSuccess": "Cliente de entrada eliminado",
"inboundClientUpdateSuccess": "Cliente de entrada actualizado",
"savedNodeOfflineWillSync": "Guardado localmente. Un nodo de respaldo está desconectado o deshabilitado: el cambio se sincronizará cuando vuelva a conectarse.",
"resetAllClientTrafficSuccess": "Todo el tráfico del cliente ha sido reiniciado",
"resetAllTrafficSuccess": "Todo el tráfico ha sido reiniciado",
"resetInboundClientTrafficSuccess": "El tráfico ha sido reiniciado",
"resetInboundTrafficSuccess": "El tráfico de entrada ha sido reiniciado",
"trafficGetError": "Error al obtener los tráficos",
"getNewX25519CertError": "Error al obtener el certificado X25519.",
"getNewmldsa65Error": "Error al obtener el certificado mldsa65.",
"getNewVlessEncError": "Error al obtener el certificado VlessEnc.",
"scanRealityTargetError": "No se pudo escanear el objetivo REALITY.",
"scanRealityTargetFeasible": "El objetivo es apto: se rellenaron el objetivo y el SNI.",
"scanRealityTargetNotFeasible": "El objetivo es accesible pero no apto para REALITY.",
"scanRealityTargetPrivate": "El destino funciona, pero está en una red privada/local.",
"invalidClientField": "Cliente {client}: campo {field} — {reason}",
"invalidField": "{field} — {reason}",
"moreIssues": "{message} (+{count} más)"
},
"form": {
"moveUp": "Subir",
"moveDown": "Bajar",
"addAll": "Añadir todo",
"addAllFallbackTooltip": "Añade una fila de fallback para cada entrada elegible aún no conectada",
"peers": "Peers",
"addPeer": "Añadir peer",
"keepAlive": "Keep-alive",
"autoSystemRoutesTooltip": "Solo Windows. Los CIDR se añaden automáticamente a la tabla de enrutamiento del sistema para que el tráfico coincidente pase por TUN.",
"autoOutboundsInterface": "Interfaz de salidas automática",
"autoOutboundsInterfaceTooltip": "Interfaz física para tráfico de salida. Usa 'auto' para detectar; se habilita automáticamente cuando se establece Auto system routes.",
"rewriteAddress": "Reescribir dirección",
"rewritePort": "Reescribir puerto",
"allowedNetwork": "Red permitida",
"followRedirect": "Seguir redirección",
"accounts": "Cuentas",
"allowTransparent": "Permitir transparente",
"encryptionMethod": "Método de cifrado",
"fakeTlsDomain": "Dominio FakeTLS (SNI)",
"mtprotoSecret": "Secreto",
"mtgDomainFrontingIp": "IP de domain fronting",
"mtgDomainFrontingPort": "Puerto de domain fronting",
"mtgDomainFrontingProxyProtocol": "Protocolo PROXY de domain fronting",
"mtgDomainFrontingHint": "Adónde envía mtg el tráfico que no es de Telegram, p. ej. tu sitio web falso de NGINX. Deja la IP vacía para usar el dominio FakeTLS mediante DNS; el puerto predeterminado es 443.",
"mtgProxyProtocolListener": "Aceptar protocolo PROXY (escucha)",
"mtgPreferIp": "Preferencia de IP",
"mtgDebug": "Registro de depuración",
"mtgRouteThroughXray": "Enrutar a través de Xray",
"mtgRouteThroughXrayHint": "Envía el tráfico de Telegram de este proxy a través de Xray para que siga tus reglas de enrutamiento. El sidecar mtg sale por un puente SOCKS local con la etiqueta de esta entrada; usa esa etiqueta en la pestaña Enrutamiento para reglas avanzadas.",
"mtgRouteOutbound": "Salida",
"mtgRouteOutboundHint": "Opcional. Fuerza el tráfico de Telegram a salir por esta salida (o balanceador). Déjalo vacío para que decidan tus reglas de enrutamiento.",
"mtgRouteOutboundPlaceholder": "Usar reglas de enrutamiento",
"mtprotoFakeTlsDomainHint": "Dominio FakeTLS predeterminado para generar el secreto de un nuevo cliente. Cada cliente puede usar su propio dominio.",
"mtgThrottleMaxConnections": "Conexiones máximas",
"mtgThrottleMaxConnectionsHint": "Limita las conexiones simultáneas de todos los usuarios con reparto equitativo. 0 desactiva el límite.",
"mtgAdTagInvalid": "El ad-tag debe tener exactamente 32 caracteres hexadecimales.",
"mtgPublicIpv4": "IPv4 pública",
"mtgPublicIpv6": "IPv6 pública",
"mtgPublicIpHint": "La dirección pública accesible de este servidor, usada por el proxy intermedio del ad-tag. Déjalo en blanco para que mtg la detecte automáticamente.",
"visionTestseed": "Vision testseed",
"version": "Versión",
"udpIdleTimeout": "UDP idle timeout (s)",
"masquerade": "Masquerade",
"type": "Tipo",
"upstreamUrl": "URL Upstream",
"rewriteHost": "Reescribir Host",
"skipTlsVerify": "Saltar verificación TLS",
"directory": "Directorio",
"statusCode": "Código de estado",
"body": "Body",
"headers": "Cabeceras",
"proxyProtocol": "Proxy Protocol",
"requestVersion": "Versión de petición",
"requestMethod": "Método de petición",
"requestPath": "Ruta de petición",
"requestHeaders": "Cabeceras de petición",
"responseVersion": "Versión de respuesta",
"responseStatus": "Estado de respuesta",
"responseReason": "Razón de respuesta",
"responseHeaders": "Cabeceras de respuesta",
"heartbeatPeriod": "Periodo de heartbeat",
"serviceName": "Nombre de servicio",
"authority": "Authority",
"multiMode": "Multi Mode",
"maxBufferedUpload": "Máx. subida en búfer",
"maxUploadSize": "Tamaño máx. de subida (Byte)",
"streamUpServer": "Stream-Up Server",
"serverMaxHeaderBytes": "Máx. bytes cabecera servidor",
"paddingBytes": "Bytes de Padding",
"uplinkHttpMethod": "Método HTTP Uplink",
"paddingObfsMode": "Modo obfs de Padding",
"paddingKey": "Padding Key",
"paddingHeader": "Padding Header",
"paddingPlacement": "Ubicación de Padding",
"paddingMethod": "Método de Padding",
"sessionPlacement": "Session Placement",
"sessionKey": "Session Key",
"sessionIDTable": "Tabla de Session ID",
"sessionIDTableHint": "Conjunto de caracteres para generar los session ID: un nombre predefinido (ALPHABET, Base62, hex, number, …) o una cadena ASCII literal. Déjalo vacío para el valor por defecto de xray-core.",
"sessionIDLength": "Longitud de Session ID",
"sessionIDLengthHint": "Longitud o rango (p. ej. 8-16) del session ID generado. Solo se usa cuando hay una Tabla de Session ID definida; el mínimo debe ser mayor que 0.",
"sequencePlacement": "Sequence Placement",
"sequenceKey": "Sequence Key",
"uplinkDataPlacement": "Uplink Data Placement",
"uplinkDataKey": "Uplink Data Key",
"noSseHeader": "Sin cabecera SSE",
"ttiMs": "TTI (ms)",
"uplinkMbps": "Subida (MB/s)",
"downlinkMbps": "Bajada (MB/s)",
"cwndMultiplier": "Multiplicador CWND",
"maxSendingWindow": "Máx. ventana de envío",
"externalProxy": "Proxy externo",
"forceTls": "Forzar TLS",
"fingerprint": "Fingerprint",
"defaultOption": "Por defecto",
"routeMark": "Route Mark",
"tcpKeepAliveInterval": "TCP Keep Alive Interval",
"tcpKeepAliveIdle": "TCP Keep Alive Idle",
"tcpMaxSeg": "TCP Max Seg",
"tcpUserTimeout": "TCP User Timeout",
"tcpWindowClamp": "TCP Window Clamp",
"tcpWindowClampHint": "Deja 0 para usar el valor predeterminado del sistema. Los valores distintos de cero limitan la ventana de recepción TCP anunciada; valores como 600 (del ejemplo de la documentación de Xray) pueden hundir el rendimiento en enlaces de alta latencia.",
"tcpFastOpen": "TCP Fast Open",
"multipathTcp": "Multipath TCP",
"penetrate": "Penetrate",
"v6Only": "Solo V6",
"tcpCongestion": "TCP Congestion",
"dialerProxy": "Dialer Proxy",
"trustedXForwardedFor": "X-Forwarded-For de confianza",
"trustedXForwardedForHint": "Confía en esta cabecera de solicitud para obtener la IP real del cliente (p. ej. CF-Connecting-IP detrás del CDN de Cloudflare). Solo válido en los transportes WebSocket, HTTPUpgrade, XHTTP y gRPC. Déjalo vacío para ignorar las cabeceras reenviadas.",
"proxyProtocolHint": "Acepta la cabecera PROXY protocol para obtener la IP real del cliente desde un túnel/relé L4 superior (HAProxy, gost, nginx-stream, Xray dokodemo-door) o Cloudflare Spectrum. El nodo superior DEBE enviar PROXY protocol. Funciona en TCP, WebSocket, HTTPUpgrade y gRPC; no en mKCP.",
"realClientIp": "IP real del cliente",
"realClientIpHint": "Captura la IP real del visitante cuando el tráfico llega a este inbound a través de un CDN o relé, en lugar de registrar la dirección del intermediario. Elige un preajuste para rellenar los campos sockopt correspondientes más abajo. Estos campos nunca se envían a los clientes en las suscripciones.",
"realClientIpPresetOff": "Desactivado / directo",
"realClientIpPresetCloudflare": "Cloudflare CDN",
"realClientIpPresetProxyProtocol": "Relé L4 / Spectrum (PROXY)",
"realClientIpTrustedHeaderTransportWarn": "Trusted X-Forwarded-For solo es válido en WebSocket, HTTPUpgrade y XHTTP. En el transporte actual esta cabecera se ignora.",
"realClientIpProxyProtocolTransportWarn": "PROXY protocol no es compatible con este transporte (mKCP). Usa TCP/RAW, WebSocket, HTTPUpgrade, gRPC o XHTTP.",
"addressPortStrategy": "Estrategia dirección+puerto",
"tryDelayMs": "Retraso de intento (ms)",
"prioritizeIPv6": "Priorizar IPv6",
"interleave": "Interleave",
"maxConcurrentTry": "Máx. intentos simultáneos",
"customSockopt": "Sockopt personalizado",
"addCustomOption": "Añadir opción personalizada",
"serverNameIndication": "SNI",
"cipherSuites": "Cipher Suites",
"autoOption": "Auto",
"minMaxVersion": "Versión mín/máx",
"rejectUnknownSni": "Rechazar SNI desconocido",
"disableSystemRoot": "Deshabilitar System Root",
"sessionResumption": "Reanudación de sesión",
"oneTimeLoading": "Carga única",
"usageOption": "Opción de uso",
"buildChain": "Construir cadena",
"echKey": "ECH key",
"echConfig": "Config ECH",
"pinnedPeerCertSha256": "SHA-256 del cert. del par fijado",
"pinnedPeerCertSha256Tip": "Hashes SHA-256 del certificado del par como cadena hexadecimal (p. ej. e8e2d3…), separados por comas. Solo en el panel — no se escribe en la config xray del servidor, pero se incluye en los enlaces para que los clientes puedan fijar el certificado.",
"pinnedPeerCertSha256Placeholder": "hash(es) hexadecimal, separados por comas",
"getNewEchCert": "Obtener nuevo cert ECH",
"echSockopt": "ECH Sockopt",
"echSockoptTip": "Opciones de socket para la conexión que Xray usa al obtener la lista de configuración ECH (por ejemplo, enrutar la consulta a través de una salida dialerProxy). Déjalo deshabilitado para usar los valores por defecto.",
"curvePreferences": "Preferencias de curvas",
"curvePreferencesTip": "Restringe las curvas de intercambio de claves TLS que ofrece el servidor, por orden de preferencia (por ejemplo, X25519MLKEM768, X25519). Déjalo vacío para usar los valores por defecto de Xray-core.",
"masterKeyLog": "Registro de clave maestra",
"masterKeyLogTip": "Ruta donde escribir las claves maestras TLS (formato SSLKEYLOGFILE) para depurar con Wireshark. Déjalo vacío en producción — permite que cualquiera con el archivo descifre el tráfico.",
"verifyPeerCertByName": "Verificar cert. del par por nombre",
"verifyPeerCertByNameTip": "Indica a los clientes que verifiquen el certificado del servidor con este nombre en lugar del SNI. Nombres separados por comas. Solo en el panel — se incluye en los enlaces (vcn). El reemplazo moderno de allowInsecure, que Xray eliminó después del 2026-06-01.",
"pinFromCert": "Rellenar desde el certificado de este inbound",
"pinFromRemote": "Obtener el hash haciendo ping al SNI (xray tls ping)",
"pinFromRemoteNoSni": "Establece primero el SNI (serverName) para hacer ping al certificado remoto.",
"pinFromRemoteFailed": "No se pudo obtener el hash del certificado remoto.",
"limitFallback": "Limitar fallback",
"limitFallbackUpload": "Limitar subida del fallback",
"limitFallbackDownload": "Limitar bajada del fallback",
"afterBytes": "Tras bytes",
"afterBytesTip": "Deja que el fallback funcione a máxima velocidad durante esta cantidad de bytes y luego empieza a limitar. 0 = limitar desde el primer byte.",
"bytesPerSec": "Bytes por seg.",
"bytesPerSecTip": "Límite de velocidad (bytes/seg.) aplicado al tráfico del fallback tras el umbral, para que las sondas no puedan usar tu servidor como ancho de banda gratuito hacia el destino. 0 = sin límite (deshabilita esta dirección).",
"burstBytesPerSec": "Ráfaga de bytes por seg.",
"burstBytesPerSecTip": "Margen para ráfagas breves por encima de la tasa constante (tamaño del token-bucket). Si es menor que Bytes por seg., se eleva para igualarlo.",
"show": "Mostrar",
"xver": "Xver",
"target": "Objetivo",
"maxTimeDiff": "Máx. diferencia de tiempo (ms)",
"minClientVer": "Mín. versión cliente",
"maxClientVer": "Máx. versión cliente",
"minClientVerHint": "Vacío no significa sin restricción: Xray-core aplica entonces el mínimo integrado de la build del núcleo en uso (26.3.27 en las versiones actuales) y rechaza a los clientes que reportan una versión anterior, incluidos núcleos de terceros como Mihomo y sing-box. Con 1.0.0 se aceptan, a costa de admitir huellas TLS obsoletas.",
"maxClientVerHint": "Vacío significa sin límite superior. Si se establece, no debe ser inferior al mínimo efectivo — la versión mínima del cliente o, si ese campo está vacío, el mínimo integrado de Xray-core — o todos los clientes serán rechazados.",
"clientVerInvalid": "La versión del cliente debe tener hasta tres números separados por puntos, cada uno 0-255 (p. ej. 26.3.27)",
"maxClientVerBelowMin": "La versión máxima del cliente no debe ser inferior a la versión mínima",
"shortIds": "Short IDs",
"realityTargetHint": "Obligatorio. Debe incluir un puerto (p. ej. example.com:443). Sin puerto, Xray-core no arranca.",
"realityTargetRequired": "El destino REALITY es obligatorio",
"realityTargetNeedsPort": "El destino REALITY debe incluir un puerto (p. ej. example.com:443)",
"realityTargetInvalidPort": "El destino REALITY tiene un puerto no válido",
"scan": "Escanear",
"findTargets": "Buscar objetivos",
"scanModalTitle": "Escáner de objetivos REALITY",
"scanModalDesc": "Valida un dominio o escanea un rango IP / CIDR para descubrir nuevos objetivos REALITY a partir de sus certificados. Deja el campo vacío para probar los candidatos comunes.",
"scanDiscoverPlaceholder": "IP, CIDR o dominio — déjalo vacío para candidatos comunes",
"scanStatus": "Estado",
"scanFeasible": "Apto",
"scanNotFeasible": "No apto",
"scanCurve": "Intercambio de claves",
"scanCert": "Certificado",
"scanCertInvalid": "No confiable",
"scanCertExpiry": "El certificado caduca",
"scanSniUsed": "SNI utilizado",
"scanPrivateNote": "Comprobado en una red privada/local: esta dirección no es accesible desde internet.",
"scanPrivateConfirmTitle": "Destino en una red local",
"scanPrivateConfirmContent": "\"{target}\" apunta a una dirección privada o de loopback. La comprobación omitirá la protección SSRF del panel solo para esta prueba. ¿Continuar?",
"scanLatency": "Latencia",
"scanUse": "Usar",
"scanRescan": "Reescanear",
"spiderX": "SpiderX",
"spiderXHint": "Semilla por cliente: el panel deriva de ella una ruta spx única para cada cliente; regenera para rotar las rutas de todos",
"getNewCert": "Obtener nuevo cert",
"mldsa65Seed": "mldsa65 Seed",
"mldsa65Verify": "mldsa65 Verify",
"getNewSeed": "Obtener nuevo Seed",
"listenHelp": "También puedes introducir una ruta de socket Unix (p. ej. /run/xray/in.sock), o un nombre de socket abstracto con el prefijo @ (p. ej. @xray/in.sock), para escuchar en un socket en lugar de un puerto TCP; en ese caso, establece el Puerto en 0.",
"shareAddrStrategy": "Estrategia de dirección para compartir",
"shareAddrStrategyHelp": "Controla qué dirección se escribe en los enlaces compartidos exportados, códigos QR y la salida de suscripción.",
"shareAddr": "Dirección compartida personalizada",
"shareAddrHelp": "Solo se usa cuando la estrategia de dirección para compartir es Personalizada. Introduce un host o IP sin esquema ni puerto.",
"subSortIndex": "Orden en la suscripción",
"subSortIndexHelp": "Posición de los enlaces de esta entrada en la salida de la suscripción (página de suscripción y apps cliente). Los valores más bajos van primero; con valores iguales se mantiene el orden de creación. No afecta a la lista de entradas del panel.",
"disableFlow": "Desactivar el flujo XTLS",
"disableFlowHelp": "Excluye este inbound de la inyección automática de xtls-rprx-vision, incluso cuando su transporte admite flow (p. ej. un inbound XHTTP tunelizado con cifrado VLESS). Los clientes mantienen Vision en tus demás inbounds compatibles de la misma suscripción. Solo VLESS.",
"shareAddrStrategyOptions": {
"node": "Dirección del nodo",
"listen": "Dirección de escucha del inbound",
"custom": "Personalizada"
}
},
"info": {
"mode": "Modo",
"grpcServiceName": "grpc serviceName",
"grpcMultiMode": "grpc multiMode",
"interfaceName": "Nombre de interfaz",
"mtu": "MTU",
"gateway": "Gateway",
"dns": "DNS",
"outboundsInterface": "Interfaz de salidas",
"autoSystemRoutes": "Rutas del sistema automáticas",
"followRedirect": "FollowRedirect",
"auth": "Auth",
"noKernelTun": "TUN sin kernel",
"keepAlive": "Keep alive",
"peerNumber": "Peer {n}",
"peerNumberConfig": "Config Peer {n}"
},
"sniffingDestOverride": "Anulación de destino"
},
"clients": {
"tabBasics": "Básico",
"tabCredentials": "Credenciales",
"tabLinks": "Enlaces",
"wireguardConfig": "Configuración de WireGuard",
"config": "Configuración",
"linksHint": "Añade enlaces de terceros y URLs de suscripción remotas para incluirlos en la suscripción de este cliente.",
"addExternalLink": "Añadir enlace externo",
"addExternalSubscription": "Añadir suscripción externa",
"noExternalLinks": "Aún no hay enlaces externos.",
"noExternalSubscriptions": "Aún no hay suscripciones externas.",
"namePrefix": "Prefijo de nombre",
"lastFetchAt": "Última obtención",
"lastFetchError": "Error de obtención",
"neverFetched": "Aún no obtenido",
"submitEdit": "Guardar cambios",
"clientCount": "Número de clientes",
"bulk": "Añadir en lote",
"selectAll": "Seleccionar todo",
"clearAll": "Limpiar todo",
"method": "Método",
"first": "Primero",
"last": "Último",
"ipLog": "Registro de IP",
"prefix": "Prefijo",
"postfix": "Sufijo",
"delayedStart": "Iniciar tras el primer uso",
"expireDays": "Duración (días)",
"renew": "Renovación automática",
"renewDesc": "Renovación automática tras la expiración. (0 = desactivado) (unidad: día)",
"renewDays": "Renovación automática (días)",
"searchPlaceholder": "Buscar email, comentario, sub ID, UUID, contraseña, auth, Telegram ID…",
"filterTitle": "Filtrar clientes",
"clearAllFilters": "Limpiar todo",
"filters": {
"nodes": "Nodos",
"localPanel": "Local (este panel)"
},
"showingCount": "Mostrando {shown} de {total}",
"sortOldest": "Más antiguos",
"sortNewest": "Más recientes",
"sortRecentlyUpdated": "Recientemente actualizados",
"sortRecentlyOnline": "Recientemente en línea",
"sortEmailAZ": "Email A→Z",
"sortEmailZA": "Email Z→A",
"sortMostTraffic": "Mayor tráfico",
"sortHighestRemaining": "Mayor restante",
"sortExpiringSoonest": "Caducidad más próxima",
"has": "Tiene",
"hasNot": "No tiene",
"actions": "Acciones",
"totalGB": "Límite de tráfico (GB)",
"totalGBDesc": "Cuota de datos para este cliente. 0 = ilimitado.",
"expiryTime": "Expiración",
"addClients": "Añadir clientes",
"limitIp": "Límite de IP",
"limitIpDesc": "Máximo de IP simultáneas. 0 = ilimitado.",
"limitHwid": "Límite de HWID",
"limitHwidDesc": "Máximo de dispositivos registrados para solicitudes de suscripción. 0 = ilimitado.",
"hwidLog": "Dispositivos HWID",
"hwidDevice": "Dispositivo registrado",
"noHwids": "Aún no hay dispositivos HWID",
"firstSeen": "Visto por primera vez",
"lastSeen": "Visto por última vez",
"deleteHwid": "Eliminar dispositivo",
"deleteHwidConfirm": "¿Eliminar este dispositivo? Deberá volver a registrarse en la próxima obtención de la suscripción.",
"hwidDeleted": "Dispositivo eliminado.",
"clearHwidsConfirm": "¿Eliminar todos los dispositivos registrados? Cada dispositivo deberá volver a registrarse en la próxima obtención de la suscripción.",
"limitIpFail2banMissing": "Fail2ban no está instalado, por lo que no se puede aplicar el límite de IP. Instala Fail2ban desde el menú bash de x-ui para habilitar esta opción.",
"limitIpFail2banWindows": "Fail2ban no está disponible en Windows, por lo que no se puede aplicar el límite de IP.",
"limitIpDisabled": "La función de límite de IP está deshabilitada en este servidor.",
"password": "Contraseña",
"passwordDesc": "Solo la usan los clientes Trojan y Shadowsocks; se ignora para VLESS, VMess, Hysteria y WireGuard.",
"subId": "ID de suscripción",
"online": "En línea",
"email": "Email",
"emailInvalidChars": "El correo no puede contener espacios, '/', '\\' ni caracteres de control",
"subIdInvalidChars": "El ID de suscripción no puede contener espacios, '/', '\\' ni caracteres de control",
"group": "Grupo",
"groupDesc": "Etiqueta lógica para agrupar clientes relacionados (p. ej. equipo, cliente, región). Filtrable desde la barra de herramientas.",
"groupPlaceholder": "p. ej. customer-a",
"comment": "Comentario",
"traffic": "Tráfico",
"speed": "Velocidad",
"offline": "Sin conexión",
"addClient": "Añadir cliente",
"qrCode": "Código QR",
"clientInfo": "Información del cliente",
"editClient": "Editar cliente",
"client": "Cliente",
"enabled": "Habilitado",
"remaining": "Restante",
"duration": "Duración",
"attachedInbounds": "Inbounds asociados",
"selectInbound": "Selecciona uno o más inbounds",
"selectAllInbounds": "Seleccionar todo",
"clearAllInbounds": "Limpiar todo",
"noSubId": "Este cliente no tiene subId, no hay enlace compartible.",
"noLinks": "No hay enlaces compartibles — asocia primero este cliente a un inbound con protocolo válido.",
"link": "Enlace",
"resetNotPossible": "Asocia primero este cliente a un inbound.",
"resetAllTraffics": "Restablecer tráfico de todos los clientes",
"resetAllTrafficsTitle": "¿Restablecer tráfico de todos los clientes?",
"resetAllTrafficsContent": "El contador de subida/bajada de cada cliente vuelve a cero. Las cuotas y la expiración no se modifican. Esta acción no se puede deshacer.",
"deleteConfirmTitle": "¿Eliminar al cliente {email}?",
"deleteConfirmContent": "Esto elimina al cliente de cada inbound asociado y descarta su registro de tráfico. No se puede deshacer.",
"adjustSelected": "Ajustar ({count})",
"subLinksSelected": "Enlaces sub ({count})",
"addToGroupTitle": "Añadir {count} cliente(s) a un grupo",
"addToGroupTooltip": "Selecciona un grupo existente o escribe un nombre nuevo. Usa Ungroup para quitar clientes de su grupo actual.",
"groupName": "Nombre del grupo",
"addToGroupSuccessToast": "Se añadieron {count} cliente(s) a {group}",
"ungroupSuccessToast": "Grupo limpiado de {count} cliente(s)",
"ungroup": "Desagrupar",
"ungroupConfirmTitle": "¿Quitar {count} cliente(s) de su grupo?",
"ungroupConfirmContent": "Limpia la etiqueta de grupo en cada cliente seleccionado. Los clientes se conservan (usa Delete para eliminarlos por completo).",
"addToGroup": "Añadir al grupo",
"attach": "Asociar",
"adjust": "Ajustar",
"subLinks": "Enlaces sub",
"enable": "Habilitar",
"disable": "Deshabilitar",
"bulkEnableConfirmTitle": "¿Habilitar {count} clientes?",
"bulkEnableConfirmContent": "Habilita cada cliente seleccionado en todos los inbounds asociados. Los clientes cuya cuota se haya agotado o cuya caducidad haya pasado se deshabilitarán de nuevo automáticamente.",
"bulkDisableConfirmTitle": "¿Deshabilitar {count} clientes?",
"bulkDisableConfirmContent": "Deshabilita cada cliente seleccionado en todos los inbounds asociados. Pierden el acceso de inmediato, pero se conservan sus registros y su tráfico.",
"selectedCount": "{count} seleccionado(s)",
"attachToInboundsTitle": "Asociar {count} cliente(s) a entrada(s)",
"attachToInboundsDesc": "Asocia los {count} cliente(s) seleccionados (mismo UUID/contraseña y tráfico compartido) a las entradas elegidas. Mantienen sus asociaciones existentes.",
"attachToInboundsTargets": "Entradas objetivo",
"attachToInboundsNoTargets": "No hay entradas multiusuario disponibles para asociar.",
"detach": "Desasociar",
"detachFromInboundsTitle": "Desasociar {count} cliente(s) de entrada(s)",
"detachFromInboundsDesc": "Quita los {count} cliente(s) seleccionados de las entradas elegidas. Las parejas donde el cliente no estaba asociado se omiten silenciosamente. Los registros de los clientes se conservan (usa Delete para eliminar por completo).",
"detachFromInboundsTargets": "Entradas para desasociar",
"detachFromInboundsNoTargets": "No hay entradas multiusuario disponibles.",
"detachFromInboundsResult": "Desasociados {detached}, omitidos {skipped}.",
"detachFromInboundsResultMixed": "Desasociados {detached}, omitidos {skipped}, errores {errors}.",
"subLinksTitle": "Enlaces sub ({count})",
"subLinkColumn": "URL de suscripción",
"subJsonLinkColumn": "URL JSON de suscripción",
"subLinksCopyAll": "Copiar todo",
"subLinksCopiedAll": "Copiados {count} enlace(s)",
"subLinksEmpty": "Ninguno de los clientes seleccionados tiene ID de suscripción.",
"subLinksDisabled": "El servicio de suscripción está deshabilitado.",
"subLinksDisabledHint": "Habilita la suscripción en Ajustes del panel → Suscripción para generar enlaces.",
"bulkDeleteConfirmTitle": "¿Eliminar {count} clientes?",
"bulkDeleteConfirmContent": "Cada cliente seleccionado se elimina de los inbounds asociados y se descarta su registro de tráfico. No se puede deshacer.",
"bulkAdjustTitle": "Ajustar {count} clientes",
"bulkAdjustHint": "Los valores positivos extienden, los negativos reducen. Los clientes con expiración o tráfico ilimitado se omiten para ese campo.",
"bulkAdjustNothing": "Establece días o tráfico antes de aplicar.",
"addDays": "Añadir días",
"addTrafficGB": "Añadir tráfico (GB)",
"bulkFlow": "Establecer flow",
"bulkFlowNoChange": "Sin cambios",
"bulkFlowDisable": "Desactivar (borrar flow)",
"delDepleted": "Eliminar agotados",
"delDepletedConfirmTitle": "¿Eliminar clientes agotados?",
"delDepletedConfirmContent": "Elimina todos los clientes con cuota agotada o expirados. No se puede deshacer.",
"exportClients": "Exportar clientes",
"importClients": "Importar clientes",
"import": "Importar",
"delOrphans": "Eliminar clientes sin entrante",
"delOrphansConfirmTitle": "¿Eliminar clientes sin entrante?",
"delOrphansConfirmContent": "Elimina todos los clientes que no están vinculados a ningún entrante, junto con su registro de tráfico. No se puede deshacer.",
"auth": "Auth",
"hysteriaAuth": "Hysteria Auth",
"hysteriaAuthDesc": "Credencial usada únicamente por los clientes Hysteria. Trojan y Shadowsocks usan el campo «Contraseña» en su lugar.",
"uuid": "UUID",
"flow": "Flow",
"vmessSecurity": "Seguridad VMess",
"wireguardPrivateKey": "Clave privada de WireGuard",
"wireguardPublicKey": "Clave pública de WireGuard",
"wireguardPreSharedKey": "Clave precompartida de WireGuard",
"wireguardAllowedIPs": "IP permitidas de WireGuard",
"wireguardAllowedIPsHint": "Déjalo vacío para asignar automáticamente; separa las entradas con comas",
"amneziaWgPrivateKey": "Clave privada de AmneziaWG",
"amneziaWgPublicKey": "Clave pública de AmneziaWG",
"amneziaWgPreSharedKey": "Clave precompartida de AmneziaWG",
"amneziaWgAllowedIPs": "IP permitidas de AmneziaWG",
"amneziaWgAllowedIPsHint": "Déjalo vacío para asignar automáticamente; separa las entradas con comas",
"amneziaWgForwardedPorts": "Puertos reenviados",
"amneziaWgForwardedPortsHint": "Puertos/rangos redirigidos (DNAT) a este cliente, p. ej. 80, 443, 8000-8100. Déjalo vacío si no aplica.",
"amneziaWgConfig": "Configuración de AmneziaWG",
"mtprotoSecret": "Secreto MTProto",
"mtprotoSecretHint": "El secreto FakeTLS del cliente. Vuelve a generarlo para cambiarlo.",
"mtprotoAdTag": "Ad-tag (canal patrocinado)",
"mtprotoAdTagHint": "Etiqueta hexadecimal opcional de 32 caracteres del registro de proxy de Telegram. Si se establece, este cliente se enruta a través de los proxies intermedios de Telegram y aparece un canal patrocinado en la parte superior de su lista de chats.",
"reverseTag": "Etiqueta inversa",
"reverseTagPlaceholder": "Reverse tag opcional",
"telegramId": "ID de usuario de Telegram",
"telegramIdPlaceholder": "ID numérico de usuario de Telegram (0 = ninguno)",
"ipLimit": "Límite de IP",
"toasts": {
"deleted": "Cliente eliminado",
"trafficReset": "Tráfico restablecido",
"allTrafficsReset": "Tráfico de todos los clientes restablecido",
"bulkDeleted": "{count} clientes eliminados",
"bulkDeletedMixed": "{ok} eliminados, {failed} fallidos",
"bulkEnabled": "{count} clientes habilitados",
"bulkEnabledMixed": "{ok} habilitados, {failed} fallidos",
"bulkDisabled": "{count} clientes deshabilitados",
"bulkDisabledMixed": "{ok} deshabilitados, {failed} fallidos",
"bulkCreated": "{count} clientes creados",
"bulkCreatedMixed": "{ok} creados, {failed} fallidos",
"bulkAdjusted": "{count} clientes ajustados",
"bulkAdjustedMixed": "{ok} ajustados, {skipped} omitidos",
"delDepleted": "{count} clientes agotados eliminados",
"delOrphans": "{count} clientes sin entrante eliminados",
"imported": "{count} clientes importados",
"importedMixed": "{ok} importados, {failed} omitidos"
},
"renewMax": "Renovaciones máximas",
"renewMaxDesc": "Cuántas veces puede activarse la renovación automática antes de dejar que el cliente caduque. 0 significa sin límite. Recuperar varios periodos perdidos consume una renovación por periodo.",
"renewOnDay": "Renovar el día",
"renewOnDayDesc": "Renueva este día de cada mes natural, a medianoche en la zona horaria del panel, en lugar de cada N días. Si el mes es demasiado corto para el día elegido, renueva su último día. 0 mantiene el modo de intervalo en días.",
"renewsUsed": "Renovaciones usadas"
},
"groups": {
"name": "Nombre",
"clientCount": "Clientes",
"totalGroups": "Total de grupos",
"totalGroupedClients": "Clientes con grupo",
"trafficUsed": "Tráfico usado",
"upload": "Subida",
"download": "Bajada",
"totalTraffic": "Tráfico total",
"totalUpDown": "Subida / bajada total",
"addGroup": "Añadir grupo",
"createSuccess": "Grupo «{name}» creado.",
"rename": "Renombrar",
"renameTitle": "Renombrar {name}",
"renameCollision": "Ya existe un grupo llamado «{name}».",
"renameSuccess": "Grupo renombrado en {count} cliente(s).",
"deleteConfirmTitle": "¿Eliminar el grupo {name}?",
"deleteConfirmContent": "Esto elimina el grupo y limpia su etiqueta de {count} cliente(s). Los clientes en sí no se eliminan.",
"deleteSuccess": "Grupo limpiado de {count} cliente(s).",
"resetTraffic": "Restablecer tráfico",
"resetConfirmTitle": "¿Restablecer tráfico del grupo {name}?",
"resetConfirmContent": "Esto restablece solo el contador de tráfico del grupo. Los contadores de cada cliente no se ven afectados.",
"resetSuccess": "Tráfico del grupo {name} restablecido.",
"adjustSuccess": "Ajustados {count} cliente(s) en {name}.",
"emptyForAction": "Este grupo aún no tiene clientes.",
"deleteGroupOnly": "Eliminar grupo (conservar clientes)",
"deleteClients": "Eliminar clientes del grupo",
"deleteClientsConfirmTitle": "¿Eliminar todos los clientes en {name}?",
"deleteClientsConfirmContent": "Esto elimina permanentemente {count} cliente(s) junto con sus registros de tráfico. La etiqueta de grupo también se limpia. Esto no se puede deshacer.",
"deleteClientsSuccess": "Eliminados {count} cliente(s).",
"deleteClientsMixed": "{ok} eliminados, {failed} omitidos",
"addToGroup": "Añadir clientes…",
"addToGroupTitle": "Añadir clientes al grupo «{name}»",
"addToGroupDesc": "Selecciona clientes para añadir a este grupo. Mantienen sus asociaciones de entrada existentes; solo cambia la etiqueta de grupo. Los clientes que ya están en este grupo no se muestran.",
"addToGroupEmpty": "No hay otros clientes disponibles para añadir.",
"addToGroupResult": "Añadidos {count} cliente(s) a {name}.",
"removeFromGroup": "Quitar clientes…",
"removeFromGroupTitle": "Quitar clientes del grupo «{name}»",
"removeFromGroupDesc": "Selecciona miembros para quitar de este grupo. Los clientes se conservan (usa «Eliminar clientes del grupo» para eliminarlos por completo).",
"removeFromGroupResult": "Quitados {count} cliente(s) de {name}."
},
"nodes": {
"addNode": "Agregar nodo",
"editNode": "Editar nodo",
"totalNodes": "Total de nodos",
"onlineNodes": "En línea",
"offlineNodes": "Sin conexión",
"avgLatency": "Latencia media",
"name": "Nombre",
"namePlaceholder": "p. ej. de-frankfurt-1",
"addressPlaceholder": "panel.example.com o 1.2.3.4",
"remark": "Notas",
"scheme": "Esquema",
"address": "Dirección",
"port": "Puerto",
"basePath": "Ruta base",
"apiToken": "Token API",
"apiTokenPlaceholder": "Token desde la página de Configuración del panel remoto",
"apiTokenHint": "El panel remoto expone su token de API en Configuraciones de Seguridad → Token de API.",
"apiTokenKeepHint": "Déjalo en blanco para mantener el token actual",
"allowPrivateAddress": "Permitir dirección privada",
"allowPrivateAddressHint": "Habilitar solo para nodos en una red privada o VPN.",
"outboundTag": "Outbound de conexión",
"outboundTagHint": "Enruta el tráfico de la API del panel de este nodo a través del outbound Xray seleccionado. Un inbound de puente loopback se agrega automáticamente a la configuración en ejecución y se aplica en vivo. Déjelo vacío para una conexión directa.",
"outboundTagPlaceholder": "Conexión directa",
"inboundSyncMode": "Importación de inbounds",
"inboundSyncModeHint": "Elige qué inbounds importar desde este nodo. Los nodos existentes importan todos de forma predeterminada.",
"allInbounds": "Todos los inbounds",
"selectedInbounds": "Inbounds seleccionados",
"inboundTags": "Inbounds",
"inboundTagsHint": "La selección se compara por la etiqueta del inbound. Una selección vacía no importa ninguno.",
"inboundTagsPlaceholder": "Carga y selecciona inbounds",
"loadInbounds": "Cargar inbounds desde el nodo",
"inboundsLoaded": "Se cargaron {{count}} inbounds",
"inboundsLoadFailed": "No se pudieron cargar los inbounds",
"enable": "Habilitado",
"status": "Estado",
"cpu": "CPU",
"mem": "Memoria",
"netUp": "Subida de red (KB/s)",
"netDown": "Bajada de red (KB/s)",
"uptime": "Tiempo activo",
"latency": "Latencia",
"lastHeartbeat": "Último latido",
"xrayVersion": "Versión de Xray",
"panelVersion": "Versión del panel",
"actions": "Acciones",
"probe": "Sondear ahora",
"updatePanel": "Actualizar panel",
"updateSelected": "Actualizar seleccionados ({count})",
"updateAvailable": "Actualización disponible",
"updateConfirmTitle": "¿Actualizar {count} nodo(s) a la última versión?",
"updateConfirmContent": "Cada nodo seleccionado descarga la última versión y se reinicia con ella. Solo se actualizan los nodos habilitados y en línea.",
"updateDevChannel": "Actualizar al canal de desarrollo (último commit)",
"testConnection": "Probar conexión",
"connectionOk": "Conexión correcta ({ms} ms)",
"connectionFailed": "Conexión fallida",
"never": "nunca",
"justNow": "ahora mismo",
"subNode": "Subnodo",
"subNodeTip": "Solo lectura: un nodo descendente al que se llega a través de {parent}. Gestiónalo desde el propio panel de {parent}.",
"deleteConfirmTitle": "¿Eliminar el nodo \"{name}\"?",
"deleteConfirmContent": "Esto detiene la monitorización del nodo. El panel remoto en sí no se ve afectado.",
"statusValues": {
"online": "En línea",
"offline": "Sin conexión",
"unknown": "Desconocido",
"xrayError": "Error de Xray",
"xrayStopped": "Detenido"
},
"toasts": {
"list": "Error al cargar los nodos",
"obtain": "Error al cargar el nodo",
"add": "Agregar nodo",
"update": "Actualizar nodo",
"delete": "Eliminar nodo",
"deleted": "Nodo eliminado",
"test": "Probar conexión",
"fillRequired": "El nombre, la dirección, el puerto y el token de API son obligatorios",
"probeFailed": "Sondeo fallido",
"updateStarted": "Actualización del panel iniciada",
"updateResult": "Actualización iniciada en {ok} nodo(s), {failed} fallaron",
"updateNoneEligible": "Selecciona al menos un nodo en línea y habilitado",
"saveMtls": "Guardar mTLS del nodo",
"reloadMtls": "Reload master mTLS credential"
},
"tlsVerifyMode": "Verificación TLS",
"tlsVerifyModeHint": "Cómo valida el panel el certificado HTTPS del nodo. Fijar u Omitir son para certificados autofirmados (solo nodos https).",
"tlsVerify": "Verificar (CA predeterminada)",
"tlsPin": "Fijar certificado (SHA-256)",
"tlsSkip": "Omitir verificación",
"tlsMtls": "TLS mutuo (certificado de cliente)",
"mtlsFormHint": "Este nodo autentica al panel con un certificado de cliente. Copia el CA de este panel desde la sección mTLS del nodo al nodo, configura su CA de confianza y luego reinícialo.",
"mtls": {
"title": "mTLS del nodo",
"intro": "TLS mutuo añade un factor de certificado de cliente además del token de API para las llamadas entre nodos. Es opcional: déjalo vacío para mantener solo la autenticación por token.",
"copyCa": "Copiar el CA de este panel",
"copyCaHint": "Entrega este CA a los nodos que gestiona este panel y luego configura su verificación TLS como TLS mutuo.",
"caCopied": "Certificado CA copiado al portapapeles",
"caFailed": "No se pudo obtener el certificado CA",
"trustLabel": "CA de confianza (panel superior)",
"trustHint": "Cuando este panel es a su vez un nodo, pega aquí el CA del panel que lo gestiona para exigir su certificado de cliente. Reinicia el panel para aplicar.",
"trustPlaceholder": "-----BEGIN CERTIFICATE-----",
"save": "Guardar CA de confianza",
"saved": "CA de confianza guardado — reinicia el panel para aplicar"
},
"tlsSkipWarning": "Omitir la verificación elimina la protección contra ataques de intermediario; el token de API podría ser interceptado. Es preferible fijar el certificado.",
"pinnedCert": "SHA-256 del certificado fijado",
"pinnedCertHint": "SHA-256 del certificado del nodo en base64 o hex. Usa Obtener para leerlo del nodo ahora.",
"pinnedCertPlaceholder": "SHA-256 en base64 o hex",
"fetchPin": "Obtener",
"pinFetched": "Se obtuvo el certificado actual del nodo",
"pinFetchFailed": "No se pudo obtener el certificado"
},
"settings": {
"defaultTag": "Predeterminado",
"title": "Configuraciones",
"save": "Guardar",
"infoDesc": "Cada cambio realizado aquí debe ser guardado. Por favor, reinicie el panel para aplicar los cambios.",
"restartPanel": "Reiniciar panel",
"restartPanelDesc": "¿Está seguro de que desea reiniciar el panel? Haga clic en Aceptar para reiniciar después de 3 segundos. Si no puede acceder al panel después de reiniciar, por favor, consulte la información de registro del panel en el servidor.",
"restartPanelSuccess": "El panel se reinició correctamente",
"actions": "Acciones",
"resetDefaultConfig": "Restablecer a Configuración Predeterminada",
"panelSettings": "Configuraciones del Panel",
"securitySettings": "Configuraciones de Seguridad",
"securityWarnings": "Advertencias de seguridad",
"panelExposed": "Es posible que su panel esté expuesto:",
"warnHttp": "El panel se sirve por HTTP sin cifrar — configure TLS para producción.",
"warnDefaultPort": "El puerto por defecto 2053 es conocido — cámbielo a uno aleatorio.",
"warnDefaultBasePath": "La ruta base por defecto \"/\" es conocida — cámbiela a una ruta aleatoria.",
"warnDefaultSubPath": "La ruta de suscripción por defecto \"/sub/\" es conocida — cámbiela.",
"warnDefaultJsonPath": "La ruta de suscripción JSON por defecto \"/json/\" es conocida — cámbiela.",
"TGBotSettings": "Bot de Telegram",
"panelListeningIP": "IP de Escucha del Panel",
"panelListeningIPDesc": "Dejar en blanco por defecto para monitorear todas las IPs.",
"panelListeningDomain": "Dominio de Escucha del Panel",
"panelListeningDomainDesc": "Dejar en blanco por defecto para monitorear todos los dominios e IPs.",
"panelPort": "Puerto del Panel",
"panelPortDesc": "El puerto utilizado para mostrar este panel.",
"publicKeyPath": "Ruta del Archivo de Clave Pública del Certificado del Panel",
"publicKeyPathDesc": "Complete con una ruta absoluta que comience con.",
"privateKeyPath": "Ruta del Archivo de Clave Privada del Certificado del Panel",
"privateKeyPathDesc": "Complete con una ruta absoluta que comience con.",
"panelUrlPath": "Ruta URI",
"panelUrlPathDesc": "Debe empezar con '/' y terminar con.",
"pageSize": "Tamaño de paginación",
"pageSizeDesc": "Defina el tamaño de página para la tabla de entradas. Establezca 0 para desactivar",
"panelOutbound": "Salida del tráfico del panel",
"panelOutboundDesc": "Enruta las peticiones del propio panel — comprobaciones de versión y descargas de panel/Xray, Telegram y la actualización normal de archivos geo — a través de esta salida de Xray para sortear el filtrado de GitHub/Telegram en el servidor. Una entrada puente local se añade automáticamente a la configuración en ejecución y se aplica en vivo. La Autoactualización de Geodata nativa de Xray no se ve afectada; tiene su propia salida de descarga. Deja vacío para conexión directa.",
"panelOutboundPh": "Conexión directa",
"datepicker": "selector de fechas",
"datepickerPlaceholder": "Seleccionar fecha",
"datepickerDescription": "El tipo de calendario selector especifica la fecha de vencimiento",
"oldUsername": "Nombre de Usuario Actual",
"currentPassword": "Contraseña Actual",
"newUsername": "Nuevo Nombre de Usuario",
"newPassword": "Nueva Contraseña",
"telegramBotEnable": "Habilitar bot de Telegram",
"telegramBotEnableDesc": "Conéctese a las funciones de este panel a través del bot de Telegram.",
"telegramToken": "Token de Telegram",
"telegramTokenDesc": "Debe obtener el token del administrador de bots de Telegram {'@'}botfather.",
"telegramProxy": "Proxy SOCKS",
"telegramProxyDesc": "Si necesita el proxy Socks5 para conectarse a Telegram. Ajuste su configuración según la guía.",
"telegramAPIServer": "Servidor API de Telegram",
"telegramAPIServerDesc": "El servidor API de Telegram a utilizar. Déjelo en blanco para utilizar el servidor predeterminado.",
"telegramChatId": "IDs de Chat de Telegram para Administradores",
"telegramChatIdDesc": "IDs de Chat múltiples separados por comas. Use {'@'}userinfobot o use el comando '/id' en el bot para obtener sus IDs de Chat.",
"telegramNotifyTime": "Hora de Notificación del Bot de Telegram",
"telegramNotifyTimeDesc": "Con qué frecuencia el bot de Telegram envía informes periódicos. Elige un intervalo predefinido o selecciona Personalizado para introducir una expresión crontab.",
"notifyTime": {
"every": "@every — repetir en un intervalo",
"hourly": "@hourly — cada hora",
"daily": "@daily — cada día a las 00:00",
"weekly": "@weekly — cada semana",
"monthly": "@monthly — cada mes",
"custom": "Personalizado (crontab)",
"seconds": "Segundos",
"minutes": "Minutos",
"hours": "Horas",
"interval": "Intervalo",
"unit": "Unidad"
},
"tgNotifyBackup": "Respaldo de Base de Datos",
"tgNotifyBackupDesc": "Incluir archivo de respaldo de base de datos con notificación de informe.",
"tgNotifyLogin": "Notificación de Inicio de Sesión",
"tgNotifyLoginDesc": "Muestra el nombre de usuario, dirección IP y hora cuando alguien intenta iniciar sesión en su panel.",
"sessionMaxAge": "Edad Máxima de Sesión",
"sessionMaxAgeDesc": "La duración de una sesión de inicio de sesión (unidad: minutos).",
"expireTimeDiff": "Umbral de Expiración para Notificación",
"expireTimeDiffDesc": "Reciba notificaciones sobre la expiración de la cuenta antes del umbral (unidad: días).",
"trafficDiff": "Umbral de Tráfico para Notificación",
"trafficDiffDesc": "Reciba notificaciones sobre el agotamiento del tráfico antes de alcanzar el umbral (unidad: GB).",
"tgNotifyCpu": "Umbral de Alerta de Porcentaje de CPU",
"tgNotifyCpuDesc": "Reciba notificaciones si el uso de la CPU supera este umbral (unidad: %).",
"timeZone": "Zona Horaria",
"timeZoneDesc": "Las tareas programadas se ejecutan de acuerdo con la hora en esta zona horaria.",
"subSettings": "Suscripción",
"subEnable": "Habilitar Servicio",
"subEnableDesc": "Función de suscripción con configuración separada.",
"subJsonEnable": "Habilitar/Deshabilitar el endpoint de suscripción JSON de forma independiente.",
"subJsonEnableTitle": "Suscripción JSON",
"subClashEnableTitle": "Suscripción Clash / Mihomo",
"subFormatsTipTitle": "Configuración de suscripción específica por formato",
"subFormatsTipDesc": "Configura por separado las rutas URL, las URL inversas y la detección automática de clientes para JSON y Clash / Mihomo.",
"subFormatsTipAction": "Abrir formatos de suscripción",
"subJsonAutoDetect": "Detectar automáticamente clientes Xray JSON",
"subJsonAutoDetectDesc": "Al activarlo, los clientes compatibles reconocidos que soliciten la URL de suscripción estándar recibirán automáticamente una matriz de configuraciones Xray JSON. Los demás clientes conservarán la respuesta sin procesar/Base64. Requiere activar la suscripción JSON y reiniciar el panel.",
"subJsonAlwaysArray": "Devolver siempre una matriz JSON",
"subJsonAlwaysArrayDesc": "Devuelve el endpoint JSON explícito como una matriz incluso con un solo perfil, según el estándar XTLS. Las respuestas JSON detectadas automáticamente siempre usan matrices. Desactívalo para conservar la respuesta heredada de un solo objeto.",
"subJsonUserAgentRegex": "Expresión User-Agent de Xray JSON",
"subJsonUserAgentRegexDesc": "Expresión regular Go RE2 que se compara con el User-Agent del cliente para seleccionar automáticamente el formato Xray JSON en la URL de suscripción estándar. Vacía de forma predeterminada, por lo que la detección automática permanece desactivada hasta que definas un patrón para los clientes que quieras atender. Los demás clientes conservan la respuesta sin procesar/Base64. Reinicia el panel después de cambiarla.",
"subClashAutoDetect": "Detectar automáticamente clientes Clash/Mihomo",
"subClashAutoDetectDesc": "Al activarlo, los clientes Clash/Mihomo reconocidos que soliciten la URL de suscripción estándar recibirán automáticamente YAML de Clash. Los navegadores seguirán mostrando la página de suscripción, los demás clientes conservarán la respuesta sin procesar/Base64 y las URL explícitas de JSON y Clash seguirán disponibles. Requiere activar la suscripción Clash/Mihomo y reiniciar el panel para aplicar el cambio.",
"subClashUserAgentRegex": "Expresión User-Agent de Clash/Mihomo",
"subClashUserAgentRegexDesc": "Expresión regular Go RE2 que se compara con el User-Agent del cliente para reconocer clientes Clash/Mihomo en la URL de suscripción estándar. Déjala vacía para usar el patrón predeterminado. Reinicia el panel después de cambiarla.",
"subTitle": "Título de la Suscripción",
"subTitleDesc": "Título mostrado en el cliente VPN. Admite tokens de identidad del cliente: {{EMAIL}}, {{ID}}, {{SHORT_ID}}, {{SUB_ID}}, {{TELEGRAM_ID}}.",
"subSupportUrl": "URL de soporte",
"subSupportUrlDesc": "Enlace de soporte técnico mostrado en el cliente VPN. Admite tokens de identidad del cliente: {{EMAIL}}, {{ID}}, {{SHORT_ID}}, {{SUB_ID}}, {{TELEGRAM_ID}}.",
"subProfileUrl": "URL del perfil",
"subProfileUrlDesc": "Un enlace a tu sitio web mostrado en el cliente VPN. Admite tokens de identidad del cliente: {{EMAIL}}, {{ID}}, {{SHORT_ID}}, {{SUB_ID}}, {{TELEGRAM_ID}}.",
"subAnnounce": "Anuncio",
"subAnnounceDesc": "El texto del anuncio mostrado en el cliente VPN. Admite tokens de identidad del cliente: {{EMAIL}}, {{ID}}, {{SHORT_ID}}, {{SUB_ID}}, {{TELEGRAM_ID}}.",
"subThemeDir": "Directorio del tema de suscripción",
"subThemeDirDesc": "Ruta absoluta a una carpeta que contiene una plantilla personalizada (index.html/sub.html) para la página de suscripción (p. ej. /etc/3x-ui/sub_templates/my-theme/). Déjalo vacío para usar la página predeterminada.",
"subThemeDirDocs": "Guía de plantillas ↗",
"subEnableRouting": "Habilitar enrutamiento",
"subEnableRoutingDesc": "Configuración global para habilitar el enrutamiento en el cliente VPN. (Solo para Happ)",
"subRoutingRules": "Reglas de enrutamiento",
"subRoutingRulesDesc": "Pegue un enlace happ:// listo o una URL HTTPS permanente. El panel actualiza las reglas remotas en segundo plano y conserva el último valor válido, sin retrasar las solicitudes de suscripción. (Solo para Happ)",
"subHideSettings": "Ocultar configuración del servidor",
"subHideSettingsDesc": "Ocultar la posibilidad de ver y editar las configuraciones del servidor en el cliente VPN. (Solo para Happ)",
"subIncyEnableRouting": "Habilitar enrutamiento",
"subIncyEnableRoutingDesc": "Inyectar un perfil de enrutamiento en el cuerpo de la suscripción para el cliente Incy. (Solo para Incy)",
"subIncyRoutingRules": "Reglas de enrutamiento",
"subIncyRoutingRulesDesc": "Pegue un enlace incy:// listo o una URL HTTPS permanente a JSON. Incy crea un perfil de autorouting y lo actualiza automáticamente. (Solo para Incy)",
"subClashEnableRouting": "Habilitar enrutamiento",
"subClashEnableRoutingDesc": "Incluir reglas globales de enrutamiento Clash/Mihomo en las suscripciones YAML generadas.",
"subClashRoutingRules": "Reglas globales de enrutamiento",
"subClashRoutingRulesDesc": "Pegue reglas/YAML o una URL HTTPS permanente. El panel la actualiza en segundo plano, importa solo grupos, proveedores de reglas y reglas, y conserva los nodos VPN generados y el último valor válido.",
"subListen": "Listening IP",
"subListenDesc": "Dejar en blanco por defecto para monitorear todas las IPs.",
"subPort": "Puerto de Suscripción",
"subPortDesc": "El número de puerto para el servicio de suscripción debe estar sin usar en el servidor. También se usa para construir el enlace/QR de suscripción mostrado en el panel cuando «URI de proxy inverso» está vacío — si la suscripción se accede a través de un proxy inverso en otro puerto, configure «URI de proxy inverso» en su lugar.",
"subCertPath": "Ruta del Archivo de Clave Pública del Certificado de Suscripción",
"subCertPathDesc": "Complete con una ruta absoluta que comience con '/'",
"subKeyPath": "Ruta del Archivo de Clave Privada del Certificado de Suscripción",
"subKeyPathDesc": "Complete con una ruta absoluta que comience con '/'",
"subPath": "Ruta URI",
"subPathDesc": "Debe empezar con '/' y terminar con '/'",
"subDomain": "Dominio de Escucha",
"subDomainDesc": "Dejar en blanco por defecto para monitorear todos los dominios e IPs. También se usa como dominio de reserva para el enlace de suscripción mostrado cuando «URI de proxy inverso» está vacío — configure «URI de proxy inverso» si el panel y la suscripción se acceden por dominios diferentes (por ejemplo, detrás de un proxy inverso).",
"subUpdates": "Intervalos de Actualización de Suscripción",
"subUpdatesDesc": "Horas de intervalo entre actualizaciones en la aplicación del cliente.",
"subEncrypt": "Codificar",
"subEncryptDesc": "Encriptar las configuraciones devueltas en la suscripción.",
"subURI": "URI de proxy inverso",
"subURIDesc": "La URL base completa (scheme://dominio[:puerto]/ruta/) para el enlace de suscripción y el código QR, usada en lugar de Dominio de Escucha/Puerto de Suscripción. Configúrela cuando la suscripción se acceda a través de un proxy inverso o un dominio/puerto distinto a los anteriores.",
"externalTrafficInformEnable": "Informe de tráfico externo",
"externalTrafficInformEnableDesc": "Informar a una API externa en cada actualización de tráfico.",
"externalTrafficInformURI": "URI de información de tráfico externo",
"externalTrafficInformURIDesc": "Las actualizaciones de tráfico se envían a este URI.",
"restartXrayOnClientDisable": "Reiniciar Xray tras desactivación automática",
"restartXrayOnClientDisableDesc": "Cuando un cliente se desactive automáticamente por vencimiento o límite de tráfico, reiniciar Xray.",
"fragment": "Fragmentación",
"fragmentDesc": "Habilitar la fragmentación para el paquete de saludo de TLS",
"fragmentSett": "Configuración de Fragmentación",
"noisesDesc": "Activar Sonidos",
"noisesSett": "Configuración de Sonidos",
"trustedProxyCidrs": "CIDR de proxy de confianza",
"trustedProxyCidrsDesc": "IP/CIDR separados por coma que pueden establecer las cabeceras de host, proto e IP del cliente reenviadas.",
"ldap": {
"enable": "Habilitar sincronización LDAP",
"host": "Host LDAP",
"port": "Puerto LDAP",
"useTls": "Usar TLS (LDAPS)",
"skipTlsVerify": "Omitir verificación de certificado TLS",
"skipTlsVerifyDesc": "Inseguro — desactiva la validación del certificado del servidor. Usar solo con CA internos/no confiables.",
"bindDn": "Bind DN",
"passwordConfigured": "Configurada; deja en blanco para mantener la contraseña actual.",
"passwordUnconfigured": "No configurada.",
"passwordPlaceholder": "Configurada — introduce un nuevo valor para reemplazar",
"baseDn": "Base DN",
"userFilter": "Filtro de usuario",
"userAttr": "Atributo de usuario (username/email)",
"vlessField": "Atributo flag VLESS",
"flagField": "Atributo flag genérico (opcional)",
"flagFieldDesc": "Si se establece, sobrescribe el flag VLESS — p. ej. shadowInactive.",
"truthyValues": "Valores truthy",
"truthyValuesDesc": "Separados por coma; por defecto: true,1,yes,on",
"invertFlag": "Invertir flag",
"invertFlagDesc": "Habilita cuando el atributo significa «deshabilitado» (p. ej. shadowInactive).",
"syncSchedule": "Programación de sincronización",
"syncScheduleDesc": "Cadena tipo cron, p. ej. @every 1m",
"inboundTags": "Etiquetas de entradas",
"inboundTagsDesc": "Entradas en las que la sincronización LDAP puede auto-crear o auto-eliminar clientes.",
"noInbounds": "No se encontraron entradas. Crea una en Entradas primero.",
"autoCreate": "Crear clientes automáticamente",
"autoDelete": "Eliminar clientes automáticamente",
"defaultTotalGb": "Total por defecto (GB)",
"defaultExpiryDays": "Caducidad por defecto (días)",
"defaultIpLimit": "Límite IP por defecto"
},
"subFormats": {
"finalMask": "Final Mask",
"finalMaskDesc": "Inyecta máscaras TCP/UDP de finalmask de Xray y parámetros QUIC en cada perfil Xray JSON generado. Requiere una aplicación compatible con suscripciones Xray JSON y un núcleo Xray reciente.",
"packets": "Paquetes",
"length": "Longitud",
"interval": "Intervalo",
"maxSplit": "Máx. división",
"noises": "Ruidos",
"noiseItem": "Ruido №{n}",
"type": "Tipo",
"packet": "Paquete",
"delayMs": "Retraso (ms)",
"applyTo": "Aplicar a",
"addNoise": "+ Ruido",
"concurrency": "Concurrencia",
"xudpConcurrency": "Concurrencia xudp",
"xudpUdp443": "xudp UDP 443"
},
"mux": "Mux",
"muxDesc": "Transmite múltiples flujos de datos independientes dentro de un flujo de datos establecido.",
"muxSett": "Configuración Mux",
"direct": "Conexión Directa",
"directDesc": "Establece conexiones directas con dominios o rangos de IP de un país específico.",
"notifications": "Notificaciones",
"certs": "Certificados",
"externalTraffic": "Tráfico Externo",
"dateAndTime": "Fecha y Hora",
"proxyAndServer": "Proxy y Servidor",
"intervals": "Intervalos",
"information": "Información",
"profile": "Perfil",
"language": "Idioma",
"telegramBotLanguage": "Idioma del Bot de Telegram",
"security": {
"admin": "Credenciales de administrador",
"twoFactor": "Autenticación de dos factores",
"twoFactorEnable": "Habilitar 2FA",
"twoFactorEnableDesc": "Añade una capa adicional de autenticación para mayor seguridad.",
"twoFactorModalSetTitle": "Activar autenticación de dos factores",
"twoFactorModalDeleteTitle": "Desactivar autenticación de dos factores",
"twoFactorModalSteps": "Para configurar la autenticación de dos factores, sigue estos pasos:",
"twoFactorModalFirstStep": "1. Escanea este código QR en la aplicación de autenticación o copia el token cerca del código QR y pégalo en la aplicación",
"twoFactorModalSecondStep": "2. Ingresa el código de la aplicación",
"twoFactorModalRemoveStep": "Ingresa el código de la aplicación para eliminar la autenticación de dos factores.",
"twoFactorModalChangeCredentialsTitle": "Cambiar credenciales",
"twoFactorModalChangeCredentialsStep": "Ingrese el código de la aplicación para cambiar las credenciales del administrador.",
"twoFactorModalSetSuccess": "La autenticación de dos factores se ha establecido con éxito",
"twoFactorModalDeleteSuccess": "La autenticación de dos factores se ha eliminado con éxito",
"twoFactorModalError": "Código incorrecto",
"show": "Mostrar",
"hide": "Ocultar",
"apiTokenNew": "Nuevo token",
"apiTokenName": "Nombre",
"apiTokenNamePlaceholder": "por ejemplo central-panel-a",
"apiTokenNameRequired": "El nombre es obligatorio",
"apiTokenEmpty": "Aún no hay tokens — crea uno para autenticar bots o paneles remotos.",
"apiTokenDeleteWarning": "Cualquier cliente que use este token dejará de autenticarse inmediatamente.",
"apiTokenCreatedTitle": "Token creado",
"apiTokenCreatedNotice": "Copia este token ahora. Por seguridad, no se almacena de forma legible y no se volverá a mostrar."
},
"toasts": {
"modifySettings": "Los parámetros han sido modificados.",
"getSettings": "Ocurrió un error al obtener los parámetros.",
"modifyUserError": "Ocurrió un error al cambiar las credenciales del administrador.",
"modifyUser": "Has cambiado exitosamente las credenciales del administrador.",
"originalUserPassIncorrect": "Nombre de usuario o contraseña original incorrectos",
"userPassMustBeNotEmpty": "El nuevo nombre de usuario y la nueva contraseña no pueden estar vacíos",
"getOutboundTrafficError": "Error al obtener el tráfico saliente",
"resetOutboundTrafficError": "Error al reiniciar el tráfico saliente"
},
"smtpSettings": "Configuración de SMTP",
"smtpEnable": "Activar notificaciones por correo",
"smtpEnableDesc": "Activar notificaciones por correo mediante SMTP",
"smtpHost": "Servidor SMTP",
"smtpHostDesc": "Nombre del servidor SMTP (p. ej. smtp.gmail.com)",
"smtpPort": "Puerto SMTP",
"smtpPortDesc": "Puerto del servidor SMTP (predeterminado: 587)",
"smtpUsername": "Usuario SMTP",
"smtpUsernameDesc": "Usuario de autenticación SMTP",
"smtpFrom": "Dirección de remitente (From)",
"smtpFromDesc": "Dirección usada en el encabezado From del correo. Déjelo vacío para usar el nombre de usuario.",
"smtpFromName": "Nombre del remitente (From)",
"smtpFromNameDesc": "Nombre para mostrar opcional antes de la dirección en el encabezado From.",
"smtpPassword": "Contraseña SMTP",
"smtpPasswordDesc": "Contraseña de autenticación SMTP",
"smtpTo": "Destinatarios",
"smtpToDesc": "Direcciones de correo de los destinatarios separadas por comas",
"emailSettings": "Correo",
"emailNotifications": "Notificaciones",
"smtpEventBusNotify": "Notificaciones por correo de eventos",
"smtpEventBusNotifyDesc": "Seleccione qué eventos generan notificaciones por correo",
"tgEventBusNotify": "Notificaciones de Telegram de eventos",
"tgEventBusNotifyDesc": "Seleccione qué eventos generan notificaciones de Telegram",
"testSmtp": "Enviar correo de prueba",
"testTgBot": "Enviar mensaje de prueba",
"eventGroupOutbound": "Saliente",
"eventGroupXray": "Núcleo de Xray",
"eventGroupSystem": "Sistema",
"eventGroupSecurity": "Seguridad",
"eventGroupNode": "Nodos",
"eventOutboundDown": "Caído",
"eventOutboundUp": "Activo",
"eventXrayCrash": "Caída",
"eventNodeDown": "Caído",
"eventNodeUp": "Activo",
"eventCPUHigh": "CPU alta (%)",
"requestFailed": "La solicitud falló",
"smtpEncryption": "Cifrado",
"smtpEncryptionDesc": "Método de cifrado de la conexión SMTP",
"smtpEncryptionNone": "Ninguno (texto sin cifrar)",
"smtpEncryptionStartTLS": "STARTTLS",
"smtpEncryptionTLS": "TLS (implícito)",
"smtpStageConnect": "Conexión",
"smtpStageAuth": "Autenticación",
"smtpStageSend": "Envío",
"smtpTestSuccess": "Correo de prueba enviado correctamente",
"smtpHostNotConfigured": "Servidor SMTP no configurado",
"smtpNoRecipients": "No hay destinatarios configurados",
"smtpFromNotConfigured": "La dirección del remitente SMTP no está configurada",
"eventLoginAttempt": "Intento de inicio de sesión",
"telegramTokenConfigured": "Configurado; deje en blanco para mantener el token actual.",
"telegramTokenPlaceholder": "Configurado: introduzca un nuevo token para reemplazarlo",
"smtpPasswordConfigured": "Configurada; deje en blanco para mantener la contraseña actual.",
"smtpPasswordPlaceholder": "Configurada: introduzca una nueva contraseña para reemplazarla",
"smtpNotInitialized": "SMTP no inicializado",
"tgBotNotEnabled": "El bot de Telegram no está activado",
"tgTestFailed": "La prueba de Telegram falló",
"tgTestSuccess": "Mensaje de prueba enviado a Telegram",
"tgBotNotRunning": "El bot de Telegram no está en ejecución",
"smtpErrorAuth": "Error de autenticación: compruebe el usuario y la contraseña",
"smtpErrorStarttls": "El servidor requiere STARTTLS: cambie el tipo de cifrado",
"smtpErrorTls": "El servidor requiere TLS: cambie el tipo de cifrado",
"smtpErrorRefused": "Conexión rechazada: compruebe el servidor y el puerto",
"smtpErrorTimeout": "Tiempo de conexión agotado: servidor inaccesible",
"smtpErrorRelay": "El servidor rechaza el envío desde esta dirección",
"smtpErrorEof": "Conexión cerrada por el servidor",
"smtpErrorUnknown": "Error de SMTP: {{ .Error }}",
"eventMemoryHigh": "Uso de memoria alto (%)",
"remarkTemplate": "Plantilla de notas",
"remarkTemplateDesc": "Cuando se define, esto reemplaza el modelo de notas para cada enlace de suscripción — escribe tu propio formato con los tokens de variable (usa el botón para insertarlos). Déjalo vacío para usar el modelo anterior.",
"subShowIdentityOnAllLinks": "Mostrar identidad en cada enlace",
"subShowIdentityOnAllLinksDesc": "Si está activado, {{EMAIL}} y {{USERNAME}} permanecen en la nota de cada enlace del cuerpo de la suscripción. Los tokens de uso siguen solo en el primer enlace.",
"validation": {
"pathLeadingSlash": "La ruta debe comenzar con /"
},
"secretClear": "Borrar",
"secretClearUndo": "Deshacer borrado",
"calendarGregorian": "Gregorian (Standard)",
"calendarJalalian": "Jalalian (شمسی)",
"ipLimitAllowlist": "Lista de permitidos del límite de IP",
"ipLimitAllowlistDesc": "Direcciones y redes que el límite de IP nunca cuenta ni banea, para que una dirección compartida de oficina o campus no agote el límite de un cliente. IP/CIDR separados por coma.",
"subBalancers": {
"menu": "Balanceadores de suscripción",
"title": "Balanceador de suscripción",
"add": "Añadir balanceador",
"desc": "Cada balanceador activo se añade a la suscripción JSON como un perfil adicional que elige automáticamente el mejor de los endpoints de los inbounds seleccionados.",
"remark": "Comentario",
"remarkPlaceholder": "Auto · el más rápido",
"strategy": "Estrategia",
"strategyLeastLoad": "Menor carga",
"strategyLeastPing": "Menor ping",
"strategyRandom": "Aleatorio",
"strategyRoundRobin": "Round robin",
"sortOrder": "Orden",
"sortOrderHelp": "Posición en la lista de la suscripción, intercalada con el orden de los inbounds; con el mismo número, el balanceador va después del inbound.",
"inbounds": "Inbounds",
"inboundsCount": "{count} Inbounds",
"enabled": "Activado",
"empty": "Aún no hay balanceadores",
"deleteConfirm": "¿Eliminar este balanceador?",
"errRemarkRequired": "El comentario es obligatorio",
"errInboundsRequired": "Selecciona al menos un inbound",
"errSortOrder": "El orden debe ser un número entero ≥ 1",
"toasts": {
"list": "No se pudieron listar los balanceadores de suscripción",
"create": "No se pudo crear el balanceador de suscripción",
"update": "No se pudo actualizar el balanceador de suscripción",
"delete": "No se pudo eliminar el balanceador de suscripción",
"invalidId": "Id no válido"
},
"tabBalancers": "Equilibradores",
"tabObservatory": "Observatorio",
"observatory": {
"title": "Observatorio del balanceador",
"desc": "Parámetros de probe para el burstObservatory incluido en cada perfil leastPing/leastLoad. random/roundRobin no generan observatorio. Se guarda como ajuste global de la suscripción JSON.",
"destination": "URL de probe",
"destinationDesc": "Dirección que el cliente sondea para medir cada salida miembro.",
"connectivity": "URL de conectividad",
"connectivityDesc": "Dirección opcional para verificar una vez que el miembro llega al destino. Vacío para omitir.",
"interval": "Intervalo de probe",
"intervalDesc": "Tiempo entre rondas de probe, p. ej. 1m.",
"timeout": "Tiempo de espera de probe",
"timeoutDesc": "Tiempo de espera de cada probe, p. ej. 5s.",
"sampling": "Muestreo",
"samplingDesc": "Número de probes consecutivos para promediar estabilidad.",
"httpMethod": "Método HTTP",
"httpMethodDesc": "Método usado para las solicitudes de probe.",
"note": "Los balanceadores leastPing/leastLoad siempre llevan un burstObservatory. Este interruptor personaliza sus parámetros de probe — apágalo para usar los valores predeterminados integrados. Los cambios se aplican tras reiniciar el panel."
}
}
},
"xray": {
"save": "Guardar configuración",
"restartSuccess": "Xray se ha reiniciado correctamente",
"stopSuccess": "Xray se ha detenido correctamente",
"restartError": "Ocurrió un error al reiniciar Xray.",
"stopError": "Ocurrió un error al detener Xray.",
"basicTemplate": "Perfil Básico",
"advancedTemplate": "Perfil Avanzado",
"generalConfigs": "Configuraciones Generales",
"generalConfigsDesc": "Estas opciones proporcionarán ajustes generales.",
"logConfigs": "Registro",
"logConfigsDesc": "Los registros pueden afectar la eficiencia de su servidor. Se recomienda habilitarlos sabiamente solo en caso de sus necesidades.",
"basicRouting": "Enrutamiento Básico",
"blockConnectionsConfigsDesc": "Estas opciones bloquearán el tráfico según el país solicitado específico.",
"directConnectionsConfigsDesc": "Una conexión directa asegura que el tráfico específico no sea enrutado a través de otro servidor.",
"blockips": "Bloquear IPs",
"blockdomains": "Bloquear Dominios",
"directips": "IPs Directas",
"directdomains": "Dominios Directos",
"ipv4Routing": "Enrutamiento IPv4",
"ipv4RoutingDesc": "Estas opciones solo enrutarán a los dominios objetivo a través de IPv4.",
"Template": "Plantilla de Configuración de Xray",
"TemplateDesc": "Genera el archivo de configuración final de Xray basado en esta plantilla.",
"FreedomStrategy": "Configurar Estrategia para el Protocolo Freedom",
"FreedomStrategyDesc": "Establece la estrategia de salida de la red en el Protocolo Freedom.",
"FreedomHappyEyeballs": "Freedom Happy Eyeballs (IPv4/IPv6)",
"FreedomHappyEyeballsDesc": "Marcado de doble pila para la salida directa (freedom): útil en servidores de salida con IPv4 e IPv6.",
"FreedomHappyEyeballsTryDelayDesc": "Milisegundos antes de probar la otra familia de direcciones. 150–250 ms es un buen punto de partida.",
"RoutingStrategy": "Configurar Estrategia de Enrutamiento de Dominios",
"RoutingStrategyDesc": "Establece la estrategia general de enrutamiento para la resolución de DNS.",
"outboundTestUrl": "URL de prueba de outbound",
"outboundTestUrlDesc": "URL usada al probar la conectividad del outbound",
"Torrent": "Prohibir Uso de BitTorrent",
"Inbounds": "Entradas",
"Outbounds": "Salidas",
"Balancers": "Equilibradores",
"balancerTagRequired": "La etiqueta es obligatoria",
"balancerSelectorRequired": "Elige al menos una salida",
"balancerLive": "Destino actual",
"balancerOverride": "Forzar destino",
"balancerOverridePh": "Automático (estrategia)",
"balancerLiveRefresh": "Actualizar estado del balanceador",
"balancerNotRunning": "Este balanceador no está activo en el Xray en ejecución — guarda los cambios o inicia Xray primero",
"routeTester": "Prueba de ruta",
"routeTesterDesc": "Pregunta al Xray en ejecución qué salida gestionaría una conexión. No se envía tráfico real — la decisión viene directamente del motor de enrutamiento en vivo.",
"routeTesterDest": "Dominio o IP",
"routeTesterPort": "Puerto",
"routeTesterInbound": "Entrante",
"routeTesterProtocol": "Protocolo detectado",
"routeTesterTest": "Probar ruta",
"routeTesterMatchedOutbound": "Salida coincidente",
"routeTesterViaBalancer": "vía balanceador",
"routeTesterDefaultOutbound": "Ninguna regla de enrutamiento coincidió — el tráfico va a la salida predeterminada (primera).",
"Routings": "Reglas de enrutamiento",
"completeTemplate": "Todo",
"logLevel": "Nivel de registro",
"logLevelDesc": "El nivel de registro para registros de errores, que indica la información que debe registrarse.",
"accessLog": "Registro de acceso",
"accessLogDesc": "La ruta del archivo para el registro de acceso. El valor especial 'ninguno' deshabilita los registros de acceso",
"errorLog": "Registro de Errores",
"errorLogDesc": "La ruta del archivo para el registro de errores. El valor especial 'none' desactiva los registros de errores.",
"dnsLog": "Registro DNS",
"dnsLogDesc": "Si habilitar los registros de consulta DNS",
"maskAddress": "Enmascarar Dirección",
"maskAddressDesc": "Máscara de dirección IP, cuando se habilita, reemplazará automáticamente la dirección IP que aparece en el registro.",
"statistics": "Estadísticas",
"statsInboundUplink": "Estadísticas de Subida de Entrada",
"statsInboundDownlink": "Estadísticas de Bajada de Entrada",
"statsOutboundUplink": "Estadísticas de Subida de Salida",
"statsOutboundDownlink": "Estadísticas de Bajada de Salida",
"connectionLimits": "Límites de conexión",
"connectionLimitsDesc": "Políticas a nivel de conexión para el nivel de usuario 0. Deja un campo vacío para usar el valor predeterminado de Xray.",
"connIdle": "Tiempo de inactividad",
"connIdleDesc": "Cierra una conexión después de que permanezca inactiva durante esta cantidad de segundos. Reducirlo libera memoria y descriptores de archivo más rápido en servidores con mucha carga (predeterminado de Xray: 300).",
"bufferSize": "Tamaño del búfer",
"bufferSizeDesc": "Tamaño del búfer interno por conexión en KB. Ponlo en 0 para minimizar el uso de memoria en servidores con poca RAM (el valor predeterminado de Xray depende de la plataforma).",
"bufferSizePlaceholder": "automático",
"seconds": "segundos",
"importRules": "Importar reglas",
"exportRules": "Exportar reglas",
"importOutbounds": "Importar salidas",
"exportOutbounds": "Exportar salidas",
"importInvalidJson": "JSON no válido — se esperaba un array o un objeto con una clave coincidente.",
"metricsListen": "Punto de métricas",
"metricsListenDesc": "Expone las métricas estilo Prometheus de Xray en esta dirección:puerto (por ejemplo, 127.0.0.1:11111). Déjalo vacío para deshabilitarlo. Vincúlalo a localhost y ponlo tras un proxy inverso — no está autenticado.",
"metricsTag": "Etiqueta de métricas",
"rules": {
"source": "Fuente",
"dest": "Destino",
"inbound": "Entrante",
"balancer": "Equilibrador",
"useComma": "Elementos separados por comas"
},
"routing": {
"dragToReorder": "Arrastra para reordenar"
},
"geoBrowser": {
"title": "Categorías geo",
"openTooltip": "Explorar categorías geo",
"database": "Base de datos",
"searchCategory": "Buscar categoría",
"searchEntries": "Filtrar dentro de la categoría",
"selectFound": "Seleccionar encontradas",
"selected": "Seleccionadas: {count}",
"clearAll": "Limpiar todo",
"apply": "Aplicar",
"emptySelection": "Marca categorías: se convertirán en tokens de la regla",
"pickCategory": "Elige una categoría a la izquierda para ver su contenido",
"noMatches": "No se encontró nada",
"noFiles": "No hay bases geo en la carpeta de Xray",
"noFilesHint": "Aparecerán cuando Xray descargue geosite.dat y geoip.dat",
"fileMeta": "{count} categorías · {size} · actualizado {date}",
"entriesCount": "{count} entradas",
"subnetsCount": "{count} subredes",
"shownRange": "Mostrando {from}–{to} de {total}",
"loadFailed": "No se pudieron cargar las bases geo",
"checkFailed": "No se pudieron verificar estos valores con las bases geo",
"parseFailed": "Archivo dañado o no es una base geosite/geoip",
"tooLarge": "Demasiado grande para explorarlo",
"unknownCategories": "No están en la base: {tokens}",
"missingDatabase": "No se encontró el archivo de la base: {tokens} — añádelo en la sección Geodata",
"unknownAttribute": "Atributo no encontrado, la regla no coincidirá con nada: {tokens}",
"invalidToken": "Xray no aceptará esta entrada: {tokens}",
"wrongKind": "Tipo de base incorrecto para este campo: {tokens}"
},
"ruleForm": {
"sourceIps": "IPs de origen",
"sourcePort": "Puerto de origen",
"vlessRoute": "Ruta VLESS",
"attributes": "Atributos",
"value": "Valor",
"user": "Usuario",
"userPlaceholder": "Seleccionar usuarios",
"userEmpty": "No hay usuarios disponibles",
"userLoadError": "No se pudieron cargar los usuarios",
"inboundTags": "Etiquetas de entradas",
"outboundTag": "Etiqueta de salida",
"balancerTag": "Etiqueta de balanceador",
"balancerTagTooltip": "Enruta el tráfico a través de uno de los balanceadores configurados"
},
"outboundForm": {
"tagDuplicate": "Etiqueta ya usada por otra salida",
"tagRequired": "La etiqueta es obligatoria",
"tagPlaceholder": "etiqueta-única",
"localIpPlaceholder": "IP local",
"dialerProxyPlaceholder": "Selecciona una salida para encadenar",
"dialerProxyHint": "Conecta esta salida a través de otra salida (por etiqueta) para crear una cadena de proxy. Déjalo vacío para conectar directamente.",
"targetStrategyHint": "Cómo se resuelve el dominio de destino antes de conectar: AsIs (predeterminado) lo envía sin resolver, UseIP… resuelve con respaldo, ForceIP… exige resolución.",
"addressRequired": "La dirección es obligatoria",
"portRequired": "El puerto es obligatorio",
"optional": "opcional",
"udpOverTcp": "UDP sobre TCP",
"uotVersion": "Versión UoT",
"inboundTag": "Etiqueta de entrada",
"inboundTagPlaceholder": "etiqueta de entrada usada en reglas de enrutamiento",
"responseType": "Tipo de respuesta",
"rewriteNetwork": "Reescribir red",
"unchanged": "(sin cambios)",
"unchangedAddress": "(sin cambios) p. ej. 1.1.1.1",
"rules": "Reglas",
"ruleN": "Regla {n}",
"action": "Acción",
"redirect": "Redirect",
"finalRules": "Reglas finales",
"overrideXrayPrivateIp": "Sobrescribir el bloqueo de IP privada por defecto de Xray",
"blockDelay": "Retraso de bloqueo (ms)",
"reverseSniffing": "Sniffing inverso",
"reserved": "Reservado",
"minUploadInterval": "Intervalo mín. de subida (ms)",
"maxUploadSizeBytes": "Tamaño máx. de subida (bytes)",
"uplinkChunkSize": "Tamaño de chunk Uplink",
"noGrpcHeader": "Sin cabecera gRPC",
"maxConcurrency": "Máx. concurrencia",
"maxConnections": "Máx. conexiones",
"maxReuseTimes": "Máx. reutilizaciones",
"maxRequestTimes": "Máx. peticiones",
"maxReusableSecs": "Máx. segundos reutilizables",
"keepAlivePeriod": "Periodo keep alive",
"authPassword": "Contraseña de auth",
"visionTestpre": "Vision testpre",
"serverNamePlaceholder": "nombre del servidor",
"verifyPeerName": "Verificar nombre del peer",
"pinnedSha256": "SHA256 pinned",
"shortId": "Short ID",
"sockopts": "Sockopts",
"keepAliveInterval": "Intervalo keep alive",
"markFwmark": "Mark (fwmark)",
"interface": "Interfaz",
"proxyProtocol": "Proxy protocol",
"tcpUserTimeoutMs": "TCP user timeout (ms)",
"tcpKeepAliveIdleS": "TCP keep-alive idle (s)"
},
"outbound": {
"tag": "Etiqueta",
"egress": "Egress",
"egressHint": "Run an HTTP test to show egress IP and country.",
"outboundStatus": "Estado de Salida",
"sendThrough": "Enviar a través de",
"targetStrategy": "Estrategia de destino",
"modeRealDelay": "Retardo real",
"testModeTooltip": "TCP: sonda rápida solo de dial. HTTP: petición completa a través de xray. Retardo real: tiempo total incluyendo el establecimiento de la conexión.",
"testAll": "Probar todo",
"httpStatus": "Estado HTTP",
"breakdownConnect": "Conexión al proxy",
"breakdownTls": "TLS vía salida",
"breakdownTtfb": "Primer byte",
"country": "País",
"server": "Servidor",
"city": "Ciudad",
"allCities": "Todas las ciudades",
"moveToTop": "Mover al principio"
},
"outboundSub": {
"manage": "Suscripciones",
"title": "Suscripciones de salida",
"remark": "Notas (opcional)",
"remarkPlaceholder": "p. ej. nodos HK",
"url": "URL de suscripción",
"urlPlaceholder": "https://... (lista de enlaces en base64)",
"tagPrefix": "Prefijo de etiqueta",
"tagPrefixPlaceholder": "hk-",
"interval": "Intervalo de actualización",
"hours": "h",
"minutes": "min",
"intervalHint": "Por defecto 10 minutos. La tarea en segundo plano comprueba con frecuencia; cada suscripción solo vuelve a descargarse cuando ha transcurrido su propio intervalo.",
"enabled": "Habilitado",
"allowPrivate": "Permitir direcciones privadas",
"allowPrivateHint": "Permite localhost, la red local (LAN) y las IP privadas en la URL de esta suscripción. Desactivado por defecto por seguridad; actívalo solo para una fuente local de confianza.",
"prepend": "Antes de las salidas manuales",
"prependHint": "Coloca las salidas de esta suscripción antes de las configuradas manualmente, de modo que una de ellas pueda convertirse en la predeterminada.",
"preview": "Vista previa",
"previewEmpty": "No se encontraron salidas en esta URL.",
"refreshAll": "Actualizar todo",
"statusOk": "Correcto",
"toastUpdated": "Suscripción actualizada",
"addButton": "Añadir",
"active": "Suscripciones activas",
"empty": "Aún no hay suscripciones. Añade una arriba.",
"colRemark": "Notas",
"colLastFetch": "Última descarga",
"colEnabled": "Habilitado",
"auto": "auto",
"never": "nunca",
"refreshNow": "Actualizar ahora",
"deleteConfirm": "¿Eliminar esta suscripción?",
"restartHint": "Después de añadir o actualizar, reinicia Xray (o espera a la próxima recarga automática) para activar las salidas.",
"fromSubsTitle": "Desde suscripciones de salida (solo lectura)",
"fromSubsDesc": "Importadas desde tus suscripciones activas. Gestiónalas en el panel de Suscripciones de arriba.",
"toastLoadFailed": "No se pudieron cargar las suscripciones",
"toastUrlRequired": "La URL de suscripción es obligatoria",
"toastAdded": "Suscripción añadida",
"toastAddFailed": "No se pudo añadir la suscripción",
"toastRefreshed": "Actualizada",
"toastRefreshFailed": "Error al actualizar",
"toastDeleted": "Eliminada",
"toastDeleteFailed": "Error al eliminar"
},
"pia": {
"menu": "PIA",
"username": "Usuario de PIA",
"password": "Contraseña de PIA",
"account": "Cuenta",
"region": "Región",
"allRegions": "Todas las regiones",
"noServers": "No hay servidores para el país seleccionado",
"outboundAdded": "Salida PIA añadida",
"outboundUpdated": "Salida PIA actualizada",
"addedServers": "Servidores añadidos",
"alreadyAdded": "Este servidor ya está en la lista de salidas. Usa {reset} para renovar la clave.",
"provisionFailed": "No se pudo crear la salida PIA. Inténtalo de nuevo."
},
"tabBalancerSettings": "Ajustes del balanceador",
"tabObservatory": "Observatorio",
"observatory": {
"autoManaged": "Los observadores se gestionan automáticamente a partir de tus balanceadores. Ajusta abajo cómo sondean; las salidas vigiladas siguen los selectores del balanceador.",
"emptyHint": "No hay ningún observador de conexión activo. Se añade uno automáticamente al crear un balanceador Least Ping o Least Load —o un balanceador Random / Round-robin con fallback— para que los balanceadores que usan observador puedan comprobar la salud de las salidas antes de elegir un destino.",
"mixedLegacy": "Esta configuración contiene Observatory y Burst Observatory a la vez. Xray usa un único observador global, por lo que este estado mixto heredado no está soportado; al guardar balanceadores se normalizará a un solo observador.",
"subjectSelector": "Salidas vigiladas",
"subjectSelectorDesc": "Etiquetas de salida que sondea este observador. Se gestionan automáticamente a partir de tus balanceadores.",
"probeURL": "URL de sondeo",
"probeURLDesc": "URL solicitada para medir cada salida. Debe devolver HTTP 204.",
"probeInterval": "Intervalo de sondeo",
"probeIntervalDesc": "Con qué frecuencia se sondea cada salida, p. ej. 30s, 1m, 2h45m.",
"enableConcurrency": "Sondeo concurrente",
"enableConcurrencyDesc": "Sondea todas las salidas vigiladas a la vez en lugar de una a una. Más rápido, pero más visible en la red.",
"destination": "Destino de sondeo",
"destinationDesc": "URL solicitada para medir cada salida. Debe devolver HTTP 204.",
"connectivity": "Comprobación de conectividad",
"connectivityDesc": "URL opcional de comprobación de red local, se prueba solo si falla el destino. Déjalo vacío para omitir.",
"interval": "Intervalo de sondeo",
"intervalDesc": "Tiempo medio entre sondeos por salida, p. ej. 1m. Mínimo 10s.",
"timeout": "Tiempo de espera del sondeo",
"timeoutDesc": "Cuánto esperar un sondeo antes de considerarlo fallido, p. ej. 5s.",
"sampling": "Número de muestras",
"samplingDesc": "Número de resultados de sondeo recientes que se conservan para puntuar cada salida.",
"httpMethod": "Método HTTP",
"httpMethodDesc": "Método HTTP usado para los sondeos.",
"deleteAlsoObservatory": "Este es el último balanceador que usa el Observatorio, por lo que también se eliminará.",
"deleteAlsoBurst": "Este es el último balanceador que usa el Observatorio Burst, por lo que también se eliminará."
},
"refCleanup": {
"header": "Al eliminar esto también se actualiza tu enrutamiento:",
"ruleRemoved": "Regla {label} — eliminada (sin destino restante)",
"ruleModified": "Regla {label} — conservada (ahora usa {keeps})",
"balancerRemoved": "Balanceador {tag} — eliminado (sin destinos restantes)"
},
"balancer": {
"balancerStrategy": "Estrategia",
"tag": "Etiqueta",
"tagDuplicate": "Etiqueta ya usada por otro balanceador",
"tagPlaceholder": "etiqueta única de balanceador",
"selector": "Selector",
"fallback": "Fallback",
"cycleTooltip": "Ciclo: {path} → (volver a {start})",
"expected": "Esperado",
"expectedPlaceholder": "número óptimo de nodos",
"maxRtt": "Máx. RTT",
"tolerance": "Tolerancia",
"baselines": "Baselines",
"costs": "Costs",
"costMatch": "Patrón de etiqueta",
"costValue": "Peso",
"costRegexp": "Coincidencia por expresión regular",
"balancerDeleteInUse": "No se puede eliminar este balanceador — se usa como respaldo para: {names}",
"balancerFallbackCycle": "No se puede establecer este balanceador como respaldo — crearía una dependencia circular.",
"balancerFallbackInfo": "El tráfico se enrutará a través de: Balanceador → Loopback → Servidor → Balanceador destino → Conexión saliente. Esto agrega un salto adicional a través del servidor, lo que puede introducir ligeros retrasos.",
"fallbackBalancerHint": "Seleccione otro balanceador como respaldo",
"reservedPrefix": "El prefijo _bl_ está reservado para objetos loopback internos del balanceador"
},
"wireguard": {
"secretKey": "Llave secreta",
"publicKey": "Llave pública",
"subnetIp": "Subred",
"subnetCidr": "CIDR de la subred",
"allowedIPs": "IP permitidas",
"endpoint": "Punto final",
"domainStrategy": "Estrategia de dominio"
},
"amneziawg": {
"privateKey": "Clave privada",
"publicKey": "Clave pública",
"subnetIp": "Subred",
"subnetCidr": "CIDR de la subred",
"mtu": "MTU",
"primaryDns": "DNS primario",
"secondaryDns": "DNS secundario",
"externalInterface": "Interfaz externa",
"externalInterfaceHint": "Interfaz de red del host para NAT (PostUp/PostDown). Déjalo vacío para autodetectar.",
"ipv6Enabled": "Habilitar IPv6",
"ipv6Subnet": "Subred IPv6",
"ipv6SubnetHint": "p. ej. fd86:ea04:1115::/64. Obligatorio cuando IPv6 está habilitado.",
"ipv6ExternalInterface": "Interfaz externa IPv6",
"ipv6ExternalInterfaceHint": "Interfaz de red del host para las entradas de proxy NDP. Déjalo vacío para reutilizar la interfaz externa.",
"obfuscation": "Parámetros de ofuscación",
"regenerateObfuscation": "Regenerar",
"jc": "Jc (cantidad de paquetes basura)",
"jmin": "Jmin (tamaño mínimo de paquete basura)",
"jmax": "Jmax (tamaño máximo de paquete basura)",
"s1": "S1 (relleno del paquete init)",
"s2": "S2 (relleno del paquete response)",
"s3": "S3 (relleno de cookie reply)",
"s4": "S4 (relleno del paquete de transporte)",
"h1": "H1 (cabecera mágica)",
"h2": "H2 (cabecera mágica)",
"h3": "H3 (cabecera mágica)",
"h4": "H4 (cabecera mágica)",
"hHint": "Un número entero o un rango. Déjalo vacío para los valores clásicos 1/2/3/4.",
"i1": "I1 (paquete de firma)",
"i1Hint": "Paquete de firma opcional. Déjalo vacío para omitirlo.",
"i2": "I2 (paquete de firma)",
"i3": "I3 (paquete de firma)",
"i4": "I4 (paquete de firma)",
"i5": "I5 (paquete de firma)",
"headerProtectionKey": "HeaderProtectionKey (protección de cabeceras)",
"headerProtectionKeyHint": "Clave Base64 de 32 bytes; debe coincidir en la configuración de cada cliente. Déjalo vacío para desactivar la protección de cabeceras.",
"contentPaddingAddition": "ContentPaddingAddition (relleno de contenido)",
"contentPaddingAdditionHint": "Un entero o un rango de bytes añadido a los paquetes de contenido. Déjalo vacío para desactivarlo.",
"rekeyAfterTime": "RekeyAfterTime (segundos)",
"rekeyTimeout": "RekeyTimeout (segundos)",
"rejectAfterTime": "RejectAfterTime (segundos)",
"keepaliveTimeout": "KeepaliveTimeout (segundos)",
"maxHandshakeAttempts": "MaxHandshakeAttempts",
"timingRangeHint": "Un entero o un rango. Déjalo vacío para mantener el valor por defecto de WireGuard.",
"maxHandshakeAttemptsHint": "Reintentos de handshake antes de abandonar. Déjalo vacío para el valor por defecto.",
"randomTrailers": "RandomTrailers",
"randomTrailersHint": "Añade bytes aleatorios a cada paquete. Ambos extremos necesitan AmneziaWG 3.1+.",
"disableCookies": "DisableCookies",
"disableCookiesHint": "No enviar cookie replies — elimina una huella para DPI, pero debilita la mitigación de inundaciones."
},
"tun": {
"userLevel": "Nivel de Usuario"
},
"nord": {
"accessToken": "Access token",
"privateKey": "Clave privada",
"noServers": "No se encontraron servidores para el país seleccionado",
"noPublicKey": "El servidor seleccionado no anuncia una clave pública NordLynx.",
"outboundAdded": "Salida NordVPN añadida",
"outboundUpdated": "Salida NordVPN actualizada"
},
"warp": {
"changeIp": "Cambiar IP",
"changeIpSuccess": "¡IP de WARP cambiada correctamente!",
"autoUpdateIp": "Actualizar IP automáticamente",
"intervalDays": "Intervalo (días)",
"intervalDesc": "0 para desactivar. Cambia la dirección IP automáticamente.",
"licenseError": "No se pudo establecer la licencia WARP.",
"fetchFirst": "Obtén primero la configuración WARP.",
"createAccount": "Crear cuenta WARP",
"accessToken": "Access token",
"deviceId": "ID del dispositivo",
"licenseKey": "Clave de licencia",
"privateKey": "Clave privada",
"deleteAccount": "Eliminar cuenta",
"settings": "Ajustes",
"licenseKeyLabel": "Clave de licencia WARP / WARP+",
"key": "Clave",
"keyPlaceholder": "clave WARP+ de 26 caracteres",
"accountInfo": "Información de cuenta",
"deviceName": "Nombre del dispositivo",
"deviceModel": "Modelo del dispositivo",
"deviceEnabled": "Dispositivo habilitado",
"accountType": "Tipo de cuenta",
"role": "Rol",
"warpPlusData": "Datos WARP+",
"quota": "Cuota",
"usage": "Uso",
"addOutbound": "Añadir salida"
},
"dns": {
"enable": "Habilitar DNS",
"enableDesc": "Habilitar servidor DNS incorporado",
"tag": "Etiqueta de Entrada DNS",
"tagDesc": "Esta etiqueta estará disponible como una etiqueta de entrada en las reglas de enrutamiento.",
"clientIp": "IP del cliente",
"clientIpDesc": "Se utiliza para notificar al servidor la ubicación IP especificada durante las consultas DNS",
"disableCache": "Desactivar caché",
"disableCacheDesc": "Desactiva el almacenamiento en caché de DNS",
"disableFallback": "Desactivar respaldo",
"disableFallbackDesc": "Desactiva las consultas DNS de respaldo",
"disableFallbackIfMatch": "Desactivar respaldo si coincide",
"disableFallbackIfMatchDesc": "Desactiva las consultas DNS de respaldo cuando se acierta en la lista de dominios coincidentes del servidor DNS",
"enableParallelQuery": "Habilitar consulta paralela",
"enableParallelQueryDesc": "Habilitar consultas DNS paralelas a múltiples servidores para una resolución más rápida",
"strategy": "Estrategia de Consulta",
"strategyDesc": "Estrategia general para resolver nombres de dominio",
"add": "Agregar Servidor",
"edit": "Editar Servidor",
"domains": "Dominios",
"expectIPs": "IPs esperadas",
"unexpectIPs": "IPs inesperadas",
"useSystemHosts": "Usar Hosts del sistema",
"useSystemHostsDesc": "Usar el archivo hosts de un sistema instalado",
"serveStale": "Servir caducados",
"serveStaleDesc": "Devolver resultados caducados de la caché mientras se actualiza en segundo plano",
"serveExpiredTTL": "TTL de caducados",
"serveExpiredTTLDesc": "Validez (segundos) de las entradas caducadas en la caché; 0 = nunca caduca",
"timeoutMs": "Tiempo de espera (ms)",
"skipFallback": "Omitir respaldo",
"finalQuery": "Consulta final",
"hosts": "Hosts",
"hostsAdd": "Agregar Host",
"hostsEmpty": "No hay Hosts definidos",
"hostsDomain": "Dominio (ej. domain:example.com)",
"hostsValues": "IP o dominio — escribe y presiona Enter",
"usePreset": "Usar plantilla",
"dnsPresetTitle": "Plantillas DNS",
"dnsPresetFamily": "Familiar",
"clearAll": "Eliminar todos",
"clearAllTitle": "¿Eliminar todos los servidores DNS?",
"clearAllConfirm": "Esto eliminará todos los servidores DNS de la lista. No se puede deshacer.",
"dnsLeakWarning": "El DNS puede filtrarse por localhost, UDP/TCP sin cifrar, DoH/DoQ en modo local, consultas de respaldo o EDNS client IP. Usa DoH enrutado, fija los resolutores en hosts y desactiva el respaldo cuando la privacidad importe."
},
"fakedns": {
"add": "Agregar DNS Falso",
"ipPool": "Subred del grupo de IP",
"poolSize": "Tamaño del grupo"
},
"defaultOutbound": "Salida predeterminada",
"defaultOutboundDesc": "El tráfico que no coincide con ninguna regla de enrutamiento usa esta salida (la primera de la lista)."
},
"hosts": {
"addHost": "Agregar host",
"editHost": "Editar host",
"selectInbound": "Selecciona un inbound",
"selectedCount": "{count} seleccionado(s)",
"summary": {
"total": "Total",
"enabled": "Habilitados",
"disabled": "Deshabilitados"
},
"moveUp": "Subir",
"moveDown": "Bajar",
"bulkEnable": "Habilitar",
"bulkDisable": "Deshabilitar",
"bulkDelete": "Eliminar",
"bulkDeleteConfirm": "¿Eliminar {count} host(s) seleccionado(s)?",
"deleteConfirmTitle": "¿Eliminar el host \"{name}\"?",
"sections": {
"basic": "Básico",
"security": "Seguridad",
"advanced": "Avanzado",
"general": "General",
"clash": "Clash (mihomo)"
},
"fields": {
"remark": "Notas",
"serverDescription": "Descripción",
"inbound": "Inbounds",
"address": "Dirección",
"port": "Puerto",
"endpoint": "Punto final",
"enable": "Habilitar",
"actions": "Acciones",
"security": "Seguridad",
"sni": "SNI",
"overrideSniFromAddress": "Usar la dirección como SNI",
"keepSniBlank": "Dejar el SNI en blanco",
"hostHeader": "Cabecera Host",
"path": "Ruta",
"alpn": "ALPN",
"fingerprint": "Fingerprint",
"pins": "SHA-256 del cert. fijado",
"verifyPeerCertByName": "Verificar cert. del par por nombre",
"allowInsecure": "Permitir inseguro",
"echConfigList": "Lista de config. ECH",
"muxParams": "Mux",
"sockoptParams": "Sockopt",
"finalMask": "Máscara final",
"vlessRoute": "Ruta VLESS",
"mihomoIpVersion": "Versión de IP",
"mihomoX25519": "Mihomo X25519",
"shuffleHost": "Barajar host",
"tags": "Etiquetas",
"nodeGuids": "Nodos",
"excludeFromSubTypes": "Excluir de formatos",
"inheritAddress": "Hereda dirección"
},
"hints": {
"address": "Déjalo en blanco para heredar la dirección propia del inbound.",
"port": "0 hereda el puerto del inbound.",
"tags": "No visible para los usuarios finales; se envía solo con la suscripción RAW. Solo letras mayúsculas, dígitos, _ y :.",
"nodeGuids": "Elige los nodos que se resolvieron desde este host. Solo asignación visual.",
"serverDescription": "Nota opcional que se muestra bajo las notas.",
"allowInsecure": "Omitir la verificación del certificado TLS (allowInsecure / skip-cert-verify).",
"vlessRoute": "Un único valor de ruta VLESS (0-65535) incrustado en el UUID, p. ej. 443. Déjalo en blanco para ninguno.",
"remark": "Una etiqueta simple para este host. Se muestra como nombre de la configuración solo cuando el inbound no tiene notas propias."
},
"remarkVars": {
"title": "Variables de plantilla",
"intro": "Haz clic en una variable para añadirla. Se sustituye por cliente al generar la suscripción.",
"preview": "Vista previa",
"groups": {
"client": "Cliente",
"traffic": "Tráfico",
"time": "Tiempo y estado",
"connection": "Conexión"
},
"descEMAIL": "Email del cliente",
"descINBOUND": "Notas del propio inbound (nombre de la configuración)",
"descHOST": "Notas del host",
"descID": "UUID del cliente",
"descSHORT_ID": "Primeros 8 caracteres del UUID",
"descTELEGRAM_ID": "ID de Telegram del cliente (vacío si no está definido)",
"descSUB_ID": "ID de suscripción",
"descCOMMENT": "Comentario del cliente",
"descTRAFFIC_USED": "Tráfico usado (legible)",
"descTRAFFIC_LEFT": "Tráfico restante (oculto si es ilimitado)",
"descTRAFFIC_TOTAL": "Tráfico total (oculto si es ilimitado)",
"descTRAFFIC_USED_BYTES": "Tráfico usado en bytes",
"descTRAFFIC_LEFT_BYTES": "Tráfico restante en bytes",
"descTRAFFIC_TOTAL_BYTES": "Tráfico total en bytes",
"descUP": "Tráfico de subida",
"descDOWN": "Tráfico de bajada",
"descSTATUS": "activo / expirado / deshabilitado / agotado",
"descSTATUS_EMOJI": "Estado como emoji (✅ ⏳ 🚫)",
"descDAYS_LEFT": "Días hasta la expiración (oculto si es ilimitado)",
"descTIME_LEFT": "Tiempo restante (p. ej. 12d 4h 30m)",
"descUSAGE_PERCENTAGE": "Tráfico usado en porcentaje (oculto si es ilimitado)",
"descEXPIRE_DATE": "Fecha de expiración (AAAA-MM-DD)",
"descJALALI_EXPIRE_DATE": "Fecha de expiración en el calendario Jalali (AAAA/MM/DD)",
"descEXPIRE_UNIX": "Expiración como marca de tiempo Unix (segundos)",
"descCREATED_UNIX": "Hora de creación como marca de tiempo Unix (segundos)",
"descRESET_DAYS": "Periodo de reinicio de tráfico en días",
"descRESET_DAY": "Día del mes en que se renueva",
"descPROTOCOL": "Protocolo del inbound (VLESS, VMess, Trojan, …)",
"descTRANSPORT": "Red de transporte (tcp, ws, grpc, …)",
"descSECURITY": "Seguridad del transporte (TLS, REALITY, NONE)"
},
"toasts": {
"list": "Error al cargar los hosts",
"obtain": "Error al cargar el host",
"add": "Agregar host",
"update": "Actualizar host",
"delete": "Eliminar host",
"badTag": "Etiqueta no válida",
"badVlessRoute": "Introduce un único número entre 0 y 65535"
}
}
},
"tgbot": {
"keyboardClosed": "❌ Teclado cerrado!",
"noResult": "❗ ¡Sin resultados!",
"noQuery": "❌ ¡Consulta no encontrada! ¡Por favor, use el comando nuevamente!",
"wentWrong": "❌ ¡Algo salió mal!",
"noIpRecord": "❗ ¡No hay registro de IP!",
"noInbounds": "❗ ¡No se encontraron entradas!",
"unlimited": "♾ Ilimitado (Restablecer)",
"add": "Añadir",
"month": "Mes",
"months": "Meses",
"days": "Días",
"hours": "Horas",
"minutes": "Minutos",
"unknown": "Desconocido",
"inbounds": "Entradas",
"clients": "Clientes",
"offline": "🔴 Sin conexión",
"online": "🟢 En línea",
"commands": {
"unknown": "❗ Comando desconocido",
"pleaseChoose": "👇 Por favor elige:\r\n",
"help": "🤖 ¡Bienvenido a este bot! Está diseñado para ofrecerte datos específicos del servidor y te permite hacer modificaciones según sea necesario.\r\n\r\n",
"start": "👋 Hola <i>{{ .Firstname }}</i>.\r\n",
"welcome": "🤖 Bienvenido al bot de gestión de <b>{{ .Hostname }}</b>.\r\n",
"status": "✅ ¡El bot está bien!",
"usage": "❗ ¡Por favor proporciona un texto para buscar!",
"getID": "🆔 Tu ID: <code>{{ .ID }}</code>",
"helpAdminCommands": "Para reiniciar Xray Core:\r\n<code>/restart</code>\r\n\r\nPara buscar un correo electrónico de cliente:\r\n<code>/usage [Correo electrónico]</code>\r\n\r\nPara buscar entradas (con estadísticas de cliente):\r\n<code>/inbound [Observación]</code>\r\n\r\nID de Chat de Telegram:\r\n<code>/id</code>",
"helpClientCommands": "Para buscar estadísticas, utiliza el siguiente comando:\r\n<code>/usage [Correo electrónico]</code>\r\n\r\nID de Chat de Telegram:\r\n<code>/id</code>",
"restartUsage": "\r\n\r\n<code>/restart</code>",
"restartSuccess": "✅ ¡Operación exitosa!",
"restartFailed": "❗ Error en la operación.\r\n\r\n<code>Error: {{ .Error }}</code>.",
"xrayNotRunning": "❗ Xray Core no está en ejecución.",
"startDesc": "Mostrar el menú principal",
"helpDesc": "Ayuda del bot",
"statusDesc": "Comprobar el estado del bot",
"idDesc": "Mostrar tu ID de Telegram",
"usageDesc": "Ver el uso del cliente: /usage correo",
"inboundDesc": "Buscar entradas: /inbound nombre (admin)",
"restartDesc": "Reiniciar el núcleo de Xray (admin)",
"clearallDesc": "Restablecer el tráfico de todos los clientes (admin)"
},
"messages": {
"cpuThreshold": "El uso de CPU {{ .Percent }}% es mayor que el umbral {{ .Threshold }}%",
"selectUserFailed": "❌ ¡Error al seleccionar usuario!",
"userSaved": "✅ Usuario de Telegram guardado.",
"loginSuccess": "✅ Has iniciado sesión en el panel con éxito.\r\n",
"loginFailed": "❗️ Falló el inicio de sesión en el panel.\r\n",
"report": "🕰 Informes programados: {{ .RunTime }}\r\n",
"datetime": "⏰ Fecha y Hora: {{ .DateTime }}\r\n",
"hostname": "💻 Host: {{ .Hostname }}\r\n",
"version": "🚀 Versión de X-UI: {{ .Version }}\r\n",
"xrayVersion": "📡 Versión de Xray: {{ .XrayVersion }}\r\n",
"ipv6": "🌐 IPv6: {{ .IPv6 }}\r\n",
"ipv4": "🌐 IPv4: {{ .IPv4 }}\r\n",
"ip": "🌐 IP: {{ .IP }}\r\n",
"ips": "🔢 IPs:\r\n{{ .IPs }}\r\n",
"serverUpTime": "⏳ Tiempo de actividad del servidor: {{ .UpTime }} {{ .Unit }}\r\n",
"serverLoad": "📈 Carga del servidor: {{ .Load1 }}, {{ .Load2 }}, {{ .Load3 }}\r\n",
"serverMemory": "📋 RAM: {{ .Current }}/{{ .Total }}\r\n",
"tcpCount": "🔹 TCP: {{ .Count }}\r\n",
"udpCount": "🔸 UDP: {{ .Count }}\r\n",
"traffic": "🚦 Tráfico: {{ .Total }} (↑{{ .Upload }},↓{{ .Download }})\r\n",
"xrayStatus": "ℹ️ Estado: {{ .State }}\r\n",
"username": "👤 Nombre de usuario: {{ .Username }}\r\n",
"reason": "❗️ Motivo: {{ .Reason }}\r\n",
"time": "⏰ Hora: {{ .Time }}\r\n",
"inbound": "📍 Entrada: {{ .Remark }}\r\n",
"port": "🔌 Puerto: {{ .Port }}\r\n",
"expire": "📅 Fecha de Vencimiento: {{ .Time }}\r\n",
"expireIn": "📅 Vence en: {{ .Time }}\r\n",
"active": "💡 Activo: {{ .Enable }}\r\n",
"enabled": "🚨 Habilitado: {{ .Enable }}\r\n",
"online": "🌐 Estado de conexión: {{ .Status }}\r\n",
"lastOnline": "🔙 Última conexión: {{ .Time }}\r\n",
"email": "📧 Email: {{ .Email }}\r\n",
"upload": "🔼 Subida: ↑{{ .Upload }}\r\n",
"download": "🔽 Descarga: ↓{{ .Download }}\r\n",
"total": "📊 Total: ↑↓{{ .UpDown }} / {{ .Total }}\r\n",
"TGUser": "👤 Usuario de Telegram: {{ .TelegramID }}\r\n",
"exhaustedCount": "🚨 Cantidad de Agotados {{ .Type }}:\r\n",
"onlinesCount": "🌐 Clientes en línea: {{ .Count }}\r\n",
"disabled": "🛑 Desactivado: {{ .Disabled }}\r\n",
"depleteSoon": "🔜 Se agotará pronto: {{ .Deplete }}\r\n\r\n",
"backupTime": "🗄 Hora de la Copia de Seguridad: {{ .Time }}\r\n",
"refreshedOn": "\r\n📋🔄 Actualizado en: {{ .Time }}\r\n\r\n",
"yes": "✅ Sí",
"no": "❌ No",
"received_email": "📧📥 Correo electrónico actualizado.",
"received_comment": "💬📥 Comentario actualizado.",
"email_prompt": "📧 Correo electrónico predeterminado: {{ .ClientEmail }}\n\nIntroduce tu correo electrónico.",
"comment_prompt": "💬 Comentario predeterminado: {{ .ClientComment }}\n\nIntroduce tu comentario.",
"cancel": "❌ ¡Proceso cancelado! \n\nPuedes /start de nuevo en cualquier momento. 🔄",
"error_add_client": "⚠️ Error:\n\n {{ .error }}",
"using_default_value": "Está bien, me quedaré con el valor predeterminado. 😊",
"incorrect_input": "Tu entrada no es válida.\nLas frases deben ser continuas sin espacios.\nEjemplo correcto: aaaaaa\nEjemplo incorrecto: aaa aaa 🚫",
"AreYouSure": "¿Estás seguro? 🤔",
"SuccessResetTraffic": "📧 Correo: {{ .ClientEmail }}\n🏁 Resultado: ✅ Éxito",
"FailedResetTraffic": "📧 Correo: {{ .ClientEmail }}\n🏁 Resultado: ❌ Fallido \n\n🛠️ Error: [ {{ .ErrorMessage }} ]",
"FinishProcess": "🔚 Proceso de reinicio de tráfico finalizado para todos los clientes.",
"eventOutboundDown": "El saliente {{ .Tag }} está CAÍDO",
"eventOutboundUp": "El saliente {{ .Tag }} está ACTIVO",
"eventErrorDetail": "Error: {{ .Error }}",
"eventDelayDetail": "Retardo: {{ .Delay }} ms",
"eventXrayCrash": "Xray se ha BLOQUEADO",
"eventXrayCrashError": "Error: {{ .Error }}",
"eventNodeDown": "El nodo {{ .Name }} está CAÍDO",
"eventNodeUp": "El nodo {{ .Name }} está ACTIVO",
"eventLoginFallback": "Inicio de sesión fallido desde {{ .Source }}",
"memoryThreshold": "Uso de memoria {{ .Percent }}% supera el umbral de {{ .Threshold }}%"
},
"buttons": {
"closeKeyboard": "❌ Cerrar Teclado",
"cancel": "❌ Cancelar",
"cancelReset": "❌ Cancelar Reinicio",
"cancelIpLimit": "❌ Cancelar Límite de IP",
"confirmResetTraffic": "✅ ¿Confirmar Reinicio de Tráfico?",
"confirmClearIps": "✅ ¿Confirmar Limpiar IPs?",
"confirmRemoveTGUser": "✅ ¿Confirmar Eliminar Usuario de Telegram?",
"confirmToggle": "✅ ¿Confirmar habilitar/deshabilitar usuario?",
"dbBackup": "Obtener Copia de Seguridad de BD",
"serverUsage": "Uso del Servidor",
"getInbounds": "Obtener Entradas",
"depleteSoon": "Pronto se Agotará",
"clientUsage": "Obtener Uso",
"onlines": "Clientes en línea",
"commands": "Comandos",
"refresh": "🔄 Actualizar",
"clearIPs": "❌ Limpiar IPs",
"removeTGUser": "❌ Eliminar Usuario de Telegram",
"selectTGUser": "👤 Seleccionar Usuario de Telegram",
"selectOneTGUser": "👤 Selecciona un usuario de telegram:",
"resetTraffic": "📈 Reiniciar Tráfico",
"resetExpire": "📅 Cambiar fecha de Vencimiento",
"ipLog": "🔢 Registro de IP",
"ipLimit": "🔢 Límite de IP",
"setTGUser": "👤 Establecer Usuario de Telegram",
"toggle": "🔘 Habilitar / Deshabilitar",
"custom": "🔢 Personalizado",
"confirmNumber": "✅ Confirmar: {{ .Num }}",
"confirmNumberAdd": "✅ Confirmar agregando: {{ .Num }}",
"limitTraffic": "🚧 Límite de tráfico",
"getBanLogs": "Registros de prohibición",
"allClients": "Todos los Clientes",
"addClient": "Añadir cliente",
"submitDisable": "Enviar como deshabilitado ☑️",
"submitEnable": "Enviar como habilitado ✅",
"use_default": "🏷️ Usar por defecto",
"change_email": "⚙️📧 Email",
"change_comment": "⚙️💬 Comentario",
"ResetAllTraffics": "Reiniciar todo el tráfico",
"SortedTrafficUsageReport": "Informe de uso de tráfico ordenado"
},
"answers": {
"successfulOperation": "✅ ¡Exitosa!",
"errorOperation": "❗ Error en la Operación.",
"getInboundsFailed": "❌ Error al obtener las entradas",
"getClientsFailed": "❌ No se pudo obtener los clientes.",
"canceled": "❌ {{ .Email }} : Operación cancelada.",
"clientRefreshSuccess": "✅ {{ .Email }} : Cliente actualizado exitosamente.",
"IpRefreshSuccess": "✅ {{ .Email }} : IPs actualizadas exitosamente.",
"TGIdRefreshSuccess": "✅ {{ .Email }} : Usuario de Telegram del cliente actualizado exitosamente.",
"resetTrafficSuccess": "✅ {{ .Email }} : Tráfico reiniciado exitosamente.",
"setTrafficLimitSuccess": "✅ {{ .Email }} : Límite de Tráfico guardado exitosamente.",
"expireResetSuccess": "✅ {{ .Email }} : Días de vencimiento reiniciados exitosamente.",
"resetIpSuccess": "✅ {{ .Email }} : Límite de IP {{ .Count }} guardado exitosamente.",
"clearIpSuccess": "✅ {{ .Email }} : IPs limpiadas exitosamente.",
"getIpLog": "✅ {{ .Email }} : Obtener Registro de IP.",
"getUserInfo": "✅ {{ .Email }} : Obtener Información de Usuario de Telegram.",
"removedTGUserSuccess": "✅ {{ .Email }} : Usuario de Telegram eliminado exitosamente.",
"enableSuccess": "✅ {{ .Email }} : Habilitado exitosamente.",
"disableSuccess": "✅ {{ .Email }} : Deshabilitado exitosamente.",
"askToAddUserId": "¡No se encuentra su configuración!\r\nPor favor, pídale a su administrador que use su ChatID de usuario de Telegram en su(s) configuración(es).\r\n\r\nSu ChatID de usuario: <code>{{ .TgUserID }}</code>",
"chooseClient": "Elige un Cliente para Inbound {{ .Inbound }}",
"chooseInbound": "Elige un Inbound"
}
},
"email": {
"labelStatus": "Estado",
"labelOutbound": "Saliente",
"labelNode": "Nodo",
"labelError": "Error",
"labelDelay": "Retardo",
"labelUsername": "Usuario",
"labelIP": "IP",
"labelReason": "Motivo",
"labelSource": "Origen",
"statusCrashed": "BLOQUEADO",
"statusHigh": "ALTA",
"statusSuccess": "CORRECTO",
"statusFailed": "FALLIDO",
"statusDown": "CAÍDO",
"statusUp": "ACTIVO"
}
}
Reference in New Issue View Git Blame Copy Permalink