xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-08-24 20:07:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
effcccceac26d9381a116c29279c40d471a3b0cb
3x-ui/internal/web/translation/id-ID.json
T
Kuzz007 effcccceac feat(amneziawg): add native AmneziaWG protocol support (#6105) 
* feat(amneziawg): add native AmneziaWG protocol backend

AmneziaWG (WireGuard plus DPI-resistant obfuscation) needs no Docker
here — it runs as a genuine kernel interface via awg-quick/awg, managed
the same way internal/mtproto manages mtg: one Inbound row is one
desired Instance, and a Manager reconciles running interfaces toward
the database every 10s (internal/web/job/amneziawg_job.go) plus
immediately after a client edit (applyLocalAmneziaWG).

Clients reuse model.Client verbatim (the same PrivateKey/PublicKey/
PreSharedKey/AllowedIPs fields WireGuard already uses), so bulk
operations, the QR/share-link modal and subscriptions come from the
shared inbound infrastructure instead of a parallel implementation.
internal/amneziawg owns the obfuscation param generator/validator
(ported from coinman-dev/3ax-ui, upgraded to AmneziaWG 2.0's S3/S4
padding and I1 signature packet) and the exec wrapper around
awg-quick/awg, with fingerprint-based reconcile (noop / reload-via-
syncconf / full restart) mirroring mtproto.Manager so a same-protocol
edit doesn't force an unnecessary interface bounce that would drop
every peer's connection.

Frontend and install.sh's DKMS/awg-tools setup are tracked separately;
this is backend-only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): add frontend support and fix a Go->Zod generator gap

Wires the amneziawg protocol through the panel UI the same way every
other protocol is registered: a Zod settings schema (nested
{server, clients}, matching the Go JSON exactly), the protocol enum,
the inbound-form's per-protocol fields component and its
tab-visibility allowlist, the default-settings factory, the client
schema dispatcher, and the sniffing-capability exclusion (no Xray
inbound exists for amneziawg, same as mtproto).

Client key/allowedIPs fields are reused rather than duplicated: since
AmneziaWG clients are wire-identical to WireGuard clients (same
model.Client fields), ClientFormModal renders one shared field block
for both, switching only the visible label by which protocol is
active. The private-key input also gets a live public-key sync via a
new useEffect, because unlike WireGuard's Xray-native inbound (which
re-derives its public key at runtime and never stores one),
AmneziaWG's server.publicKey is a real persisted field the Go backend
reads directly — free-typing a new private key without this would
silently save a mismatched keypair.

Adds a downloadable per-client .conf (amneziawgConfig.ts, mirroring
wireguardConfig.ts) with the obfuscation lines, and an
InboundOption.AwgServer field on the Go side so the config builder
gets the full server block in one round trip.

Along the way, running tools/openapigen surfaced a real bug: it
doesn't flatten anonymously-embedded Go structs the way encoding/json
does, so ServerSettings embedding Obfuscation20 produced a Zod schema
with a nested `obfuscation20` key that never matches the real wire
JSON. Fixed by un-embedding (flat fields + an accessor method) and
registering internal/amneziawg in the generator's own package list,
which had been silently emitting a dangling schema reference.

English and Russian translations are complete; the other 10 locale
files still fall back to English for the new keys.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): complete frontend parity for the Inbounds list page

The Clients page (form, CRUD, QR/config) already worked from the
prior commit; this closes the remaining gap on the Inbounds side and
in a couple of protocol allowlists that a plain search for existing
wireguard/mtproto handling turned up.

lib/xray/inbound-link.ts gets amneziawg-specific link/config builders
(genAmneziaWGLink/genAmneziaWGConfig, plus the *s fan-out variants)
mirroring the wireguard ones — AmneziaWG has no legacy peers-array to
fall back to, so these read settings.clients directly and add the
obfuscation lines every client must share with the server. Wired into
genInboundLinks generically, and into three consumers that call the
wireguard builders directly rather than through that dispatcher:
QrCodeModal, InboundInfoModal, and InboundsPage's bulk export.

ClientInfoModal, ClientBulkAddModal, and the bulk attach/detach modals
each had their own protocol allowlist that needed amneziawg added
alongside wireguard/mtproto.

Two real gaps surfaced by grepping every remaining 'wireguard' /
Protocols.WIREGUARD hit in frontend/src rather than trusting the
checklist was exhaustive:
- useInbounds.ts's TRACKED_PROTOCOLS gates the deactive/depleted/
  expiring/online client counts shown per inbound on the list page;
  without amneziawg those counts would silently read zero.
- inbound-tag.ts is an explicit client-side mirror of the Go backend's
  port_conflict.go (the file says so itself: "Keep in sync"). It still
  only special-cased wireguard for UDP, so an amneziawg inbound would
  have fallen through to the TCP default and disagreed with the
  backend's own port-conflict math.

Also finishes translating the AmneziaWG UI strings into the 11 locale
files that were still falling back to English (ar-EG, es-ES, fa-IR,
id-ID, ja-JP, pt-BR, tr-TR, uk-UA, vi-VN, zh-CN, zh-TW), matching
en-US/ru-RU key-for-key (26 new keys, verified by count in every file).

Not run anywhere: npm run typecheck / build. This machine has neither
Node nor npm, so nothing here has compiled — reviewed by hand plus
brace/paren balance checks and cross-referencing the generated Zod/TS
types. Treat this as needing a real typecheck before shipping.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(install): note that AmneziaWG kernel module install is still manual

Tracked separately (not yet ported into this script) — see
coinman-dev/3ax-ui's install_amneziawg for the reference approach
(ppa:amnezia/ppa). Also serves as a real, path-filter-matching change
to get the previous empty commit's CI trigger to actually fire —
release.yml's push trigger is paths-scoped and an empty commit changes
no files, so it never matched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): add a button to randomize obfuscation parameters

Mirrors the existing key-regenerate button next to the private key
field. Client-side randomization matches the ranges/constraints of
GenerateObfuscation20's "default" preset (internal/amneziawg/params.go)
closely enough for a form suggestion — the user can still hand-edit any
field afterward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(install): auto-install the AmneziaWG DKMS module + amneziawg-tools

Ports install_amneziawg from coinman-dev/3ax-ui's install.sh, adapted to
this script's broader distro coverage and NONINTERACTIVE convention:

- Ubuntu/Debian/Armbian: ppa:amnezia/ppa (primary, tested path), with a
  reachability pre-check for the Launchpad PPA host — often blocked by
  hosting providers, especially Russian VPS — so a flaky network skips
  the feature instead of hanging apt through several retries.
- Fedora/RHEL-family, Arch/Manjaro/Parch: best-effort fallback to plain
  wireguard-tools (+ AUR amneziawg-dkms via yay/paru when available),
  with a manual-install pointer.
- Everything else: manual-install pointer only.

Also installs ndppd and persists IPv4/IPv6 forwarding (for the future
IPv6/NDP phase, not yet wired into the panel) and adds a Secure Boot
warning at the end of the run, since a DKMS-built module is unsigned
and won't load while it's enabled — a common trap on cloud VPS images.

Never fatal: the panel installs and runs fine either way, an AmneziaWG
inbound just won't bring up its tunnel until the module is present.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): resolve all 3 real CI failures (typecheck/lint/codegen)

Found by checking the fork's Actions tab after the last two pushes —
the release build passed (it doesn't run these checks) but the
separate CI workflow caught three real issues:

- golangci-lint (noctx): every internal/amneziawg/manager.go exec.Command
  call is now exec.CommandContext with a 30s timeout, so a hung
  awg-quick/awg invocation can't block the reconcile job indefinitely
  (mirrors internal/mtproto/process.go's own CommandContext usage).
- tsc --noEmit: frontend/src/schemas/client.ts's hand-maintained
  InboundOptionSchema (used by the useClients hook, separate from the
  auto-generated one in generated/) never got an awgServer field added
  when the AmneziaWG frontend work was done — every read of
  inbound.awgServer.* in amneziawgConfig.ts was typing as {}. Added
  AwgServerOptionSchema, nested (not flattened like wg*) to match what
  amneziawgConfig.ts already expects. Also guarded server.publicKey in
  inbound-link.ts's genAmneziaWGLink against the schema's optional type.
- codegen staleness: frontend/public/openapi.json is produced by a Node
  script (gen:api) this machine can't run; hand-applied the exact diff
  the CI failure log already showed (amneziawg protocol enum entry,
  ServerSettings schema, InboundOption.awgServer, one example payload),
  verified as valid JSON.

Also confirmed independently by this run: install_amneziawg (previous
commit) installed and loaded the DKMS module successfully on both amd64
and arm64 CI runners. The two "Deploy Smoke Tests" failures are
unrelated to this change — this fork has only ever published the
dev-latest pre-release, and GitHub's /releases/latest API deliberately
excludes pre-releases, so the smoke test's no-argument install path
(which resolves "latest") has nothing to find. Not a regression; needs
an actual tagged release whenever that's wanted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): Phase 2a — IPv6 support + NDP proxy

Adds native dual-stack IPv6 to AmneziaWG inbounds, ported from
coinman-dev/3ax-ui's approach:

- ServerSettings gets ipv6Enabled/ipv6Subnet/ipv6ExternalInterface;
  Instance carries the server's own IPv6 address (first host of the
  subnet) alongside its IPv4 one.
- defaultAmneziaWGClients allocates an IPv6 host address per client
  (second AllowedIPs entry) when the server has IPv6 enabled, reusing
  allocateWireguardAddress — which needed a real fix along the way: it
  always suffixed "/32" regardless of address family, which is wrong
  for an IPv6 host address (needs /128). Now family-aware.
- generateServerConfig's PostUp/PostDown gains IPv6 forward-accept
  rules, proxy_ndp sysctl, and one `ip -6 neigh add/del proxy` entry per
  enabled peer with an IPv6 address — the lightweight per-client
  method, not the ndppd-daemon whole-subnet method (not worth the
  config-file-management complexity at this scale; ndppd itself is
  still installed by install.sh in case that changes later).
- ValidateIPv6Subnet rejects a malformed subnet before save.
- Frontend: ipv6Enabled/ipv6Subnet/ipv6ExternalInterface fields on the
  AmneziaWG inbound form, EN+RU translations, openapi.json/generated/*
  regenerated (the latter via `go run ./tools/openapigen`, pure Go).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): fill in IPv6 fields missed by the Phase 2a commit

Two real gaps the CI caught (both new fields, both my miss):

- inbound-defaults.ts's createDefaultAmneziawgInboundSettings() built a
  server object literal predating ipv6Enabled/ipv6Subnet/
  ipv6ExternalInterface — AmneziawgServer's inferred type now requires
  them (zod .default() fields are non-optional post-parse), so this
  didn't typecheck at all.
- openapi.json's ipv6Enabled property was missing the description the
  real generator attaches (the Go doc comment covering all three IPv6
  fields is attached to the first one) — a one-line diff, but git
  diff --exit-code doesn't care how small.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): Phase 2b — per-client port-forwarding

Admins can now set a per-client ForwardedPorts string (e.g. "80, 443,
8000-8100") that gets DNAT'd + FORWARD'd to that peer's tunnel address
via iptables rules in PostUp/PostDown, ported and simplified from
coinman-dev/3ax-ui's shared/portfwd.

Two decisions worth flagging for future readers:

- The iptables --comment tag on each rule is awg-fwd-<fnv32a(email)>,
  not the raw client email. Email is admin/API-supplied free text that
  ends up embedded in a shell-executed PostUp/PostDown line; a hash
  can never carry a shell metacharacter through where raw
  interpolation could.
- The reconcile manager gained a third fingerprint (portFwdFP, next to
  the existing structural/peers ones). `awg syncconf` only touches the
  WireGuard peer table — it never re-applies PostUp/PostDown iptables
  rules — so a port-forward-only change has to force a full
  awg-quick down+up bounce, same as a structural change, rather than
  the lighter sync a plain peer add/remove can use.

Also fixes a real pre-existing bug found while wiring up IPv6 client
allocation in the previous commit's spirit: allocateWireguardAddress
always suffixed "/32" regardless of address family, which produced
invalid host bits for IPv6 (needs "/128").

ForwardedPorts flows through model.Client -> model.ClientRecord
(gorm column wg_forwarded_ports, auto-migrated) -> ToRecord/ToClient/
MergeClientRecord, mirroring the awgServer field's earlier lesson
that new fields need checking against a second, hand-maintained
persistence-layer struct.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): route a client's traffic through Xray via the Routing page

Every enabled AmneziaWG inbound gets its own Xray TPROXY bridge
automatically, with no toggle to enable first: a loopback
dokodemo-door inbound (sockopt.tproxy) tagged with the AmneziaWG
inbound's own real tag, so it's already selectable in the existing
Routing page's inbound-tag picker — the same trick the mtproto
sidecar's own bridge already relies on (InboundService.GetInboundTags
is a plain, protocol-blind SELECT over every inbound row's tag, no
dedicated UI plumbing needed).

internal/amneziawg's defaultPostUpDown TPROXYs every peer's traffic
into that bridge unconditionally; the bridge's port is derived
deterministically from the inbound's id (EgressPortForInbound) so the
kernel-side reconcile loop and the Xray-config generator never need to
negotiate a runtime value between them.

injectAmneziawgEgress never generates a routing rule itself — whether
a client's traffic goes anywhere beyond Xray's default routing is
entirely up to whatever rules the admin adds through the existing
Routing UI (pick the AmneziaWG inbound's tag as source, optionally a
specific peer's IP via that page's own Source-IP field, and an
outbound), exactly the same workflow as routing any other protocol.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): recover orphaned interfaces after an ungraceful exit

Two gaps left an AmneziaWG interface stuck outside the manager's
control after a crash (kill -9/OOM/panic skips StopAll):

- ensureRestart's teardown was gated on the in-memory `exists` map,
  which is always empty on a fresh process, so a survived interface
  never got interfaceDown before interfaceUp tried `ip link add`
  against a name the kernel already had — failing forever and never
  populating m.ifaces, so traffic accounting silently stopped and the
  inbound could never be removed. Gate on isInterfaceUp instead, which
  checks real kernel state rather than this process's own bookkeeping.

- An inbound deleted from the database entirely while the panel was
  down has no entry in `desired` ever again, so it never reaches the
  per-id cleanup loop in Reconcile (which only walks m.ifaces). Add a
  one-time sweepOrphansLocked scan of configDir, mirroring
  mtproto.Manager.sweepOrphansLocked, that tears down and removes any
  leftover interface/config not in the current desired set.

Found by the automated review on MHSanaei/3x-ui#6105 (Finding 1).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* i18n(amneziawg): backfill IPv6/obfuscation/port-forwarding keys in 11 locales

Only en-US/ru-RU ever got these 9 keys as each AmneziaWG feature landed
(the regenerate-obfuscation button, then Phase 2a's IPv6 fields, then
Phase 2b's per-client ForwardedPorts) — the other 11 locale files were
never backfilled, so i18next has been silently falling back to English
for all of them since Phase 1. Cosmetic-only (never broke anything),
but now closed for every shipped locale.

* fix(amneziawg): resolve 7 Medium findings from the automated PR review

Each is independently reproducible; fixed together since one review pass
found all of them.

- manager.go: the shared "ip rule add fwmark" policy route had no
  existence check, so it duplicated in "ip rule show" on every interface
  bounce (which hostRulesFingerprint forces on any client add/remove/
  re-IP). Now checked via "ip rule list | grep -q ..." first. (Finding 2)

- params.go: ExternalInterface, IPv6ExternalInterface, and subnetIp/
  subnetCidr are interpolated unescaped into a shell-executed PostUp/
  PostDown line, but only obfuscation and the IPv6 subnet were validated
  before save. Added ValidateInterfaceName (a strict charset+length
  pattern) and ValidateSubnetIPv4 (netip.ParsePrefix), wired into
  normalizeAmneziaWGSettings. (Finding 3)

- amneziawg_job.go: IsAwgInstalled() existed but nothing ever called it,
  so a host without awg/awg-quick (the Docker image, RHEL, Arch, a failed
  install.sh PPA step) logged a reconcile failure every 10s forever. Now
  checked once an inbound actually needs it, warning once instead of
  spamming. (Finding 4)

- client_inbound_apply.go: the WireGuard/AmneziaWG credential
  carry-forward (added so a metadata-only client edit doesn't rotate
  keys) never covered ForwardedPorts, so a partial edit -- an API call or
  Telegram-bot toggle that omits the field -- silently wiped a client's
  port-forwarding spec. Carried forward and written back the same way the
  key fields already are. (Finding 5)

- manager.go: hostRulesFingerprint keyed each peer on its IPv4 address
  only, and structuralFingerprint omitted IPv6Enabled/IPv6ExternalInterface
  entirely, so an IPv6-only change could pick the syncconf reload path
  (which never re-runs PostUp, leaving a stale NDP-proxy entry) or be a
  complete no-op. Both fingerprints now cover the IPv6 fields. (Finding 6)

- port_conflict.go: the AmneziaWG egress bridge (injectAmneziawgEgress)
  binds 127.0.0.1:63100+id with no collision check anywhere, since it
  isn't a database row the ordinary port-conflict query can see -- same
  blind spot the reserved Xray API port already has its own check for.
  Added the equivalent check for the AmneziaWG bridge port. (Finding 7)

- install.sh: install_amneziawg ran unconditionally for every install/
  update, building a DKMS kernel module and enabling host-wide IPv4/IPv6
  forwarding whether or not the feature is ever used. Gated behind a new
  should_install_amneziawg (XUI_INSTALL_AMNEZIAWG=true/false, or an
  interactive y/N prompt defaulting to no). Also replaced the deprecated
  apt-key adv with a dedicated keyring + signed-by= on the Debian branch,
  and guarded its sources.list appends against duplication on a retried
  install. (Finding 8)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(amneziawg): make the Xray TPROXY bridge a per-inbound opt-in

Addresses Finding 10 from the automated PR review: an always-on TPROXY
bridge makes every AmneziaWG tunnel hard-depend on Xray being up (all
traffic, including DNS, drops whenever Xray restarts), and forces a full
awg-quick down+up bounce on any client add/remove/re-IP, permanently
losing the syncconf fast path.

Adds ServerSettings.RouteThroughXray (off by default):

- defaultPostUpDown only emits the TPROXY/policy-route rules when it's
  on; a plain AmneziaWG tunnel now has zero Xray dependency out of the
  box.
- structuralFingerprint covers it (toggling it changes whether PostUp/
  PostDown contain any TPROXY rules at all -- structural, not a
  per-peer host-rule). hostRulesFingerprint's IPv4 tracking is now
  itself conditional on RouteThroughXray (and IPv6 tracking on
  IPv6Enabled), so an instance that never uses either keeps the
  syncconf fast path for a plain peer re-IP.
- injectAmneziawgEgress only creates a bridge for inbounds that opted
  in; checkAmneziawgEgressConflict (the Finding-7 fix) now parses each
  candidate through InstanceFromInbound so a non-routed inbound's port
  is correctly never treated as reserved.
- New inbound-level Switch in the AmneziaWG form; the actual outbound
  decision is still made entirely through the panel's stock Routing
  page, same as before -- only whether the bridge exists at all is now
  a choice.

Translation keys added to all 13 locales in the same commit this time,
not backfilled later (see Finding 9's lesson).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): resolve 4 Low findings from the automated PR review

- manager.go: serverAddress assumed subnetIp always ends in ".0"; a
  base like "10.8.1.5" was used verbatim as the server's own address,
  eventually colliding with peer allocation (which starts at .2
  upward). Now derives the first host of the actual subnetIp/subnetCidr
  network via netip, matching serverAddressV6's own approach. A /32
  base (no host bits at all) is still used as-is. (Finding 12, partial
  -- the /16 pool-widening half of this finding only exists on the
  upstream-pr/amneziawg branch's merged client_wireguard.go, not here;
  handled separately on that branch.)

- manager.go: ensureLocked carried the previous per-peer traffic
  counters (`last`) forward even through a full restart, but
  awg-quick down+up resets the kernel's own counters to zero -- the
  next CollectTraffic computed a large negative delta (clamped to 0),
  silently discarding real traffic. Extracted the decision into
  nextTrafficBaseline: only a reload (syncconf) preserves the
  baseline. (Finding 13)

- portfwd.go: exported ForwardedPortsInclude; inbound_amneziawg.go's
  new checkForwardedPortsConflict uses it to reject, at save time, a
  client's forwardedPorts that would DNAT the panel's own port or
  another enabled inbound's port to the tunnel client --
  portForwardLines has no destination restriction, so this collision
  was previously silent. Wired into both the single-client update path
  and the add-client path (client_inbound_apply.go), plus
  normalizeAmneziaWGSettings for the whole-inbound save path. (Finding 14)

- inbound.go: InboundOption.AwgServer sent the whole ServerSettings
  struct including PrivateKey to GetInboundOptions callers -- a
  shared, admin-wide dropdown-filling endpoint the frontend's own
  AwgServerOptionSchema never reads that field from. Redacted it
  before assigning. (Finding 11)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): don't widen the peer address pool past AmneziaWG's own subnet

Completes Finding 12 from the automated PR review (the serverAddress half
of this finding was already fixed on main and cherry-picked here). This
half is specific to this branch: allocateWireguardAddress's /16
pool-widening fallback is an independent addition from upstream's own
main that this branch inherited during the cherry-pick rebase -- it
doesn't exist on the fork's own main at all, so this fix can't be
cherry-picked the normal way and is committed directly here.

Widening is safe for WireGuard's own Xray-native inbound (AllowedIPs
isn't tied to a strict kernel interface subnet), but AmneziaWG's kernel
interface Address is exactly the configured subnet -- an address
allocated from the containing /16 once the /24 fills up would be
silently unroutable. allocateWireguardAddress now takes an explicit
allowWidening bool: WireGuard's own caller passes true (unchanged
behavior), AmneziaWG's passes false (fails loudly on exhaustion instead).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(docker): note that AmneziaWG doesn't work in this image

Investigated: the image is Alpine-based, and AmneziaWG's own packaging
(DKMS module + amneziawg-tools) doesn't target Alpine/musl at all --
unlike the Debian/Ubuntu/Fedora/Arch paths install.sh already handles,
there's no package to apk add even with full host network/capabilities.
The panel already degrades gracefully (IsAwgInstalled() logs one warning
instead of retrying forever), so no code change is needed -- just made
the reason explicit at the point where a user would reach for cap_add/
network_mode to try to work around it.

* fix(sub): include amneziawg inbounds in subscription links

getInboundsBySubId's SQL protocol allowlist never had 'amneziawg' added,
so every AmneziaWG client was silently excluded from all three
subscription formats (plain/individual links, JSON, Clash) and from the
Telegram bot's QR/individual-link buttons, which fetch through the same
path. genAmneziaWGLink itself was already fully implemented and already
wired into GetLink's dispatch switch -- it just never got a chance to
run. Same bug shape as the earlier TRACKED_PROTOCOLS frontend gap: a
hardcoded protocol list one entry short.

Found while investigating whether the Telegram bot needed AmneziaWG-
specific client-management code -- it doesn't (the bot itself is fully
protocol-agnostic), but this is the actual root cause of "can't share
an AmneziaWG client's config via the bot."

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(inbound): enforce node-eligibility server-side, not just in the UI

Investigated multi-node interaction with AmneziaWG: the master's own
reconcile (DesiredAmneziaWGInstances) and Xray config generation
(injectAmneziawgEgress, the GenXrayInboundConfig protocol skip) all
correctly filter on NodeID IS NULL, so a node-assigned AmneziaWG (or
MTProto) inbound would never be managed by the master. But nothing
stopped one from being created that way: NODE_ELIGIBLE_PROTOCOLS
(frontend/src/pages/inbounds/form/InboundFormModal.tsx) only hides the
node picker client-side -- a direct API call could set nodeId on an
AmneziaWG inbound, which every node then reconciles as an ordinary
local inbound (nodes run the identical binary, full cron suite
included), leaving it running unmanaged and untracked by the master's
own AmneziaWG bookkeeping.

Added isNodeEligibleProtocol (inbound_protocol.go), mirroring the
frontend's allowlist, and enforced it in both AddInbound (the actually
exploitable path -- nodeId comes straight from the request) and
UpdateInbound (defense in depth; NodeID is already restored from the
stored row there before this check, so it mainly guards against a
protocol change on an existing node-hosted inbound).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): allow TPROXY-marked traffic through a default-deny INPUT chain

TPROXY never rewrites a packet's own destination address, only the routing
decision. A default-deny firewall whose INPUT chain sanity-checks "is this
destination actually local" (UFW's ufw-not-local, via addrtype --dst-type
LOCAL, is a concrete example) silently drops the redirected packet before
Xray's socket ever sees it -- RouteThroughXray looked fully configured
(TPROXY rule present and counting, Xray listening with IP_TRANSPARENT set)
yet every peer's traffic vanished with no trace on either side.

Adds an idempotent, never-torn-down "iptables -I INPUT 1 -m mark --mark
<fwmark> -j ACCEPT" alongside the existing shared policy route, so this
works regardless of which firewall manager owns the rest of the INPUT chain.

* fix(frontend): give AmneziaWG the same UDP tag and its own tag color

The Inbounds list only special-cased isWireguard/isHysteria for the "UDP"
network badge, so an AmneziaWG row showed just the bare protocol tag with
no transport badge next to it. Added the missing isAmneziawg flag (mirrors
isWireguard exactly) and wired it into the same branch.

Client-row protocol-color maps in ClientsPage/HostList had no amneziawg
entry, silently falling back to grey -- ClientInfoModal already had
amneziawg: 'yellow' from earlier work, these two just never got it.

* feat(logs): show which AmneziaWG client an access-log line belongs to

The dokodemo-door TPROXY bridge every AmneziaWG peer's traffic is routed
through has no per-user identity, so Xray's own access log never carries an
"email:" token for these lines -- the Access Logs modal showed a blank
Email column for every in-*-udp row, even though every other protocol's
rows show the client normally.

The peer's decapsulated tunnel IP does survive as the log's "from" address,
and that IP deterministically maps to exactly one configured peer. Builds a
"<inbound tag>|<ip>" -> email index from the same AmneziaWG inbounds already
parsed elsewhere (amneziawg.InstanceFromInbound), and fills in Email from it
whenever the raw log line didn't have one.

* fix(amneziawg): enable sniffing on the TPROXY bridge

Domain-based Routing rules could never match RouteThroughXray traffic: an
AmneziaWG peer resolves DNS itself, through the tunnel, before ever sending
a packet, so the decapsulated traffic TPROXY hands to the bridge is already
a bare destination IP with no domain name attached at the network layer.
Every other inbound recovers this via sniffing (confirmed working for the
stock wireguard inbound, which does have it configured); the bridge never
got a sniffing block at all, so only tag/IP/network-based rules could ever
match it -- any domain rule above it in the list was silently unreachable.

* docs: add an AmneziaWG config page and list it as a supported protocol

Closes the PR checklist gap: the feature shipped with zero mention on
the docs site. Mirrors reality.mdx's structure (key settings, setup
steps, config excerpt) and notes the Docker/multi-node/Telegram-bot
caveats the PR itself is honest about not having confirmed.

* fix: address the fresh review round on PR #6105 (8 findings)

1. hostRulesFingerprint didn't account for ForwardedPorts when
   RouteThroughXray was off, so re-IPing a peer with port-forwarding
   configured left stale DNAT rules pointing at an address the next
   peer could be handed.
2. Server/client config values (keys, email, I1) were never validated
   for control characters before being written into the generated
   .conf; a newline could smuggle a PostUp hook into awg-quick's
   parser. Added ValidateConfigValue at save time and a
   sanitizeConfigValue backstop at render time.
3. checkForwardedPortsConflict didn't scope to node_id IS NULL, so a
   port used only on a different node produced a false collision; also
   hoisted the panel-port/inbounds lookup out of the per-client loop
   (portConflictContext) so N clients cost one query, not N.
4. PostDown commands were ";"-joined and abort on the first failure;
   appendOrTrue makes teardown best-effort so an external firewall
   flush can't leave DNAT rules to accumulate across bounces.
5. The "ip rule list | grep -q" existence check could SIGPIPE under
   pipefail and re-add a duplicate rule; switched to grep -c >/dev/null.
6. Ported the vpn:// share-link format (base64url of the plain .conf
   text, matching the real AmneziaVPN app) onto this branch -- it had
   only ever landed on our own fork's main, so this PR branch was still
   on the old amneziawg://+query-params scheme our own docs no longer
   described. Also corrected the docs' install.sh claim (opt-in/
   interactive, not automatic) and stale pre-opt-in comments in
   route_egress.go.
7. install.sh: Arch's ndppd install used pacman -Syu (full system
   upgrade) instead of -Sy like every other call in the script; and
   should_install_amneziawg re-prompted on every `x-ui update` even
   when awg was already installed.
8. CollectTraffic could clobber a concurrent restart's freshly-reset
   (empty) traffic baseline with stale pre-restart counters, since
   getPeerStats runs lock-free; now checks pointer identity before
   writing back. sweepOrphansLocked permanently disabled itself on a
   transient os.ReadDir failure instead of allowing a retry.

go build/vet/test and frontend typecheck/lint/build/vitest all pass.

* fix(install.sh): check the live sysctl value, not sysctl.conf text

Reviewer feedback (cherts, PR #6105): grepping /etc/sysctl.conf for the
setting name is unreliable -- many distros split sysctl config across
/etc/sysctl.d/*.conf, and /etc/sysctl.conf can be a symlink into that
directory, so the check can miss an already-active setting (harmless
duplicate append) or match a disabled/commented line (forwarding
silently stays off). Query the live value via `sysctl -n` instead,
which is accurate regardless of which file set it. Applied the same
fix to both the IPv6 and IPv4 checks for consistency.

* fix: update inbound_amneziawg.go to the split buildInboundForLocalRuntime

Same fork-only-file blind spot as the one caught on our own main after
the 3.6.0 sync: upstream split buildRuntimeInboundForAPI into
buildInboundForNodePush / buildInboundForLocalRuntime (part of the
node-sync client-deletion fix, 5bc81dfd), updating every call site it
could see. This file doesn't exist upstream, so it kept calling the
old name even after the branch merged in that commit.

* fix(frontend): recognize AmneziaWG's vpn:// scheme in share-link labels

The shared link-tag/label helper (used by the client info modal, QR
modal, and subscription page) had no entry for the vpn:// scheme
AmneziaWG links use, so it fell through to the generic fallback: a
plain "Vpn" tag with no color, and an empty remark/port that made the
row's title fall back to "Link N" instead of the inbound's actual
name:port — unlike every other protocol, which shows its real tag and
label.

vpn:// links are base64url of a plain .conf text (matching the real
AmneziaVPN app's own share-link format), not a structured URL, so
there's no query string or #hash to read a remark/port from. Decode
the payload and pull the remark/endpoint back out of the .conf text
directly instead.

* fix(xray): force a full restart for TPROXY inbounds, never hot-add them

Real incident: an AmneziaWG inbound with RouteThroughXray enabled lost
all internet on that connection after a migration. Root-caused on the
live box -- iptables TPROXY counters were incrementing (packets
correctly redirected to 127.0.0.1:63110), but nothing was actually
listening there (ss showed nothing on that port) until a full
`systemctl restart x-ui`, after which the bridge came up immediately.

Xray-core's gRPC AddInbound reports success for a new sockopt.tproxy
inbound (internal/amneziawg's own Xray egress bridge is the only kind
this fork ever generates) but doesn't reliably bind a working listener
for it outside of process startup -- the bridge silently never comes
up, and RouteThroughXray traffic goes nowhere until the next full
restart happens to occur for an unrelated reason.

diffInbounds already has this exact defensive pattern for REALITY
inbounds ("a gRPC remove+add does not reliably rebuild the REALITY
authenticator"), just never extended to TPROXY, and only in the
already-existing-then-changed branch -- the "brand new inbound" branch
had no such guard at all, which is exactly the path a freshly-enabled
RouteThroughXray bridge takes. Added inboundUsesTproxy and wired it
into both branches.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): flag Xray for resync when a peer edit changes qualifying state

Real production bug, root-caused on iiadmin-vps: updateAmneziaWGInbound/
AddInbound/DelInbound only ever updated the kernel interface via
amneziawg.GetManager() -- they never called SetNeedRestart the way every
other protocol's mutation path does (client_crud.go, inbound.go, etc. all
do). injectAmneziawgEgress's TPROXY bridge inbound depends on
InstanceFromInbound finding at least one qualifying peer plus
RouteThroughXray, so an edit that flips that (first peer added, last one
removed, RouteThroughXray toggled on) previously required a full panel
restart before the bridge actually got created, with no error anywhere:
the kernel interface would handshake fine, but traffic redirected into the
bridge's TPROXY port went nowhere because nothing was listening there.

diffInbounds/inboundUsesTproxy already correctly force a full restart for
a brand new TPROXY inbound (bdee0a20) -- that part was never the bug. The
gap was entirely upstream: nothing ever told Xray a resync was even needed.

* fix(clients): reject AllowedIPs already used on another WireGuard/AmneziaWG inbound

defaultWireguardClients/defaultAmneziaWGClients only ever checked uniqueness
against their own inbound's client list, so two inbounds sharing a subnet
(same protocol or not) could silently hand out or accept the same address --
the exact scenario behind a real duplicate-IP incident where a WireGuard and
an AmneziaWG client both ended up on the same address. otherTunnelAllowedIPs
now collects every address already claimed on every other tunnel inbound and
folds it into both the auto-allocation pool and the manual-entry collision
check, naming the other inbound in the error when it fires.

* fix(frontend): add the missing AmneziaWG config download on the sub page

The subscription page already gave WireGuard links their own "Config"
block (copy/download/QR of the actual .conf, via wireguardConfigFromLink
reversing the wireguard:// query params) but had no equivalent for
AmneziaWG's vpn:// links -- its isWireguardLink gate never matched them,
and no reverse-parse helper existed for this page specifically. Every
other surface (InboundInfoModal, ClientInfoModal, ClientQrModal) already
had this parity; this was the one page that didn't.

Fixed by adding amneziawgConfigFromLink (inbound-link.ts), simpler than
its WireGuard counterpart since a vpn:// payload already *is* the plain
.conf text -- just base64url-decode it, no query-param reconstruction
needed -- and wiring it into SubPage.tsx alongside the existing WireGuard
block, reusing the same pages.clients.amneziaWgConfig label the other
three surfaces already use.

* fix(xray): force a full restart for password-auth SOCKS5 hot-apply

Real production incident: editing a client under an AmneziaWG inbound
left its embedded SOCKS5 relay's settings byte-different (a new account
list), and Xray's gRPC remove+add hot swap silently dropped the account
for a peer whose email contained non-ASCII characters -- its tunnel kept
handshaking fine but all its traffic got rejected at the SOCKS5 layer,
while every other peer on the same relay was unaffected. A full restart
(reading the same JSON straight from disk) always produced the correct
account list. socks isn't in userDiffableProtocols (that only covers
vless/vmess/trojan's clients+email shape, not accounts+user), so any
settings drift on this inbound fell through to the generic remove+add
path. Forces a restart instead, the same defensive choice already made
for REALITY and TPROXY -- scoped to auth:"password" specifically so the
other, noauth SOCKS5 bridges (panel/node/mtproto egress) keep the cheaper
hot path.

* Fix Attach reusing one identity's address across wg/awg inbounds

ClientService.Attach deliberately copies one identity's stored
AllowedIPs into every WireGuard/AmneziaWG inbound it's attached to
in the same call, so the same person gets the same tunnel address
on every protocol they use. Its loop calls addInboundClient once per
inbound, and each of those independently computes
otherTunnelAllowedIPs -- so by the second inbound in the batch, the
first inbound's just-written copy of this identity's own address
looked like a cross-inbound collision against itself.

Real production symptom this caused: detaching then re-attaching a
client to both wg and awg failed with "wireguard: allowedIPs entry
X is already used by a client on inbound 'awg' (#N)" -- the exact
address the identity is supposed to keep, rejected as if it belonged
to someone else.

Add a selfEmails exclusion to otherTunnelAllowedIPs and populate it
from the client(s) being processed at the one real call site. Safe
unconditionally: ClientRecord.Email is globally unique, so a match
can only ever be this same identity's own entry on a sibling inbound,
never a genuine different client's address.

Reproduced the underlying mechanism live (manual entry correctly
rejected as a cross-inbound collision; fresh auto-allocation
correctly avoided a used address) before writing the fix, to confirm
the guard itself works and the bug is specifically in how Attach's
per-inbound calls interact with it.

* Attach: allocate fresh when re-attaching with no active tunnel

The previous fix (82cc69f5) made Attach's own address-reuse
correctly not collide with itself across inbounds -- but it still
always reused an identity's stored AllowedIPs verbatim, even when
that identity currently has zero WireGuard/AmneziaWG attachments at
all. A real report from testing this live: an identity fully
detached from both its wg and awg inbounds, then re-attached, got
its old address back even though several lower addresses were free
-- because nothing about being fully detached ever cleared the
stored value Attach copies from.

Add hasTunnelAttachment, checked once against the identity's CURRENT
inbound set before Attach's loop runs: if none of its current
inbounds is WireGuard/AmneziaWG, clear the stored AllowedIPs so this
attach allocates fresh (matching what a brand-new client would get)
instead of resurrecting an address nothing reserves anymore. Left
alone when the identity already has an active tunnel elsewhere, so
extending it to a second protocol still keeps a consistent address.

* Fix TestOtherTunnelAllowedIPsExcludesSelfEmail's own test setup

CI caught this: the "genuinely different client" (other@wg) was
seeded onto the SAME inbound passed as excludeID, which
otherTunnelAllowedIPs already excludes entirely regardless of the
selfEmails fix -- so the assertion that its address is still
reported could never have passed, proving nothing either way. Move
it onto the sibling inbound alongside shared@id, which is what the
test actually needs to exercise (two clients on one sibling, one
excluded by email, one not).

* Attach: never inherit an address that doesn't fit the target inbound

hasTunnelAttachment (from the earlier fix, commit 51067f16) only
asked "does this identity have ANY tunnel attachment", treating that
as license to reuse its stored address verbatim on every inbound
being attached. Real production case this missed: an identity's
stored address came from WireGuard's own fallback subnet
(10.0.0.0/24, used when that inbound has no other clients to infer a
base from), then got attached to a second, AmneziaWG inbound
configured for a completely different subnet (10.8.1.0/24).
defaultAmneziaWGClients's already-set-AllowedIPs branch only checks
for collisions, never subnet membership, so the mismatched address
was accepted silently -- producing a peer that can never actually
connect, since an AmneziaWG address must fall inside the kernel
interface's own configured subnet to be routable at all.

Add addressesFitAmneziaWGInbound, checked per inbound inside Attach's
loop: if the inherited address doesn't fit the SPECIFIC inbound being
attached, clear it just for that one so it gets a fresh, valid
allocation instead, while other already-attached inbounds keep their
existing values. WireGuard has no equivalent strict subnet
requirement (allocateWireguardAddress can widen to a fallback pool
for it), so this only ever constrains AmneziaWG targets.

* Give WireGuard an explicit, admin-configurable subnet field

WireGuard previously had no configurable subnet at all -- only an
implicit one, either inferred from existing clients' own addresses
(wireguardAllocationBase) or a hardcoded 10.0.0.0/24 fallback when
none exist yet. AmneziaWG, by contrast, has always had a real
server.subnetIp/subnetCidr field in its settings, editable in the
UI. User request: give WireGuard the same treatment.

Backend: explicitWireguardSubnetBase reads an optional subnetIp/
subnetCidr pair from the inbound's own settings JSON (mirroring
AmneziaWG's defaultAmneziaWGSubnetBases). defaultWireguardClients
checks it first; only when unset does it fall back to today's
inference-from-existing-clients behavior, so an inbound saved before
this field existed keeps working exactly as it always has.

Frontend: subnetIp/subnetCidr added to WireguardInboundSettingsSchema
and the inbound form (mirroring AmneziaWG's own field layout/labels),
with a real default (10.0.0.0/24, the same value the backend already
fell back to) seeded for newly created inbounds so the field starts
populated and editable rather than blank. Translated across all 13
locales.

This also structurally closes the class of bug fixed in
82cc69f5/291c47b3: with wg and awg subnets explicit and
independently controllable, an admin who wants matching addresses
across both protocols can configure them to actually agree, instead
of one silently inheriting the other's incompatible range.

* Split the client edit form's AllowedIPs into per-protocol fields

A client attached to both WireGuard and AmneziaWG shared one AllowedIPs
form field with a dynamically-switching label, so its two genuinely
different addresses could never both be shown or edited correctly.
Worse, Update/Create broadcast that one shared value to every attached
wg/awg inbound with no subnet-fit check, so an ordinary edit save could
silently overwrite one protocol's address with the other's -- the same
bug class already fixed for Attach, but reachable from any client edit.

model.Client gains an optional AllowedIPsByInbound map so a caller can
send distinct values per inbound; Update/Create honor it and, when it's
absent, clear a shared value that doesn't fit an AmneziaWG inbound's own
subnet instead of writing it through. A new TunnelAllowedIPsByInbound
read path feeds the real per-inbound address to the client edit form via
GET, which now renders two separate, correctly-labeled fields whenever
both protocols are attached (unchanged single dynamic field otherwise).

* Regenerate openapi.json for the new allowedIPsByInbound field

Follow-up to 878ee839: gen:zod (frontend/src/generated) was already
regenerated and committed, but gen:api (frontend/public/openapi.json)
wasn't, so CI's codegen drift check failed.

* Fix build breakage from merging upstream main: Update() gained a limitHwid param

Two of our own AllowedIPs tests (not present upstream, so the merge never
flagged them as conflicting) still called the old 3-arg Update(inboundSvc,
id, client) -- upstream's hardware-ID-limit feature added a required
limitHwid parameter that every other caller in this package already
passes. Also drop createDefaultInboundSettings from InboundsPage.tsx: the
merge conflict resolution kept the import, but upstream's clone-payload
refactor (buildClonePayload, inbound-clone.ts) already calls it
internally now -- this file doesn't need it directly anymore.

* Fix real bug: AmneziaWG clients rejected as "empty client ID" in 3 places

Three switch statements on inbound.Protocol handle "wireguard" explicitly
(checking client.PublicKey) but fall through to the default case for
"amneziawg" (checking client.ID, which AmneziaWG clients never set --
they use PublicKey/Email like WireGuard, not the VMess/VLESS UUID field).
This is what the 4 AllowedIPs tests were actually catching:
UpdateInboundClient's newClientId derivation hit this same default branch,
so every Update() on an AmneziaWG client returned "empty client ID"
before ever reaching the AllowedIPs logic being tested.

Fixed by adding "amneziawg" alongside "wireguard" in each switch:
addInboundClient's per-client validation, UpdateInboundClient's
newClientId derivation, and AddInbound's per-client validation (the
third one wasn't hit by these tests, but has the identical bug -- creating
a brand-new AmneziaWG inbound with a client attached would fail the
same way).

* refactor(amneziawg): rename Obfuscation20 to Obfuscation31, drop the dead mobile preset

Mechanical rename ahead of the AmneziaWG 3.1 parameter work: the type,
generator and prose all said 2.0, and the "mobile" generator preset was
reachable only from its own test. No behavior change.

* feat(amneziawg): AmneziaWG 3.1 obfuscation parameters (backend + generated schemas)

Adds the 3.1 parameter surface to the inbound settings and both Go config
emitters: I2-I5 signature packets, HeaderProtectionKey (base64 32-byte,
shared server<->client), ContentPaddingAddition, the five handshake-timing
randomization ranges (RekeyAfterTime/RekeyTimeout/RejectAfterTime/
KeepaliveTimeout/MaxHandshakeAttempts), and the RandomTrailers/
DisableCookies switches. Freshly generated sets fill everything except
I2-I5 (matching Amnezia's own generator) with jittered ranges bracketing
WireGuard's stock timing constants; every reject window starts >= 30s
above the rekey window by construction. Empty fields stay off the wire,
so blanking a field disables just that feature.

Validation generalizes the H1-H4 range checker for the new uint32-range
fields, requires min 1 on timers, cross-checks rekey-vs-reject, and
demands a real 32-byte base64 header-protection key. The manager warns
once per process when the installed awg tools predate 3.1 but an inbound
uses 3.1 parameters (awg-quick rejects unknown keys with a generic
error otherwise); apply still proceeds.

Requires amneziawg-tools v3.1.20260812+ / module or amneziawg-go
v3.1.20260814+ on the host.

* feat(amneziawg): emit and randomize 3.1 parameters in the frontend

Both client-config emitters (the vpn:// link builder and the clients-page
.conf builder) now carry the 3.1 [Interface] lines in the same order as
the Go emitters. The obfuscation randomizer moves out of InboundFormModal
into a shared lib/xray/amneziawg-obfuscation.ts that also fills the new
fields, and createDefaultAmneziawgInboundSettings switches from static
values to that generator — a fresh inbound now really gets the unique
fingerprint the docs promise instead of the same jc=5/jmin=10 set on
every install.

Schema parse-time defaults for the new fields stay ''/false on purpose:
real values come only from the generator, so resaving an inbound never
mutates its stored parameters. A new parity test pins the hand-written
AmneziawgServerSchema to the generated ServerSettings key set, so a field
added on one side can no longer silently vanish from configs.

* feat(amneziawg): 3.1 form fields and translations

Inbound form gains inputs for I2-I5, HeaderProtectionKey (filled by the
existing obfuscation Regenerate button), ContentPaddingAddition, the five
timing ranges, and the RandomTrailers/DisableCookies switches; the MTU
input picks up the min=1 its schema already enforced. All 13 locales get
the 19 new keys and drop the "2.0" branding from the s3/s4/i1 labels.

* docs(amneziawg): document 3.1 parameters; install.sh kernel/version notes

The AmneziaWG page's obfuscation section moves from the 2.0 to the 3.1
parameter set: table rows for I2-I5, HeaderProtectionKey,
ContentPaddingAddition, the timing-randomization ranges and the
RandomTrailers/DisableCookies switches, a requirements callout (tools
v3.1.20260812+, module/awg-go v3.1.20260814+, Linux 6.7+ for the DKMS
path), and a sample client .conf that matches what the panel actually
emits (including the DNS defaults and PersistentKeepalive it always had).

install.sh warns before a DKMS build on a pre-6.7 kernel and after any
install that left pre-3.1 amneziawg-tools on PATH.

Also updates the hosts API operation paths ({id} -> {groupId}) in the
stale ru/zh/fa reference pages: syncing docs/public/openapi.json for the
new AmneziaWG schema fields surfaced that rename, which had never been
copied over, and the docs build fails on paths missing from the spec.

* fix(amneziawg): reject control characters and canonicalize 3.1 range values

Adversarial review of the 3.1 work surfaced a validation gap:
base64.DecodeString silently ignores CR/LF, so a header-protection key
that picked up a line wrap in transit decoded to a valid 32 bytes,
passed validation, and was emitted verbatim into every client config —
where the orphan second line breaks the import while the server (whose
emitter strips control chars) keeps running with the correct key. The
key and range validators now reject control characters outright.

Also from the same review: range values are canonicalized on save
("110 - 140" -> "110-140", whitespace-only collapses to feature-off,
closing a case where the server conf rendered an invalid blank-value
line the client emitters omitted); the rekey/reject invariant is now
enforced against WireGuard's 120s/180s defaults when only one side is
set; and the structural fingerprint joins on "\n" instead of "|",
which is a legal I1-I5 character and made adjacent free-text fields
join-ambiguous.

* fix(install): resolve latest release tag via web redirect to dodge API rate limits

The non-interactive install smoke test resolved the release version through
the unauthenticated GitHub API (api.github.com/.../releases/latest), which
allows only 60 requests/hour per IP. The test installs twice in one run, and
on shared CI runner IPs the second call gets rate-limited, returns no
tag_name, and install.sh treats an empty version as fatal (exit 1) — the same
"Failed to fetch x-ui version" real users hit behind CGNAT/shared addresses.

resolve_latest_tag() now reads the tag from the github.com releases/latest
web redirect (not subject to the API rate limit), falling back to the API
only if the redirect yields nothing. Verified with the real
deploy/test/smoke-noninteractive.sh (two installs, both green).

* fix(amneziawg): three review findings on #6105, plus a comment trim

1. A peer's allowedIPs reached the generated .conf unvalidated and
   unsanitized, unlike email/publicKey/preSharedKey which
   normalizeAmneziaWGSettings already guards. A newline in an entry let a
   following "[Interface]" re-open the interface section, whose "PostUp = ..."
   awg-quick then runs as root on the next apply. Reproduced end to end
   against generateServerConfig. The save path now rejects and canonicalizes
   through normalizeWireguardAllowedIPs, and the render path sanitizes as a
   backstop for rows predating the validation (an upgrade, a restored backup,
   a direct DB edit). H1-H4 get the same render-time sanitize, and the two NIC
   name fields a plausibility check, since stripping control characters alone
   would still let a shell metacharacter into a root-executed PostUp line.

2. EgressPortForInbound is 63100 + inbound id, so an id past 2435 derives a
   port above 65535 -- and Xray rejects the whole generated config over one
   invalid port, taking every other protocol down with it. It now reports
   ok=false past the range, and both the Xray bridge and its TPROXY rules are
   skipped instead of emitting an impossible port.

3. The downloadable AmneziaWG .conf read ClientRecord.allowedIPs, a single
   shared column that holds the WireGuard address for an identity attached to
   both protocols -- the exact ambiguity tunnelAllowedIPs was added to resolve
   for the edit form. The info and QR modals already hydrate that field, so
   they now pass this inbound's own address to the builder.

Also trims the comment blocks in the files touched here to the 2-line
guidance in CLAUDE.md: internal/amneziawg alone carried 423 comment lines in
over-long blocks against 118 for the comparable internal/mtproto, and is now
at 110. Every non-obvious constraint is kept (the kernel S1/S2 rule, why
PostDown is best-effort, why grep -c and not -q, why the fingerprints split
three ways); the narration is gone. Two hot_diff.go comments pointed at an
internal/amneziawgnet package and an injectAmneziawgnetSocks function that
exist nowhere in the tree; the checks themselves are unchanged.

* feat(logs): add an AmneziaWG log view to the overview

The overview has an access-log view for Xray but nothing for AmneziaWG, so
when a tunnel misbehaves there is no way to see it from the panel at all. A
kernel tunnel logs no per-request lines, so the equivalent view is built from
the two things it does expose:

- Live per-peer activity from `awg show <iface> dump`, joined to the client
  email through the desired peer set: last handshake, endpoint, allowed IPs,
  cumulative transfer and online state, newest handshake first.
- The panel's own AmneziaWG event lines (interface up/down, awg-quick
  failures, the pre-3.1 tools warning), which are what actually explain a peer
  being absent from the table.

POST /panel/api/server/amneziawglogs/:count serves both, with the same
count + filter contract GetXrayLogs uses, and the modal mirrors XrayLogModal's
toolbar, auto-update, mobile cards and download. The action-bar button is
gated on a new status.amneziawg.configured, which stays true while an inbound
exists but its interface is down -- exactly when the event lines matter.

Verified against a running panel: the endpoint returns the peer table and
real event lines ("awg/awg-quick not found on PATH", "create config dir:
permission denied"), and count and filter both narrow as documented.

One of those lines surfaced a Debugf that had been rendering as
"for inbound1:amneziawg:"; fixed here since it is now user-visible.

* fix(amneziawg): stop double-counting a routed inbound's traffic

injectAmneziawgEgress tags its Xray bridge with the AmneziaWG inbound's own
tag, so the stock Routing page can target it. Xray therefore reports that
bridge's bytes under the inbound's tag, and XrayTrafficJob feeds them to
AddTraffic -- which accumulates -- on top of the same bytes AmneziaWGJob
already reported from `awg show dump`. An inbound with routeThroughXray on
counted roughly twice its real traffic, which also inflates the quota checks
that read the same counters.

The awg counters are the complete measure: every peer, whether or not TPROXY
routed it, and the same wire bytes the per-client totals are built from, so
they stay and the Xray rows are dropped. Per-client stats were never affected
-- a dokodemo-door bridge has no per-user identity, so Xray emits no
user>>>email rows for it.

Filtering happens before every consumer, so the DB totals, the external
traffic inform and the dashboard's live speed all read one source per inbound.
The set of bridge tags now comes from a predicate shared with
injectAmneziawgEgress itself, with a test that pins the two together -- naming
one tag too few doubles the traffic again, one too many makes real traffic
vanish.

* fix(amneziawg): align the three .conf emitters on one peer field order

The panel builds an AmneziaWG client .conf in three independent places, and
they disagreed: buildAmneziaWGClientConfig put PresharedKey right after
PublicKey (wg-quick(8)'s own order, and what both WireGuard emitters on the
clients side already use), while genAmneziaWGConfig and the Go
amneziaWGConfigText put it after Endpoint. A user comparing a subscription
link against a downloaded .conf sees the difference immediately, and the
generators are exactly the kind of parallel implementation CLAUDE.md warns
about drifting.

Moves the two outliers onto the wg-quick order. Also drops the stray trailing
newline that only appeared when PersistentKeepalive was set, so a config now
always ends on its last set field whichever that is -- the same shape all
three emitters produce for the same client.

Parsing is unaffected either way (the format is order-insensitive, and the
AmneziaVPN app reads it as a flat key-value bag), so this changes only the
rendered text. Adds a test on each side that pins the peer block's field
order, since nothing previously asserted it.

* refactor(amneziawg): switch to the embedded amneziawg-go/gVisor architecture

Replaces the kernel-module (DKMS) + awg-quick + TPROXY backend with the
fork's own embedded design: amneziawg-go runs in-process over a userspace
gVisor netstack, and each peer's decapsulated traffic relays into its own
loopback Xray SOCKS5 inbound, so Xray's native stats/sniffing/routing work
for free instead of through hand-rolled bridges. No kernel module, no DKMS,
no Secure Boot conflicts, works the same in a container as on bare metal.

- internal/amneziawgnet: new package (Device/UAPI, gVisor netstack, TCP/UDP
  forwarding, SOCKS5 relay, peer identity, IPv6 host-alias egress identity,
  per-client port-forwarding) - amneziawg-go v3.1.20260814 + gvisor.
- internal/amneziawg: keep the reusable protocol-shape types/validation
  (Instance/Peer/Obfuscation, InstanceFromInbound); drop the OS-shellout
  half (awg-quick, TPROXY policy routing, NDP proxy, peer-stats parsing).
- internal/web/service: rewire the 5 integration points (job, runtime,
  client-apply, web shutdown, xray config) from the old manager to the new
  one; the AmneziaWG log view is rebuilt on the embedded Device's own UAPI
  dump (extended to carry endpoint/AllowedIPs) instead of `awg show dump`.
- install.sh: drop DKMS/ndppd/TPROXY/Secure-Boot installer code (~250
  lines) - an entire recurring class of installer fragility goes away.
- frontend: drop the now-meaningless routeThroughXray toggle (the relay is
  always on); keep the field in the Zod schema, unexposed, so it isn't
  silently stripped from stored settings on next save - two regression
  tests deliberately depend on the Go struct still carrying it.
- docs/i18n: rewrite amneziawg.mdx for the new architecture; drop the
  dead routeThroughXray translation keys across all 13 locales.

Real production throughput (embedded core datapath, isolated bench, same
box the kernel-module path was measured on): ~296 Mbit/s up, ~640 Mbit/s
down, vs. 414.69 MB/s (~3.3 Gbit/s) for the kernel module on the same
hardware - a real gap, tempered by this being single-stream/no-SOCKS5-hop
and most VPN traffic being latency-bound rather than throughput-saturating.

* fix(amneziawg): restore the branch's own Obfuscation31 shape + 2 CodeQL findings

The previous push's wholesale-copy of types.go/params.go from the fork's
main branch pulled in that branch's own independent (and incompatible)
naming for the same AWG 3.1 feature set: Obfuscation20/GenerateObfuscation20
instead of this branch's already-shipped Obfuscation31/GenerateObfuscation31,
and a missing CanonicalizeUintRange -- broke every Go CI job (the whole
matrix fails to compile when any one package doesn't, which is why govulncheck/
golangci/postgres-durable-first/race all failed identically, not just go-test).

Restores params.go/params_test.go verbatim from this branch's own last
commit (a strict superset of validation: it already cross-checks rekey vs.
reject timing windows, which the copied version never did) and folds the
3.0/3.1 fields (HeaderProtectionKey, ContentPaddingAddition, the 5 timing
fields, RandomTrailers/DisableCookies) into Obfuscation31 itself, matching
the original struct exactly instead of as separate top-level Instance
fields. instance.go, the two amneziawgnet call sites, and 7 amneziawgnet
test files updated to match. Also drops the one test (sanitizeConfigValue)
that only ever served the retired kernel-module .conf writer -- correctly
not ported, so the test testing it shouldn't have been copied either.

Also fixes 2 CodeQL findings the same push surfaced: a clamped uint64->int64
conversion for the new log view's live byte counters (server.go), and an
unneeded len+len sum feeding a slice pre-size in the v6-egress outbound
merge (xray.go) -- append already grows correctly without it.

* chore(amneziawg): regenerate frontend schemas for updated doc comments

npm run gen was missed after the previous commit's types.go doc-comment
edits (Obfuscation20 -> Obfuscation31, ValidateHeaderProtection ->
ValidateObfuscation in the prose) -- openapigen bakes those comments
into the generated schema's description field, so the committed
frontend/src/generated/schemas.ts and openapi.json still had the old
wording. codegen's git-diff-exit-code check caught it correctly.

* fix(amneziawg): narrow 2 test fixtures that collided with MaxForwardedPorts

TestCheckForwardedPortsConflict_CollidesWithEnabledInboundPort and
..._NoCollisionWhenPortsDontOverlap used "8000-8100"/"9000-9100" as their
ForwardedPorts fixture -- 101 ports each, one over MaxForwardedPorts (100).
The cap check (checkForwardedPortsConflict, added this session alongside
the SOCKS-phantom-port check) fires first, so both tests got "more than
100 forwarded ports" instead of ever reaching the collision logic they're
actually testing. The cap itself has its own dedicated boundary test
already; these two just needed a narrower range that still covers/misses
port 8080 as intended -- 8075-8085 and 9075-9085, 11 ports each.

* fix(amneziawg): checkAmneziawgnetSocksConflict had no receiver in its new home

My merge-conflict resolution kept this as a method call (s.checkAmneziawgnetSocksConflict)
inside checkPortConflictTx, a plain function with no *InboundService receiver --
upstream's #6225 fix moved the port-conflict check out of the (s *InboundService)
method and into this new tx-scoped free function, and I didn't notice the call
site needed to change shape too. CI caught it immediately (undefined: s); nothing
in this specific package can be locally verified past internal/database's own
unrelated, pre-existing CGO build issue on this dev machine.

Since the signature had to change either way, folded in the fix already flagged
as a separate follow-up: checkAmneziawgnetSocksConflict now takes the caller's
db handle instead of fetching its own via database.GetDB(), so it actually runs
inside the same serialized transaction #6225 introduced -- previously it sat
right next to that race fix without benefiting from it.

* fix: address the review findings on the embedded AmneziaWG PR

5 blocking findings:

- Floor S3/S4 at 12 in both obfuscation generators (Go and frontend) and
  reject a hand-edited value below that when HeaderProtectionKey is set --
  IpcSet requires it, and ~39% of previously-generated sets violated it
  silently.
- Guard PrivateKey/PrimaryDNS/SecondaryDNS/remark against newline injection
  in the AmneziaWG .conf builder (both the Go subscription-link path and
  the frontend downloadable-config path) -- unguarded, any of them could
  inject an arbitrary config line into a subscriber's client.
- Bound the derived AmneziaWG SOCKS relay port to <= 65535 once an
  inbound's id is known, and check the reverse direction (does the relay
  port collide with an existing inbound's port) on both create and update
  -- previously only port -> relay collisions were checked, not relay ->
  port.
- Gate injectAmneziawgV6Egress on the same V6AliasesActive predicate
  desiredV6Aliases already uses, so the two can't disagree about whether a
  peer's IPv6 identity is actually active at the OS level.

2 minor findings:

- Fix the forwarded-ports cap check's off-by-one (a spec covering exactly
  the cap was rejected as if it were over it).
- Correct docker-compose.yml's stale comment describing the retired
  DKMS/kernel-module architecture.

* chore: retrigger CI

build (armv5) failed on a transient Go module proxy network error
(INTERNAL_ERROR stream reset on sagernet/sing), unrelated to this PR's
changes.

* docs: fix doc comments still describing the retired DKMS/awg-quick design

A few doc comments (and one illustrative test log line) survived the
embedded-architecture cutover unchanged and now contradict the code
they sit next to:

- internal/amneziawg/types.go's package comment claimed this package
  still owns a Manager that reconciles OS-level interfaces via
  awg-quick/DKMS -- that Manager was removed; the reconcile loop lives
  in internal/amneziawgnet now, and this package is protocol-shape-only.
- internal/amneziawg/params.go's ValidateObfuscation/ValidateConfigValue
  comments cited "awg-quick up" / "awg-quick executes as root" as the
  reason to validate -- the server itself never calls awg-quick in this
  architecture; the same value still reaches a real rendered .conf that
  a client app or an admin's own awg-quick CLI applies downstream, so
  the validation is still warranted, just for a different consumer.
  Mirrored the same fix in inbound_amneziawg.go's matching comment and
  its test's comment.
- internal/amneziawgnet/manager.go's Manager doc comments (x3) pointed
  readers at "internal/amneziawg.Manager" for comparison -- that type no
  longer exists in this diff at all. Repointed at internal/mtproto.Manager,
  the pattern this was actually modeled on and the one that's still real.
- Swapped one test's illustrative "awg-quick up awg2 failed" log line for
  a message shaped like this architecture's actual amneziawgnet logging,
  so a reader skimming the test doesn't wonder whether the server still
  shells out to awg-quick.

No behavior change.

* fix(docs): re-run codegen for xray-settings.mdx after conflict merge

The automated conflict-resolution hand-merge for this generated file
was content-correct but didn't byte-match a real regen (different
YAML long-string folding style). Re-ran npm run gen + docs' gen:api
and kept that canonical output instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(amneziawg): drop the dead access-log email backfill

amneziawgEmailIndex keyed peers by "<tag>|<tunnel IP>", a scheme built
for the retired TPROXY bridge where the peer's decapsulated tunnel
address survived as the access log's from-address. The embedded
architecture relays through a loopback SOCKS5 dial, so every AmneziaWG
log line's from-address is 127.0.0.1:<ephemeral> and the lookup could
never match: the index was rebuilt on every log view just to miss.
Remove the index, its GetXrayLogs wiring and its test. If per-line
emails are wanted back, the relay would have to publish a
local-port->email registry for the viewer to resolve loopback sources.

* fix(api): generate AmneziaWGLogs/PeerActivity schemas instead of hand-writing them

The amneziawglogs endpoint's response structs were missing from
openapigen's StructAllow, so they were silently absent from every
generated schema/example, the endpoints.ts entry carried a hand-written
response, and AmneziaWGLogModal.tsx duplicated the shapes as local
interfaces - the exact drift the allowlist rule exists to prevent.
Allowlist both structs with example tags, point the endpoint at the
generated schema, import the generated types in the modal, and sync
docs/public/openapi.json.

* chore(amneziawg): drop the unreferenced quiccapture package

Nothing imports internal/amneziawg/quiccapture and no route exposes it;
its package doc justifies the code as a port of
frontend/src/lib/xray/i1Generators.ts, which does not exist in this
repository, and promises an API round-trip that also does not exist.
1,110 lines of unreachable code with misleading provenance claims.
Revert this commit to bring the package back when the live-capture I1
feature and its frontend counterpart actually land.

* fix(clients): re-run cross-inbound conflict checks on the serialized writer

The new client-level checks - cross-inbound AllowedIPs collisions and
AmneziaWG forwardedPorts conflicts - read a fresh DB snapshot, decide,
and only then enter runSerializedTx, while lockInbound only serializes
writers on the SAME inbound. Two concurrent client creates on two
different tunnel inbounds both passed the read and both committed,
yielding two peers with one address: the exact check-then-claim race
81cfd857 (#6225) closed for AddInbound, which this PR's own
checkAmneziawgnetSocksReverseConflict already cites. Keep the pre-tx
pass for fail-fast UX and re-validate inside the transaction, where the
single writer makes the answer authoritative. The race test drives two
goroutines at two inbounds and demands exactly one winner; it fails
with committed=2 when the in-tx re-check is removed.

* fix(amneziawg): hot-apply depletion disables like mtproto does

applyTrafficMutationBatch special-cases MTProto so a quota/expiry
depletion cuts the sidecar immediately, but AmneziaWG fell through to
runtime AddUser/RemoveUser - explicit no-ops for this protocol - so a
depleted peer kept tunneling until the next 10s reconcile tick. Route
it through applyLocalAmneziaWG, whose own contract (re-read committed
settings, filter depleted clients, push to the interface) is exactly
this case; the comment claiming it mirrors applyLocalMtproto is now
true for the depletion path too.

* fix(amneziawg): persist cleared DNS fields instead of resurrecting defaults

PrimaryDNS/SecondaryDNS marshaled with omitempty, so clearing them
persisted settings with no key at all - and the frontend re-parses
stored settings through a Zod schema whose .default('8.8.8.8') /
.default('8.8.4.4') fire on missing keys, silently repopulating the
form on every load and re-persisting the defaults on the next save.
Blank is a documented, meaningful state (no DNS line in client
configs); drop omitempty so a cleared value survives the round-trip.
The regression test normalizes a server block with cleared DNS and
fails when the keys are dropped.

* fix(amneziawg): accept cleared numeric obfuscation/subnet fields in the form

AntD InputNumber emits null when cleared, Zod .default() only replaces
undefined, and unlike wireguard.ts - whose optionalClearedInt comment
documents exactly this failure mode - the AmneziaWG schema declared
subnetCidr and jc/jmin/jmax/s1-s4 as bare z.number() defaults. Clearing
any of the eight fields made safeParse reject the null and block the
save until the user retyped a value. Absorb null into undefined while
keeping each field's schema default, so a cleared field refills its
documented default and legacy blobs with absent keys behave as before.

* fix(amneziawg): guard the third .conf emitter against newline injection

The review-round fix added the newline guard to amneziaWGConfigText (Go)
and buildAmneziaWGClientConfig, but genAmneziaWGConfig in inbound-link.ts
- the third of the three emitters its own comment says must not drift -
still rendered privateKey/primaryDns/secondaryDns/remark unescaped, so a
newline there injected a config line (e.g. a rogue PostUp) into the
inbound form's downloaded .conf. Add the same guard, plus the regression
tests the original fix shipped without: all four fields on the Go and
both frontend emitters go red if any guard is removed.

* test(amneziawg): pin the S3/S4 floors the TS drift guard claims to mirror

The test's docstring says it mirrors internal/amneziawg/params_test.go,
but it asserted S3>=8/S4>=4 while the Go test and both generators pin
12/12 - the floor ValidateObfuscation enforces whenever a header
protection key is set, which this generator always sets. A regression
narrowing the TS floors into 8-11/4-11 would have passed the drift
guard and produced configs the backend rejects on save.

* docs: restore the pia repo-map entry and document the AmneziaWG subsystem

Merging main dropped CLAUDE.md's internal/pia/ bullet (added by #6272)
while resolving the repo-map conflict - the package itself is untouched.
Restore it, add the missing map entries for the two packages this branch
introduces (internal/amneziawg/, internal/amneziawgnet/), bump the cron
count, and give amneziawg_job its row in architecture.md's 5.4 table.

* chore(amneziawg): correct comments stranded by the architecture pivot

ae77c7e9's cutover to the embedded gVisor path deleted the kernel-module
code but left several comments describing it in the present tense:
hot_diff.go cited the removed service.amneziawgEgressStreamSettings and
wrongly claimed AmneziaWG is the only sockopt.tproxy source (tunnel's
TProxy mode is the live one the guard protects), socks_config.go pointed
at the deleted EgressBasePort/EgressPortForInbound, manager.go referred
to the deleted Manager and its fingerprinting as live code, web.go's
cron registration claimed the job scrapes traffic (its own doc says it
does not), and types.go capped ContentPaddingAddition at uint16 when
validation and upstream both use uint32.

* style(lint): satisfy gofumpt/goimports so make verify is green

json_service.go's two 'Tag: "proxy"}' literals came in with main's own
cc245a90 formatting commit and fail the repo's gofumpt gate for everyone;
the import grouping in inbound_amneziawg.go is from the serialized-writer
fix on this branch.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
2026-08-24 02:41:15 +02:00

2253 lines
127 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"username": "Nama Pengguna",
"password": "Kata Sandi",
"login": "Masuk",
"confirm": "Konfirmasi",
"cancel": "Batal",
"close": "Tutup",
"save": "Simpan",
"logout": "Keluar",
"create": "Buat",
"add": "Tambah",
"remove": "Hapus",
"update": "Perbarui",
"copy": "Salin",
"copied": "Tersalin",
"more": "lainnya",
"download": "Unduh",
"regenerate": "Buat Ulang",
"jsonEditor": "Editor JSON",
"downloadImage": "Unduh Gambar",
"sort": "Urutkan",
"remark": "Catatan",
"enable": "Aktifkan",
"protocol": "Protokol",
"search": "Cari",
"filter": "Filter",
"all": "Semua",
"from": "Dari",
"to": "Ke",
"done": "Selesai",
"loading": "Memuat...",
"refresh": "Segarkan",
"clear": "Bersihkan",
"second": "Detik",
"minute": "Menit",
"hour": "Jam",
"day": "Hari",
"check": "Centang",
"indefinite": "Tak Terbatas",
"unlimited": "Tanpa Batas",
"none": "Tidak ada",
"qrCode": "Kode QR",
"info": "Informasi Lebih Lanjut",
"edit": "Edit",
"delete": "Hapus",
"reset": "Reset",
"noData": "Tidak ada data.",
"copySuccess": "Berhasil Disalin",
"sure": "Yakin",
"encryption": "Enkripsi",
"transmission": "Transmisi",
"host": "Host",
"path": "Path",
"camouflage": "Obfuskasi",
"status": "Status",
"enabled": "Aktif",
"disabled": "Nonaktif",
"depleted": "Habis",
"depletingSoon": "Akan Habis",
"offline": "Offline",
"online": "Online",
"domainName": "Nama Domain",
"monitor": "IP Pemantauan",
"certificate": "Sertifikat Digital",
"fail": "Gagal",
"comment": "Komentar",
"success": "Berhasil",
"lastOnline": "Terakhir online",
"lastSubFetch": "Pengambilan langganan terakhir",
"getVersion": "Dapatkan Versi",
"install": "Instal",
"clients": "Klien",
"usage": "Penggunaan",
"twoFactorCode": "Kode",
"remained": "Tersisa",
"security": "Keamanan",
"emptyDnsDesc": "Tidak ada server DNS yang ditambahkan.",
"emptyFakeDnsDesc": "Tidak ada server Fake DNS yang ditambahkan.",
"emptyBalancersDesc": "Tidak ada penyeimbang yang ditambahkan.",
"somethingWentWrong": "Terjadi kesalahan",
"subscription": {
"title": "Info langganan",
"subId": "ID langganan",
"status": "Status",
"downloaded": "Diunduh",
"uploaded": "Diunggah",
"expiry": "Kedaluwarsa",
"totalQuota": "Kuota total",
"individualLinks": "Tautan individual",
"active": "Aktif",
"inactive": "Nonaktif",
"unlimited": "Tanpa batas",
"noExpiry": "Tanpa kedaluwarsa",
"copyAllConfigs": "Salin Semua Konfigurasi",
"copyAllConfigsCopied": "Semua konfigurasi tersalin",
"email": "Email"
},
"menu": {
"theme": "Tema",
"dashboard": "Ikhtisar",
"inbounds": "Inbound",
"clients": "Klien",
"groups": "Grup",
"nodes": "Node",
"settings": "Pengaturan Panel",
"xray": "Konfigurasi Xray",
"routing": "Pengalihan",
"outbounds": "Outbound",
"apiDocs": "Dokumentasi API",
"donate": "Donasi",
"hosts": "Host",
"docs": "Dokumentasi",
"openMenu": "Buka menu",
"pinSidebar": "Sematkan bilah sisi",
"unpinSidebar": "Lepas sematan bilah sisi",
"subFormats": "Sub Formats"
},
"pages": {
"login": {
"hello": "Halo",
"title": "Selamat Datang",
"loginAgain": "Sesi Anda telah berakhir, harap masuk kembali",
"toasts": {
"invalidFormData": "Format data input tidak valid.",
"emptyUsername": "Nama Pengguna diperlukan",
"emptyPassword": "Kata Sandi diperlukan",
"wrongUsernameOrPassword": "Username, kata sandi, atau kode dua faktor tidak valid.",
"successLogin": "Anda telah berhasil masuk ke akun Anda."
}
},
"index": {
"cpu": "CPU",
"swap": "Swap",
"storage": "Penyimpanan",
"memory": "Memori",
"xrayStatus": "Xray",
"stopXray": "Hentikan",
"restartXray": "Mulai ulang",
"xraySwitch": "Versi",
"xrayUpdates": "Pembaruan Xray",
"xraySwitchClickDesk": "Pilih dengan hati-hati, karena versi yang lebih lama mungkin tidak kompatibel dengan konfigurasi saat ini.",
"updatePanel": "Perbarui Panel",
"panelUpdateDesc": "Ini akan memperbarui 3X-UI ke rilis terbaru dan me-restart layanan panel.",
"currentPanelVersion": "Versi panel saat ini",
"latestPanelVersion": "Versi panel terbaru",
"panelUpToDate": "Panel sudah terbaru",
"devChannel": "Kanal dev",
"devChannelWarning": "Build dev mengikuti setiap commit di main dan bukan rilis stabil — tidak ada penurunan versi otomatis.",
"currentCommit": "Commit saat ini",
"latestCommit": "Commit terbaru",
"updateChannelChanged": "Kanal pembaruan diubah",
"xrayStatusUnknown": "Tidak diketahui",
"xrayStatusRunning": "Berjalan",
"xrayStatusStop": "Berhenti",
"xrayStatusError": "Error",
"systemHistoryTitle": "Riwayat Sistem",
"historyTitleCpu": "Penggunaan CPU",
"historyTitleMem": "Penggunaan Memori",
"historyTitleNetwork": "Bandwidth Jaringan",
"historyTitlePackets": "Paket Jaringan",
"historyTitleDisk": "I/O Disk",
"historyTitleOnline": "Klien Online",
"historyTitleLoad": "Rata-rata Beban Sistem (1 / 5 / 15 mnt)",
"historyTitleConnections": "Koneksi Aktif (TCP / UDP)",
"historyTitleDiskUsage": "Penggunaan Ruang Disk",
"historyTabBandwidth": "Bandwidth",
"historyTabPackets": "Paket",
"historyTabDisk": "Disk I/O",
"historyTabOnline": "Online",
"historyTabLoad": "Beban",
"historyTabConnections": "Koneksi",
"historyTabDiskUsage": "Penggunaan Disk",
"xrayMetricsTitle": "Metrik Xray",
"xrayTitleHeap": "Memori Heap Teralokasi",
"xrayTitleSys": "Memori Dicadangkan dari OS",
"xrayTitleObjects": "Objek Heap Aktif",
"xrayTitleGcCount": "Siklus GC Selesai",
"xrayTitleGcPause": "Durasi Jeda GC",
"xrayTitleObservatory": "Kesehatan Koneksi Keluar",
"xrayTabHeap": "Heap",
"xrayTabSys": "Sys",
"xrayTabObjects": "Objek",
"xrayTabGcCount": "Jumlah GC",
"xrayTabGcPause": "Jeda GC",
"xrayTabObservatory": "Observatorium",
"xrayMetricsDisabled": "Endpoint metrik Xray belum dikonfigurasi",
"xrayMetricsHint": "Tambahkan blok metrics tingkat atas ke konfigurasi xray dengan tag metrics_out dan listen 127.0.0.1:11111, lalu mulai ulang xray.",
"xrayObservatoryEmpty": "Belum ada data Observatory",
"xrayObservatoryHint": "Tambahkan blok observatory ke konfigurasi xray yang mencantumkan tag outbound untuk diuji, lalu mulai ulang xray.",
"xrayObservatoryTagPlaceholder": "Pilih outbound",
"xrayObservatoryAlive": "Aktif",
"xrayObservatoryDead": "Mati",
"xrayObservatoryLastSeen": "Terakhir terlihat",
"xrayObservatoryLastTry": "Percobaan terakhir",
"connectionCount": "Statistik Koneksi",
"ipAddresses": "Alamat IP",
"toggleIpVisibility": "Alihkan visibilitas IP",
"overallSpeed": "Kecepatan keseluruhan",
"upload": "Unggah",
"download": "Unduh",
"sent": "Dikirim",
"received": "Diterima",
"xraySwitchVersionDialog": "Apakah Anda yakin ingin mengubah versi Xray?",
"xraySwitchVersionDialogDesc": "Ini akan mengubah versi Xray ke #version#.",
"xraySwitchVersionPopover": "Xray berhasil diperbarui",
"panelUpdateDialog": "Apakah Anda benar-benar ingin memperbarui panel?",
"panelUpdateDialogDesc": "Ini akan memperbarui 3X-UI ke #version# dan me-restart layanan panel.",
"panelUpdateStartedPopover": "Pembaruan panel dimulai",
"panelUpdateFailedTitle": "Pembaruan panel gagal",
"panelUpdateFailedDesc": "Pembaruan tidak selesai dengan sukses. Periksa log server, atau jalankan 'x-ui update' dari baris perintah.",
"panelUpdateUnknownTitle": "Tidak dapat memastikan pembaruan selesai",
"panelUpdateUnknownDesc": "Panel tidak melaporkan hasil tepat waktu. Muat ulang untuk memeriksa versi saat ini, atau periksa log server.",
"geofileUpdateDialog": "Apakah Anda yakin ingin memperbarui geofile?",
"geofileUpdateDialogDesc": "Ini akan memperbarui file #filename#.",
"geofilesUpdateDialogDesc": "Ini akan memperbarui semua berkas.",
"geofilesUpdateAll": "Perbarui semua",
"geofileUpdatePopover": "Geofile berhasil diperbarui",
"geodataTitle": "Pembaruan Otomatis Geodata",
"geodataHint": "Xray mengunduh berkas ini sesuai jadwal dan memuat ulang tanpa restart. URL harus HTTPS. Setiap berkas harus sudah ada di folder bin agar Xray dapat memperbaruinya.",
"geodataCron": "Jadwal (cron)",
"geodataOutbound": "Unduh melalui outbound (opsional)",
"geodataFile": "Nama berkas",
"geodataAddFile": "Tambah berkas",
"geodataSaveRestart": "Simpan & Mulai Ulang Xray",
"geodataConfirmTitle": "Simpan pengaturan geodata?",
"geodataConfirmContent": "Templat konfigurasi Xray akan diperbarui dan Xray akan dimulai ulang.",
"geodataInvalidUrl": "Setiap berkas memerlukan URL HTTPS.",
"geodataInvalidFile": "Nama berkas harus berupa nama sederhana, mis. geosite_custom.dat (tanpa path).",
"geodataInvalidCron": "Cron harus terdiri dari 5 bagian, mis. 0 4 * * *",
"geodataEmpty": "Belum ada berkas yang dikonfigurasi. Pada aturan routing, rujuk berkas sebagai ext:geosite_custom.dat:category.",
"dontRefresh": "Instalasi sedang berlangsung, harap jangan menyegarkan halaman ini",
"logs": "Log",
"accessLogs": "Log Akses",
"autoUpdate": "Pembaruan Otomatis",
"amneziawgLogs": "Log AmneziaWG",
"amneziawgHandshake": "Handshake Terakhir",
"amneziawgInterface": "Antarmuka",
"amneziawgInbound": "Inbound",
"amneziawgEndpoint": "Endpoint",
"amneziawgIdle": "Idle",
"amneziawgEvents": "Peristiwa",
"amneziawgNoPeers": "Tidak ada peer AmneziaWG yang aktif",
"amneziawgNoEvents": "Belum ada peristiwa AmneziaWG yang tercatat",
"config": "Konfigurasi",
"backupTitle": "Cadangan & Pulihkan",
"exportDatabase": "Cadangkan",
"exportDatabaseDesc": "Klik untuk mengunduh file .db yang berisi cadangan dari database Anda saat ini ke perangkat Anda. Berkas yang sama juga dapat dipulihkan ke panel yang berjalan di PostgreSQL.",
"importDatabase": "Pulihkan",
"importDatabaseDesc": "Klik untuk memilih dan mengunggah cadangan .db atau dump migrasi (.dump) dari perangkat Anda untuk memulihkan database.",
"importDatabaseSuccess": "Database berhasil diimpor",
"importDatabaseError": "Terjadi kesalahan saat mengimpor database",
"readDatabaseError": "Terjadi kesalahan saat membaca database",
"getDatabaseError": "Terjadi kesalahan saat mengambil database",
"getConfigError": "Terjadi kesalahan saat mengambil file konfigurasi",
"backupPostgresNote": "Panel ini berjalan di PostgreSQL. «Cadangkan» mengunduh arsip pg_dump (.dump) dan «Pulihkan» memuatnya kembali dengan pg_restore. «Pulihkan» juga menerima basis data SQLite (.db) atau dump migrasi SQLite dan mengimpor datanya ke PostgreSQL. Server memerlukan alat klien PostgreSQL (pg_dump dan pg_restore) terpasang.",
"exportDatabasePgDesc": "Klik untuk mengunduh dump PostgreSQL (.dump) dari basis data Anda saat ini ke perangkat Anda.",
"importDatabasePgDesc": "Klik untuk memilih dan mengunggah cadangan PostgreSQL (.dump), basis data SQLite (.db), atau dump migrasi SQLite guna memulihkan basis data Anda. Ini menggantikan semua data saat ini.",
"migrationDownload": "Unduh migrasi",
"migrationDownloadPgDesc": "Klik untuk mengunduh basis data SQLite .db yang dibuat dari data PostgreSQL Anda, siap menjalankan panel ini di SQLite.",
"avg": "rerata",
"peak": "puncak",
"free": "tersisa",
"openSockets": "soket terbuka",
"throughputSub": "Total antarmuka",
"avgWindow": "Rerata periode",
"healthWarm": "{list} — mulai tinggi",
"healthCritical": "{list} — kritis",
"panel": "Panel",
"threads": "Thread",
"uptime": "Waktu aktif",
"logLevelDebug": "Debug",
"logLevelInfo": "Info",
"logLevelNotice": "Notice",
"logLevelWarning": "Warning",
"logLevelError": "Error",
"accessDirect": "DIRECT",
"accessBlocked": "BLOCKED",
"accessProxy": "PROXY",
"importKeepHostSettings": "Pertahankan pengaturan mesin ini",
"importKeepHostSettingsDesc": "Mempertahankan alamat dengar, port, path dasar, sertifikat, dan identitas node panel ini alih-alih mengambilnya dari berkas yang diunggah."
},
"inbounds": {
"totalDownUp": "Total Terkirim/Diterima",
"totalUsage": "Penggunaan Total",
"inboundCount": "Total Masuk",
"operate": "Menu",
"enable": "Aktifkan",
"remark": "Catatan",
"node": "Node",
"deployTo": "Terapkan ke",
"localPanel": "Panel lokal",
"fallbacks": {
"title": "Fallback",
"empty": "Belum ada fallback",
"add": "Tambah fallback",
"pickInbound": "Pilih inbound",
"matchAny": "apa pun",
"destPlaceholder": "otomatis (listen:port child)",
"needsTls": "Fallback tersedia setelah memilih TLS atau Reality di tab Keamanan (hanya VLESS/Trojan melalui RAW)."
},
"protocol": "Protokol",
"port": "Port",
"portMap": "Pemetaan port",
"traffic": "Trafik",
"speed": "Kecepatan",
"expireDate": "Durasi",
"createdAt": "Dibuat",
"updatedAt": "Diperbarui",
"resetTraffic": "Reset trafik",
"addInbound": "Tambahkan Masuk",
"generalActions": "Tindakan Umum",
"modifyInbound": "Ubah Masuk",
"deleteConfirmTitle": "Hapus inbound \"{remark}\"?",
"deleteConfirmContent": "Tindakan ini menghapus inbound beserta semua kliennya. Tidak dapat dibatalkan.",
"resetConfirmTitle": "Reset trafik \"{remark}\"?",
"resetConfirmContent": "Mengatur ulang counter unggah/unduh ke 0 untuk inbound ini.",
"selectedCount": "{count} dipilih",
"selectAll": "Pilih semua",
"bulkDeleteConfirmTitle": "Hapus {count} inbound?",
"bulkDeleteConfirmContent": "Tindakan ini menghapus inbound yang dipilih beserta semua kliennya. Tidak dapat dibatalkan.",
"cloneConfirmTitle": "Klon inbound \"{remark}\"?",
"cloneConfirmContent": "Membuat salinan dengan port baru dan daftar klien kosong.",
"delAllClients": "Hapus Semua Klien",
"delAllClientsConfirmTitle": "Hapus semua {count} klien dari \"{remark}\"?",
"delAllClientsConfirmContent": "Menghapus setiap klien dari inbound ini dan menghapus catatan trafiknya. Inbound itu sendiri dipertahankan. Tindakan ini tidak dapat dibatalkan.",
"attachClients": "Lampirkan klien ke…",
"addClientsToGroup": "Tambah klien ke grup…",
"attachClientsTitle": "Lampirkan klien dari «{remark}»",
"attachClientsDesc": "Melampirkan {count} klien yang sama (UUID/kata sandi sama dan trafik bersama) ke inbound terpilih. Tetap ada di inbound ini juga.",
"attachClientsTargets": "Inbound tujuan",
"attachClientsNoTargets": "Tidak ada inbound kompatibel lain untuk dilampirkan.",
"attachClientsResult": "Dilampirkan {attached}, dilewati {skipped}.",
"attachClientsResultMixed": "Dilampirkan {attached}, dilewati {skipped}, error {errors}.",
"attachClientsSelectLabel": "Klien untuk dilampirkan",
"attachClientsSearchPlaceholder": "Cari email atau komentar",
"attachClientsStatusDisabled": "Dinonaktifkan",
"attachClientsSelectedCount": "{selected} dari {total} dipilih",
"attachExistingClients": "Lampirkan klien yang ada…",
"attachExistingTitle": "Lampirkan klien yang ada ke «{remark}»",
"attachExistingDesc": "Melampirkan klien yang ada ({count} tersedia) ke inbound ini — UUID/kata sandi sama dan trafik bersama. Klien yang sudah ada di sini dilewati.",
"attachExistingNoClients": "Belum ada klien. Buat klien dulu, lalu lampirkan di sini.",
"attachExistingStatusAttached": "Sudah dilampirkan",
"detachClients": "Lepas klien",
"detachClientsTitle": "Lepas klien dari «{remark}»",
"detachClientsDesc": "Menghapus klien terpilih hanya dari inbound ini. Catatan klien tetap dipertahankan (gunakan Delete untuk menghapus sepenuhnya). Sumber memiliki total {count} klien.",
"detachClientsResult": "Dilepas {detached}, dilewati {skipped}.",
"detachClientsResultMixed": "Dilepas {detached}, dilewati {skipped}, error {errors}.",
"detachClientsSelectLabel": "Klien untuk dilepas",
"exportLinksTitle": "Ekspor tautan inbound",
"exportSubsTitle": "Ekspor tautan langganan",
"exportAllLinksTitle": "Ekspor semua tautan inbound",
"exportAllSubsTitle": "Ekspor semua tautan langganan",
"exportAllLinksFileName": "Semua-Inbound",
"exportAllSubsFileName": "Semua-Inbound-Subs",
"inboundJsonTitle": "JSON inbound",
"resetTrafficContent": "Apakah Anda yakin ingin mereset traffic?",
"copyLink": "Salin URL",
"address": "Alamat",
"network": "Jaringan",
"destinationPort": "Port Tujuan",
"targetAddress": "Alamat Target",
"monitorDesc": "Biarkan kosong untuk mendengarkan semua IP",
"meansNoLimit": "= Tanpa batas. (satuan: GB)",
"totalFlow": "Total Aliran",
"leaveBlankToNeverExpire": "Biarkan kosong untuk tidak pernah kedaluwarsa",
"certificatePath": "Path Berkas",
"certificateContent": "Konten Berkas",
"publicKey": "Kunci Publik",
"privatekey": "Kunci Pribadi",
"client": "Klien",
"export": "Ekspor Semua URL",
"clone": "Duplikat",
"resetAllTraffic": "Reset Semua Traffic Masuk",
"resetAllTrafficTitle": "Reset Semua Traffic Masuk",
"resetAllTrafficContent": "Apakah Anda yakin ingin mereset traffic semua masuk?",
"email": "Email",
"IPLimit": "Batas IP",
"IPLimitlog": "Log IP",
"IPLimitlogclear": "Hapus Log",
"setDefaultCert": "Atur Sertifikat dari Panel",
"setDefaultCertEmpty": "Tidak ada sertifikat yang dikonfigurasi untuk panel. Atur dulu di Pengaturan.",
"streamTab": "Aliran",
"securityTab": "Keamanan",
"sniffingTab": "Sniffing",
"sniffingMetadataOnly": "Hanya metadata",
"sniffingRouteOnly": "Hanya routing",
"sniffingIpsExcluded": "IP yang dikecualikan",
"sniffingDomainsExcluded": "Domain yang dikecualikan",
"decryption": "Dekripsi",
"encryption": "Enkripsi",
"vlessAuthX25519": "X25519 (native)",
"vlessAuthMlkem768": "ML-KEM-768 (native)",
"vlessAuthX25519Xorpub": "X25519 (xorpub)",
"vlessAuthX25519Random": "X25519 (random)",
"vlessAuthMlkem768Xorpub": "ML-KEM-768 (xorpub)",
"vlessAuthMlkem768Random": "ML-KEM-768 (random)",
"vlessAuthCustom": "Khusus",
"vlessAuthSelected": "Dipilih: {auth}",
"vlessAuthGenerate": "Buat kunci",
"vlessAuthGenerateButton": "Buat",
"advanced": {
"title": "Bagian JSON inbound",
"subtitle": "JSON inbound lengkap dan editor fokus untuk settings, sniffing, dan streamSettings.",
"all": "Semua",
"allHelp": "Objek inbound lengkap dengan semua bidang dalam satu editor.",
"settings": "Pengaturan",
"settingsHelp": "Pembungkus blok settings Xray:",
"sniffing": "Sniffing",
"sniffingHelp": "Pembungkus blok sniffing Xray:",
"stream": "Stream",
"streamHelp": "Pembungkus blok stream Xray:"
},
"subSortIndex": "Urutan sub",
"inboundInfo": "Informasi Inbound",
"exportInbound": "Ekspor Masuk",
"import": "Impor",
"importInbound": "Impor Masuk",
"periodicTrafficResetTitle": "Reset Trafik Berkala",
"periodicTrafficResetDay": "Hari reset bulanan",
"periodicTrafficReset": {
"never": "Tidak Pernah",
"daily": "Harian",
"weekly": "Mingguan",
"monthly": "Bulanan",
"hourly": "Setiap jam"
},
"toasts": {
"obtain": "Dapatkan",
"updateSuccess": "Pembaruan berhasil",
"logCleanSuccess": "Log telah dibersihkan",
"inboundUpdateSuccess": "Inbound berhasil diperbarui",
"inboundCreateSuccess": "Inbound berhasil dibuat",
"bulkDeleted": "{count} inbound dihapus",
"bulkDeletedMixed": "{ok} dihapus, {failed} gagal",
"clonedMany": "{count} inbound digandakan",
"clonedMixed": "{ok} digandakan, {failed} gagal",
"inboundDeleteSuccess": "Inbound berhasil dihapus",
"inboundClientAddSuccess": "Klien inbound telah ditambahkan",
"inboundClientDeleteSuccess": "Klien inbound telah dihapus",
"inboundClientUpdateSuccess": "Klien inbound telah diperbarui",
"savedNodeOfflineWillSync": "Disimpan secara lokal. Node pendukung sedang offline atau dinonaktifkan — perubahan akan disinkronkan setelah terhubung kembali.",
"resetAllClientTrafficSuccess": "Semua lalu lintas klien telah direset",
"resetAllTrafficSuccess": "Semua lalu lintas telah direset",
"resetInboundClientTrafficSuccess": "Lalu lintas telah direset",
"resetInboundTrafficSuccess": "Lalu lintas masuk telah direset",
"trafficGetError": "Gagal mendapatkan data lalu lintas",
"getNewX25519CertError": "Terjadi kesalahan saat mendapatkan sertifikat X25519.",
"getNewmldsa65Error": "Terjadi kesalahan saat mendapatkan sertifikat mldsa65.",
"getNewVlessEncError": "Terjadi kesalahan saat mendapatkan sertifikat VlessEnc.",
"scanRealityTargetError": "Gagal memindai target REALITY.",
"scanRealityTargetFeasible": "Target layak — target dan SNI terisi.",
"scanRealityTargetNotFeasible": "Target dapat dijangkau tetapi tidak layak untuk REALITY.",
"scanRealityTargetPrivate": "Target dapat dijangkau, tetapi berada di jaringan privat/lokal.",
"invalidClientField": "Klien {client}: kolom {field} — {reason}",
"invalidField": "{field} — {reason}",
"moreIssues": "{message} (+{count} lainnya)"
},
"form": {
"moveUp": "Naik",
"moveDown": "Turun",
"addAll": "Tambah semua",
"addAllFallbackTooltip": "Tambahkan baris fallback untuk setiap inbound yang memenuhi syarat dan belum terhubung",
"peers": "Peers",
"addPeer": "Tambah peer",
"keepAlive": "Keep-alive",
"autoSystemRoutesTooltip": "Hanya Windows. CIDR ditambahkan otomatis ke tabel routing sistem agar trafik yang cocok melewati TUN.",
"autoOutboundsInterface": "Interface outbound otomatis",
"autoOutboundsInterfaceTooltip": "Interface fisik untuk trafik outbound. Gunakan 'auto' untuk deteksi; otomatis aktif saat Auto system routes diatur.",
"rewriteAddress": "Tulis ulang alamat",
"rewritePort": "Tulis ulang port",
"allowedNetwork": "Jaringan yang diizinkan",
"followRedirect": "Ikuti redirect",
"accounts": "Akun",
"allowTransparent": "Izinkan transparan",
"encryptionMethod": "Metode enkripsi",
"fakeTlsDomain": "Domain FakeTLS (SNI)",
"mtprotoSecret": "Secret",
"mtgDomainFrontingIp": "IP domain fronting",
"mtgDomainFrontingPort": "Port domain fronting",
"mtgDomainFrontingProxyProtocol": "Protokol PROXY domain fronting",
"mtgDomainFrontingHint": "Tujuan mtg mengirim lalu lintas non-Telegram — mis. situs palsu NGINX Anda. Kosongkan IP untuk memakai domain FakeTLS melalui DNS; port bawaan adalah 443.",
"mtgProxyProtocolListener": "Terima protokol PROXY (listener)",
"mtgPreferIp": "Preferensi IP",
"mtgDebug": "Log debug",
"mtgRouteThroughXray": "Rutekan melalui Xray",
"mtgRouteThroughXrayHint": "Kirim lalu lintas Telegram proxy ini melalui Xray agar mengikuti aturan routing Anda. Sidecar mtg keluar lewat bridge SOCKS loopback yang diberi tag sama dengan inbound ini; rujuk tag tersebut di tab Routing untuk aturan lanjutan.",
"mtgRouteOutbound": "Outbound",
"mtgRouteOutboundHint": "Opsional. Paksa lalu lintas Telegram keluar melalui outbound (atau balancer) ini. Biarkan kosong agar aturan routing yang menentukan.",
"mtgRouteOutboundPlaceholder": "Gunakan aturan routing",
"mtprotoFakeTlsDomainHint": "Domain FakeTLS default untuk membuat secret klien baru. Setiap klien bisa memakai domainnya sendiri.",
"mtgThrottleMaxConnections": "Koneksi maksimum",
"mtgThrottleMaxConnectionsHint": "Batasi koneksi bersamaan semua pengguna dengan pembagian adil. 0 menonaktifkan.",
"mtgAdTagInvalid": "Ad-tag harus tepat 32 karakter heksadesimal.",
"mtgPublicIpv4": "IPv4 Publik",
"mtgPublicIpv6": "IPv6 Publik",
"mtgPublicIpHint": "Alamat publik server ini yang dapat dijangkau, digunakan oleh proxy perantara ad-tag. Biarkan kosong agar mtg mendeteksinya secara otomatis.",
"visionTestseed": "Vision testseed",
"version": "Versi",
"udpIdleTimeout": "UDP idle timeout (d)",
"masquerade": "Masquerade",
"type": "Tipe",
"upstreamUrl": "URL Upstream",
"rewriteHost": "Tulis ulang Host",
"skipTlsVerify": "Lewati verifikasi TLS",
"directory": "Direktori",
"statusCode": "Kode status",
"body": "Body",
"headers": "Header",
"proxyProtocol": "Proxy Protocol",
"requestVersion": "Versi permintaan",
"requestMethod": "Metode permintaan",
"requestPath": "Path permintaan",
"requestHeaders": "Header permintaan",
"responseVersion": "Versi respons",
"responseStatus": "Status respons",
"responseReason": "Alasan respons",
"responseHeaders": "Header respons",
"heartbeatPeriod": "Periode heartbeat",
"serviceName": "Nama layanan",
"authority": "Authority",
"multiMode": "Multi Mode",
"maxBufferedUpload": "Maks. upload ter-buffer",
"maxUploadSize": "Ukuran upload maks. (Byte)",
"streamUpServer": "Stream-Up Server",
"serverMaxHeaderBytes": "Maks. byte header server",
"paddingBytes": "Byte Padding",
"uplinkHttpMethod": "Metode HTTP Uplink",
"paddingObfsMode": "Mode obfs Padding",
"paddingKey": "Padding Key",
"paddingHeader": "Padding Header",
"paddingPlacement": "Posisi Padding",
"paddingMethod": "Metode Padding",
"sessionPlacement": "Session Placement",
"sessionKey": "Session Key",
"sessionIDTable": "Tabel Session ID",
"sessionIDTableHint": "Kumpulan karakter untuk membuat session ID: nama yang telah ditentukan (ALPHABET, Base62, hex, number, …) atau string ASCII literal. Kosongkan untuk default xray-core.",
"sessionIDLength": "Panjang Session ID",
"sessionIDLengthHint": "Panjang atau rentang (mis. 8-16) session ID yang dibuat. Hanya digunakan saat Tabel Session ID disetel; nilai minimum harus lebih besar dari 0.",
"sequencePlacement": "Sequence Placement",
"sequenceKey": "Sequence Key",
"uplinkDataPlacement": "Uplink Data Placement",
"uplinkDataKey": "Uplink Data Key",
"noSseHeader": "Tanpa header SSE",
"ttiMs": "TTI (ms)",
"uplinkMbps": "Uplink (MB/s)",
"downlinkMbps": "Downlink (MB/s)",
"cwndMultiplier": "Pengganda CWND",
"maxSendingWindow": "Maks. jendela pengiriman",
"externalProxy": "Proxy eksternal",
"forceTls": "Paksa TLS",
"fingerprint": "Fingerprint",
"defaultOption": "Default",
"routeMark": "Route Mark",
"tcpKeepAliveInterval": "TCP Keep Alive Interval",
"tcpKeepAliveIdle": "TCP Keep Alive Idle",
"tcpMaxSeg": "TCP Max Seg",
"tcpUserTimeout": "TCP User Timeout",
"tcpWindowClamp": "TCP Window Clamp",
"tcpWindowClampHint": "Biarkan 0 untuk memakai bawaan OS. Nilai bukan nol membatasi jendela penerimaan TCP yang diiklankan; nilai seperti 600 (dari contoh dokumentasi Xray) bisa menjatuhkan throughput pada tautan berlatensi tinggi.",
"tcpFastOpen": "TCP Fast Open",
"multipathTcp": "Multipath TCP",
"penetrate": "Penetrate",
"v6Only": "Hanya V6",
"tcpCongestion": "TCP Congestion",
"dialerProxy": "Dialer Proxy",
"trustedXForwardedFor": "X-Forwarded-For tepercaya",
"trustedXForwardedForHint": "Percayai header permintaan ini untuk IP klien asli (mis. CF-Connecting-IP di belakang CDN Cloudflare). Hanya berlaku pada transport WebSocket, HTTPUpgrade, XHTTP, dan gRPC. Kosongkan untuk mengabaikan header yang diteruskan.",
"proxyProtocolHint": "Terima header PROXY protocol untuk mengetahui IP klien asli dari tunnel/relay L4 di hulu (HAProxy, gost, nginx-stream, Xray dokodemo-door) atau Cloudflare Spectrum. Hulu HARUS mengirim PROXY protocol. Berfungsi pada TCP, WebSocket, HTTPUpgrade, dan gRPC; tidak pada mKCP.",
"realClientIp": "IP klien asli",
"realClientIpHint": "Tangkap IP asli pengunjung saat lalu lintas mencapai inbound ini melalui CDN atau relay, alih-alih mencatat alamat perantara. Pilih preset untuk mengisi kolom sockopt terkait di bawah. Kolom ini tidak pernah dikirim ke klien dalam langganan.",
"realClientIpPresetOff": "Mati / langsung",
"realClientIpPresetCloudflare": "Cloudflare CDN",
"realClientIpPresetProxyProtocol": "Relay L4 / Spectrum (PROXY)",
"realClientIpTrustedHeaderTransportWarn": "Trusted X-Forwarded-For hanya berlaku pada WebSocket, HTTPUpgrade, dan XHTTP. Pada transport saat ini header ini diabaikan.",
"realClientIpProxyProtocolTransportWarn": "PROXY protocol tidak didukung pada transport ini (mKCP). Gunakan TCP/RAW, WebSocket, HTTPUpgrade, gRPC, atau XHTTP.",
"addressPortStrategy": "Strategi alamat+port",
"tryDelayMs": "Penundaan percobaan (ms)",
"prioritizeIPv6": "Prioritaskan IPv6",
"interleave": "Interleave",
"maxConcurrentTry": "Maks. percobaan bersamaan",
"customSockopt": "Sockopt kustom",
"addCustomOption": "Tambah opsi kustom",
"serverNameIndication": "SNI",
"cipherSuites": "Cipher Suites",
"autoOption": "Otomatis",
"minMaxVersion": "Versi Min/Maks",
"rejectUnknownSni": "Tolak SNI tidak dikenal",
"disableSystemRoot": "Nonaktifkan System Root",
"sessionResumption": "Lanjutkan sesi",
"oneTimeLoading": "Pemuatan sekali",
"usageOption": "Opsi penggunaan",
"buildChain": "Bangun rantai",
"echKey": "ECH key",
"echConfig": "Konfig ECH",
"pinnedPeerCertSha256": "SHA-256 Sertifikat Peer Tersemat",
"pinnedPeerCertSha256Tip": "Hash SHA-256 dari sertifikat peer sebagai string heksadesimal (mis. e8e2d3…), dipisah koma. Hanya panel — tidak ditulis ke konfig xray server, tetapi disertakan dalam link berbagi agar klien dapat menyematkan sertifikat.",
"pinnedPeerCertSha256Placeholder": "hash heksadesimal, dipisah koma",
"getNewEchCert": "Dapatkan sertifikat ECH baru",
"show": "Tampilkan",
"xver": "Xver",
"target": "Target",
"maxTimeDiff": "Maks. selisih waktu (ms)",
"minClientVer": "Min. versi klien",
"maxClientVer": "Maks. versi klien",
"minClientVerHint": "Kosong bukan berarti tanpa batas: Xray-core akan memakai minimum bawaan dari build core yang dijalankan (26.3.27 pada rilis saat ini) dan menolak klien yang melaporkan versi lebih lama — termasuk core pihak ketiga seperti Mihomo dan sing-box. Isi 1.0.0 untuk menerimanya, dengan risiko mengizinkan sidik jari TLS yang usang.",
"maxClientVerHint": "Kosong berarti tanpa batas atas. Jika diisi, tidak boleh lebih rendah dari minimum efektif — versi klien minimum, atau minimum bawaan Xray-core saat kolom itu kosong — atau semua klien akan ditolak.",
"clientVerInvalid": "Versi klien harus berupa maksimal tiga angka dipisah titik, masing-masing 0-255 (mis. 26.3.27)",
"maxClientVerBelowMin": "Versi klien maksimum tidak boleh lebih rendah dari versi klien minimum",
"shortIds": "Short IDs",
"realityTargetHint": "Wajib. Harus menyertakan port (mis. example.com:443). Tanpa port, Xray-core menolak untuk mulai.",
"realityTargetRequired": "Target REALITY wajib diisi",
"realityTargetNeedsPort": "Target REALITY harus menyertakan port (mis. example.com:443)",
"realityTargetInvalidPort": "Target REALITY memiliki port yang tidak valid",
"scan": "Pindai",
"findTargets": "Cari Target",
"scanModalTitle": "Pemindai Target REALITY",
"scanModalDesc": "Validasi domain, atau pindai rentang IP / CIDR untuk menemukan target REALITY baru dari sertifikatnya. Biarkan kosong untuk memeriksa kandidat umum.",
"scanDiscoverPlaceholder": "IP, CIDR, atau domain — kosongkan untuk kandidat umum",
"scanStatus": "Status",
"scanFeasible": "Layak",
"scanNotFeasible": "Tidak layak",
"scanCurve": "Pertukaran Kunci",
"scanCert": "Sertifikat",
"scanCertInvalid": "Tidak tepercaya",
"scanCertExpiry": "Sertifikat kedaluwarsa",
"scanSniUsed": "SNI yang dipakai",
"scanPrivateNote": "Diperiksa melalui jaringan privat/lokal — alamat ini tidak dapat dijangkau dari internet.",
"scanPrivateConfirmTitle": "Target di jaringan lokal",
"scanPrivateConfirmContent": "\"{target}\" mengarah ke alamat privat atau loopback. Pemeriksaan akan melewati pelindung SSRF panel hanya untuk uji ini. Lanjutkan?",
"scanLatency": "Latensi",
"scanUse": "Gunakan",
"scanRescan": "Pindai ulang",
"spiderX": "SpiderX",
"spiderXHint": "Seed per-klien — panel menurunkan jalur spx unik untuk tiap klien darinya; regenerasi untuk merotasi jalur semua klien",
"getNewCert": "Dapatkan sertifikat baru",
"mldsa65Seed": "mldsa65 Seed",
"mldsa65Verify": "mldsa65 Verify",
"getNewSeed": "Dapatkan Seed baru",
"listenHelp": "Anda juga dapat memasukkan path Unix socket (mis. /run/xray/in.sock), atau nama abstract socket dengan awalan @ (mis. @xray/in.sock), untuk listen pada socket alih-alih port TCP — dalam hal ini setel Port ke 0.",
"shareAddrStrategy": "Strategi alamat berbagi",
"shareAddrStrategyHelp": "Menentukan alamat yang ditulis ke tautan berbagi yang diekspor, kode QR, dan keluaran langganan.",
"shareAddr": "Alamat berbagi kustom",
"shareAddrHelp": "Hanya digunakan saat strategi alamat berbagi adalah Kustom. Masukkan host atau IP tanpa skema atau port.",
"subSortIndex": "Urutan dalam langganan",
"subSortIndexHelp": "Posisi tautan inbound ini dalam keluaran langganan (halaman langganan dan aplikasi klien). Nilai lebih kecil tampil lebih dulu; nilai sama mempertahankan urutan pembuatan. Tidak memengaruhi daftar inbound di panel.",
"disableFlow": "Nonaktifkan flow XTLS",
"disableFlowHelp": "Kecualikan inbound ini dari injeksi otomatis xtls-rprx-vision, meskipun transport-nya mendukung flow (mis. inbound XHTTP yang dituneling dengan enkripsi VLESS). Klien tetap memakai Vision pada inbound lain yang mendukung dalam langganan yang sama. Hanya VLESS.",
"shareAddrStrategyOptions": {
"node": "Alamat node",
"listen": "Alamat listen inbound",
"custom": "Kustom"
},
"echSockopt": "ECH Sockopt",
"echSockoptTip": "Opsi socket untuk koneksi yang dipakai Xray guna mengambil daftar konfig ECH (mis. mengarahkan pencarian melalui outbound dialerProxy). Biarkan nonaktif untuk memakai bawaan.",
"curvePreferences": "Preferensi kurva",
"curvePreferencesTip": "Batasi kurva pertukaran kunci TLS yang ditawarkan server, sesuai urutan preferensi (mis. X25519MLKEM768, X25519). Biarkan kosong untuk memakai bawaan Xray-core.",
"masterKeyLog": "Log master key",
"masterKeyLogTip": "Path untuk menulis master key TLS (format SSLKEYLOGFILE) untuk debug dengan Wireshark. Biarkan kosong di produksi — ini memungkinkan siapa pun yang memiliki file tersebut mendekripsi lalu lintas.",
"verifyPeerCertByName": "Verifikasi sertifikat peer berdasarkan nama",
"verifyPeerCertByNameTip": "Minta klien memverifikasi sertifikat server terhadap nama ini, bukan SNI. Nama dipisahkan koma. Hanya panel — disertakan dalam tautan berbagi (vcn). Pengganti modern untuk allowInsecure, yang dihapus Xray setelah 2026-06-01.",
"pinFromCert": "Isi dari sertifikat inbound ini",
"pinFromRemote": "Ambil hash dengan melakukan ping ke SNI (xray tls ping)",
"pinFromRemoteNoSni": "Atur SNI (serverName) terlebih dahulu untuk melakukan ping ke sertifikat jarak jauh.",
"pinFromRemoteFailed": "Tidak dapat mengambil hash sertifikat jarak jauh.",
"limitFallback": "Batasi fallback",
"limitFallbackUpload": "Batasi unggah fallback",
"limitFallbackDownload": "Batasi unduh fallback",
"afterBytes": "Setelah byte",
"afterBytesTip": "Biarkan fallback berjalan pada kecepatan penuh untuk sejumlah byte ini, lalu mulai membatasi. 0 = batasi sejak byte pertama.",
"bytesPerSec": "Byte per detik",
"bytesPerSecTip": "Batas kecepatan (byte/detik) yang diterapkan pada lalu lintas fallback setelah ambang batas, agar probe tidak dapat memakai server Anda sebagai bandwidth gratis menuju target. 0 = tanpa batas (menonaktifkan arah ini).",
"burstBytesPerSec": "Byte per detik burst",
"burstBytesPerSecTip": "Kelonggaran untuk burst singkat di atas laju tetap (ukuran token-bucket). Jika lebih kecil dari Byte per detik, nilainya dinaikkan agar sama."
},
"info": {
"mode": "Mode",
"grpcServiceName": "grpc serviceName",
"grpcMultiMode": "grpc multiMode",
"interfaceName": "Nama interface",
"mtu": "MTU",
"gateway": "Gateway",
"dns": "DNS",
"outboundsInterface": "Interface outbound",
"autoSystemRoutes": "Rute sistem otomatis",
"followRedirect": "FollowRedirect",
"auth": "Auth",
"noKernelTun": "TUN tanpa kernel",
"keepAlive": "Keep alive",
"peerNumber": "Peer {n}",
"peerNumberConfig": "Konfig Peer {n}"
},
"sniffingDestOverride": "Penggantian tujuan"
},
"clients": {
"tabBasics": "Dasar",
"tabCredentials": "Kredensial",
"tabLinks": "Tautan",
"wireguardConfig": "Konfigurasi WireGuard",
"config": "Konfigurasi",
"linksHint": "Tambahkan tautan berbagi pihak ketiga dan URL langganan jarak jauh untuk disertakan dalam langganan klien ini.",
"addExternalLink": "Tambah Tautan Eksternal",
"addExternalSubscription": "Tambah Langganan Eksternal",
"noExternalLinks": "Belum ada tautan eksternal.",
"noExternalSubscriptions": "Belum ada langganan eksternal.",
"namePrefix": "Awalan nama",
"lastFetchAt": "Pengambilan terakhir",
"lastFetchError": "Galat pengambilan",
"neverFetched": "Belum diambil",
"submitEdit": "Simpan perubahan",
"clientCount": "Jumlah klien",
"bulk": "Tambah massal",
"selectAll": "Pilih semua",
"clearAll": "Hapus semua",
"method": "Metode",
"first": "Pertama",
"last": "Terakhir",
"ipLog": "Log IP",
"prefix": "Awalan",
"postfix": "Akhiran",
"delayedStart": "Mulai setelah penggunaan pertama",
"expireDays": "Durasi (hari)",
"renew": "Perpanjangan otomatis",
"renewDesc": "Perpanjangan otomatis setelah kedaluwarsa. (0 = nonaktif) (satuan: hari)",
"renewDays": "Perpanjangan otomatis (hari)",
"searchPlaceholder": "Cari email, komentar, sub ID, UUID, kata sandi, auth, Telegram ID…",
"filterTitle": "Filter klien",
"clearAllFilters": "Hapus semua",
"filters": {
"nodes": "Node",
"localPanel": "Lokal (panel ini)"
},
"showingCount": "Menampilkan {shown} dari {total}",
"sortOldest": "Terlama dulu",
"sortNewest": "Terbaru dulu",
"sortRecentlyUpdated": "Baru saja diperbarui",
"sortRecentlyOnline": "Baru saja online",
"sortEmailAZ": "Email A→Z",
"sortEmailZA": "Email Z→A",
"sortMostTraffic": "Trafik terbanyak",
"sortHighestRemaining": "Tersisa terbanyak",
"sortExpiringSoonest": "Segera kedaluwarsa",
"has": "Memiliki",
"hasNot": "Tidak memiliki",
"actions": "Aksi",
"totalGB": "Batas Trafik (GB)",
"totalGBDesc": "Kuota data untuk klien ini. 0 = tidak terbatas.",
"expiryTime": "Kedaluwarsa",
"addClients": "Tambah klien",
"limitIp": "Batas IP",
"limitIpDesc": "Jumlah maksimum IP bersamaan. 0 = tidak terbatas.",
"limitHwid": "Batas HWID",
"limitHwidDesc": "Jumlah maksimum perangkat terdaftar untuk permintaan langganan. 0 = tidak terbatas.",
"hwidLog": "Perangkat HWID",
"hwidDevice": "Perangkat terdaftar",
"noHwids": "Belum ada perangkat HWID",
"firstSeen": "Pertama terlihat",
"lastSeen": "Terakhir terlihat",
"deleteHwid": "Hapus perangkat",
"deleteHwidConfirm": "Hapus perangkat ini? Perangkat perlu mendaftar ulang pada pengambilan langganan berikutnya.",
"hwidDeleted": "Perangkat dihapus.",
"clearHwidsConfirm": "Hapus semua perangkat terdaftar? Setiap perangkat perlu mendaftar ulang pada pengambilan langganan berikutnya.",
"limitIpFail2banMissing": "Fail2ban tidak terpasang, sehingga batas IP tidak dapat diterapkan. Pasang Fail2ban dari menu bash x-ui untuk mengaktifkan opsi ini.",
"limitIpFail2banWindows": "Fail2ban tidak tersedia di Windows, sehingga batas IP tidak dapat diterapkan.",
"limitIpDisabled": "Fitur batas IP dinonaktifkan di server ini.",
"password": "Kata sandi",
"passwordDesc": "Hanya digunakan oleh klien Trojan dan Shadowsocks; diabaikan untuk VLESS, VMess, Hysteria, dan WireGuard.",
"subId": "ID Langganan",
"online": "Online",
"email": "Email",
"emailInvalidChars": "Email tidak boleh mengandung spasi, '/', '\\', atau karakter kontrol",
"subIdInvalidChars": "ID langganan tidak boleh mengandung spasi, '/', '\\', atau karakter kontrol",
"group": "Grup",
"groupDesc": "Label logis untuk mengelompokkan klien terkait (mis. tim, pelanggan, wilayah). Dapat difilter dari toolbar.",
"groupPlaceholder": "mis. customer-a",
"comment": "Komentar",
"traffic": "Lalu lintas",
"speed": "Kecepatan",
"offline": "Offline",
"addClient": "Tambah klien",
"qrCode": "Kode QR",
"clientInfo": "Informasi Klien",
"editClient": "Ubah klien",
"client": "Klien",
"enabled": "Aktif",
"remaining": "Sisa",
"duration": "Durasi",
"attachedInbounds": "Inbound terlampir",
"selectInbound": "Pilih satu atau lebih inbound",
"selectAllInbounds": "Pilih semua",
"clearAllInbounds": "Hapus semua",
"noSubId": "Klien ini tidak punya subId, tidak ada tautan yang bisa dibagikan.",
"noLinks": "Tidak ada tautan yang bisa dibagikan — lampirkan klien ini ke inbound yang mendukung protokol terlebih dahulu.",
"link": "Tautan",
"resetNotPossible": "Lampirkan klien ini ke inbound terlebih dahulu.",
"resetAllTraffics": "Reset lalu lintas semua klien",
"resetAllTrafficsTitle": "Reset lalu lintas semua klien?",
"resetAllTrafficsContent": "Penghitung kirim/terima setiap klien turun ke nol. Kuota dan kedaluwarsa tidak terpengaruh. Tidak dapat dibatalkan.",
"deleteConfirmTitle": "Hapus klien {email}?",
"deleteConfirmContent": "Tindakan ini menghapus klien dari setiap inbound terlampir dan menghapus catatan lalu lintasnya. Tidak dapat dibatalkan.",
"adjustSelected": "Sesuaikan ({count})",
"subLinksSelected": "Tautan sub ({count})",
"addToGroupTitle": "Tambahkan {count} klien ke grup",
"addToGroupTooltip": "Pilih grup yang ada atau ketik nama baru. Gunakan Ungroup untuk menghapus klien dari grup saat ini.",
"groupName": "Nama grup",
"addToGroupSuccessToast": "{count} klien ditambahkan ke {group}",
"ungroupSuccessToast": "Grup dihapus dari {count} klien",
"ungroup": "Lepaskan grup",
"ungroupConfirmTitle": "Hapus {count} klien dari grupnya?",
"ungroupConfirmContent": "Menghapus label grup dari setiap klien terpilih. Klien tetap dipertahankan (gunakan Delete untuk menghapus sepenuhnya).",
"addToGroup": "Tambahkan ke grup",
"attach": "Lampirkan",
"adjust": "Atur",
"subLinks": "Tautan sub",
"enable": "Aktifkan",
"disable": "Nonaktifkan",
"bulkEnableConfirmTitle": "Aktifkan {count} klien?",
"bulkEnableConfirmContent": "Mengaktifkan setiap klien yang dipilih di semua inbound yang terlampir. Klien yang kuotanya habis atau masa berlakunya telah lewat akan dinonaktifkan kembali secara otomatis.",
"bulkDisableConfirmTitle": "Nonaktifkan {count} klien?",
"bulkDisableConfirmContent": "Menonaktifkan setiap klien yang dipilih di semua inbound yang terlampir. Mereka langsung kehilangan akses, tetapi catatan dan trafiknya tetap disimpan.",
"selectedCount": "{count} dipilih",
"attachToInboundsTitle": "Lampirkan {count} klien ke inbound",
"attachToInboundsDesc": "Melampirkan {count} klien terpilih (UUID/kata sandi sama dan trafik bersama) ke inbound terpilih. Lampiran yang ada tetap dipertahankan.",
"attachToInboundsTargets": "Inbound tujuan",
"attachToInboundsNoTargets": "Tidak ada inbound multi-pengguna untuk dilampirkan.",
"detach": "Lepas",
"detachFromInboundsTitle": "Lepas {count} klien dari inbound",
"detachFromInboundsDesc": "Menghapus {count} klien terpilih dari inbound terpilih. Pasangan di mana klien tidak terlampir akan dilewati secara diam-diam. Catatan klien dipertahankan (gunakan Delete untuk menghapus sepenuhnya).",
"detachFromInboundsTargets": "Inbound untuk dilepas",
"detachFromInboundsNoTargets": "Tidak ada inbound multi-pengguna.",
"detachFromInboundsResult": "Dilepas {detached}, dilewati {skipped}.",
"detachFromInboundsResultMixed": "Dilepas {detached}, dilewati {skipped}, error {errors}.",
"subLinksTitle": "Tautan sub ({count})",
"subLinkColumn": "URL Langganan",
"subJsonLinkColumn": "URL JSON Langganan",
"subLinksCopyAll": "Salin semua",
"subLinksCopiedAll": "{count} tautan disalin",
"subLinksEmpty": "Tidak ada klien terpilih yang memiliki ID langganan.",
"subLinksDisabled": "Layanan langganan dinonaktifkan.",
"subLinksDisabledHint": "Aktifkan langganan di Pengaturan Panel → Langganan untuk membuat tautan.",
"bulkDeleteConfirmTitle": "Hapus {count} klien?",
"bulkDeleteConfirmContent": "Setiap klien yang dipilih dihapus dari semua inbound terlampir dan catatan lalu lintasnya dihapus. Tidak dapat dibatalkan.",
"bulkAdjustTitle": "Sesuaikan {count} klien",
"bulkAdjustHint": "Nilai positif menambah, negatif mengurangi. Klien dengan masa berlaku atau trafik tak terbatas dilewati untuk bidang tersebut.",
"bulkAdjustNothing": "Setel hari atau trafik sebelum menerapkan.",
"addDays": "Tambah hari",
"addTrafficGB": "Tambah trafik (GB)",
"bulkFlow": "Atur flow",
"bulkFlowNoChange": "Tanpa perubahan",
"bulkFlowDisable": "Nonaktifkan (hapus flow)",
"delDepleted": "Hapus yang habis",
"delDepletedConfirmTitle": "Hapus klien yang habis?",
"delDepletedConfirmContent": "Hapus setiap klien yang kuota lalu lintasnya habis atau yang masa berlakunya telah berakhir. Tidak dapat dibatalkan.",
"exportClients": "Ekspor klien",
"importClients": "Impor klien",
"import": "Impor",
"delOrphans": "Hapus klien tanpa inbound",
"delOrphansConfirmTitle": "Hapus klien tanpa inbound?",
"delOrphansConfirmContent": "Menghapus setiap klien yang tidak terhubung ke inbound mana pun, beserta catatan lalu lintasnya. Tidak dapat dibatalkan.",
"auth": "Auth",
"hysteriaAuth": "Hysteria Auth",
"hysteriaAuthDesc": "Kredensial yang hanya digunakan oleh klien Hysteria. Trojan dan Shadowsocks menggunakan kolom \"Kata sandi\" sebagai gantinya.",
"uuid": "UUID",
"flow": "Flow",
"vmessSecurity": "Keamanan VMess",
"wireguardPrivateKey": "Kunci Privat WireGuard",
"wireguardPublicKey": "Kunci Publik WireGuard",
"wireguardPreSharedKey": "Kunci Pra-Berbagi WireGuard",
"wireguardAllowedIPs": "IP yang Diizinkan WireGuard",
"wireguardAllowedIPsHint": "Biarkan kosong untuk penetapan otomatis; pisahkan entri dengan koma",
"amneziaWgPrivateKey": "Kunci Privat AmneziaWG",
"amneziaWgPublicKey": "Kunci Publik AmneziaWG",
"amneziaWgPreSharedKey": "Kunci Pra-Berbagi AmneziaWG",
"amneziaWgAllowedIPs": "IP yang Diizinkan AmneziaWG",
"amneziaWgAllowedIPsHint": "Biarkan kosong untuk penetapan otomatis; pisahkan entri dengan koma",
"amneziaWgForwardedPorts": "Port yang Diteruskan",
"amneziaWgForwardedPortsHint": "Port/rentang yang di-DNAT ke klien ini, mis. 80, 443, 8000-8100. Biarkan kosong jika tidak ada.",
"amneziaWgConfig": "Konfigurasi AmneziaWG",
"mtprotoSecret": "Secret MTProto",
"mtprotoSecretHint": "Secret FakeTLS klien. Buat ulang untuk menggantinya.",
"mtprotoAdTag": "Ad-tag (kanal bersponsor)",
"mtprotoAdTagHint": "Tag heksadesimal 32 karakter opsional dari pendaftaran proxy Telegram. Jika diatur, klien ini dirutekan melalui proxy perantara Telegram dan kanal bersponsor muncul di bagian atas daftar obrolannya.",
"reverseTag": "Reverse tag",
"reverseTagPlaceholder": "Reverse tag opsional",
"telegramId": "ID pengguna Telegram",
"telegramIdPlaceholder": "ID numerik pengguna Telegram (0 = tidak ada)",
"ipLimit": "Batas IP",
"toasts": {
"deleted": "Klien dihapus",
"trafficReset": "Lalu lintas direset",
"allTrafficsReset": "Lalu lintas semua klien direset",
"bulkDeleted": "{count} klien dihapus",
"bulkDeletedMixed": "{ok} dihapus, {failed} gagal",
"bulkEnabled": "{count} klien diaktifkan",
"bulkEnabledMixed": "{ok} diaktifkan, {failed} gagal",
"bulkDisabled": "{count} klien dinonaktifkan",
"bulkDisabledMixed": "{ok} dinonaktifkan, {failed} gagal",
"bulkCreated": "{count} klien dibuat",
"bulkCreatedMixed": "{ok} dibuat, {failed} gagal",
"bulkAdjusted": "{count} klien disesuaikan",
"bulkAdjustedMixed": "{ok} disesuaikan, {skipped} dilewati",
"delDepleted": "{count} klien habis dihapus",
"delOrphans": "{count} klien tanpa inbound dihapus",
"imported": "{count} klien diimpor",
"importedMixed": "{ok} diimpor, {failed} dilewati"
},
"renewMax": "Maksimum perpanjangan",
"renewMaxDesc": "Berapa kali perpanjangan otomatis boleh berjalan sebelum klien dibiarkan kedaluwarsa. 0 berarti tanpa batas. Mengejar beberapa periode yang terlewat menghabiskan satu perpanjangan per periode.",
"renewOnDay": "Perpanjang pada tanggal",
"renewOnDayDesc": "Perpanjang pada tanggal ini setiap bulan kalender, pada tengah malam menurut zona waktu panel, alih-alih setiap N hari. Bulan yang terlalu pendek untuk tanggal yang dipilih diperpanjang pada hari terakhirnya. 0 mempertahankan mode interval hari.",
"renewsUsed": "Perpanjangan terpakai"
},
"groups": {
"name": "Nama",
"clientCount": "Klien",
"totalGroups": "Total grup",
"totalGroupedClients": "Klien dengan grup",
"trafficUsed": "Trafik terpakai",
"upload": "Unggah",
"download": "Unduh",
"totalTraffic": "Total trafik",
"totalUpDown": "Total unggah / unduh",
"addGroup": "Tambah grup",
"createSuccess": "Grup «{name}» dibuat.",
"rename": "Ubah nama",
"renameTitle": "Ubah nama {name}",
"renameCollision": "Grup bernama «{name}» sudah ada.",
"renameSuccess": "Grup diubah namanya pada {count} klien.",
"deleteConfirmTitle": "Hapus grup {name}?",
"deleteConfirmContent": "Ini menghapus grup dan label-nya dari {count} klien. Klien itu sendiri tidak dihapus.",
"deleteSuccess": "Grup dihapus dari {count} klien.",
"resetTraffic": "Reset trafik",
"resetConfirmTitle": "Reset trafik grup {name}?",
"resetConfirmContent": "Ini hanya mengatur ulang penghitung trafik grup. Penghitung tiap klien tidak terpengaruh.",
"resetSuccess": "Trafik grup {name} direset.",
"adjustSuccess": "{count} klien di {name} disesuaikan.",
"emptyForAction": "Grup ini belum memiliki klien.",
"deleteGroupOnly": "Hapus grup (pertahankan klien)",
"deleteClients": "Hapus klien di grup",
"deleteClientsConfirmTitle": "Hapus semua klien di {name}?",
"deleteClientsConfirmContent": "Ini akan menghapus {count} klien secara permanen beserta catatan trafiknya. Label grup juga dihapus. Tidak dapat dibatalkan.",
"deleteClientsSuccess": "{count} klien dihapus.",
"deleteClientsMixed": "{ok} dihapus, {failed} dilewati",
"addToGroup": "Tambah klien…",
"addToGroupTitle": "Tambah klien ke grup «{name}»",
"addToGroupDesc": "Pilih klien untuk ditambahkan ke grup ini. Lampiran inbound yang ada tetap dipertahankan; hanya label grup yang berubah. Klien yang sudah ada di grup ini tidak ditampilkan.",
"addToGroupEmpty": "Tidak ada klien lain untuk ditambahkan.",
"addToGroupResult": "{count} klien ditambahkan ke {name}.",
"removeFromGroup": "Hapus klien…",
"removeFromGroupTitle": "Hapus klien dari grup «{name}»",
"removeFromGroupDesc": "Pilih anggota untuk dihapus dari grup ini. Klien tetap dipertahankan (gunakan «Hapus klien di grup» untuk menghapus sepenuhnya).",
"removeFromGroupResult": "{count} klien dihapus dari {name}."
},
"nodes": {
"addNode": "Tambah Node",
"editNode": "Edit node",
"totalNodes": "Total Node",
"onlineNodes": "Online",
"offlineNodes": "Offline",
"avgLatency": "Latensi Rata-rata",
"name": "Nama",
"namePlaceholder": "mis. de-frankfurt-1",
"addressPlaceholder": "panel.example.com atau 1.2.3.4",
"remark": "Catatan",
"scheme": "Skema",
"address": "Alamat",
"port": "Port",
"basePath": "Path dasar",
"apiToken": "Token API",
"apiTokenPlaceholder": "Token dari halaman Pengaturan panel jarak jauh",
"apiTokenHint": "Panel jarak jauh menampilkan token API-nya di Otentikasi → Token API.",
"apiTokenKeepHint": "Biarkan kosong untuk mempertahankan token saat ini",
"allowPrivateAddress": "Izinkan alamat pribadi",
"allowPrivateAddressHint": "Aktifkan hanya untuk node di jaringan pribadi atau VPN.",
"outboundTag": "Outbound koneksi",
"outboundTagHint": "Rutekan lalu lintas API panel node ini melalui outbound Xray yang dipilih. Sebuah inbound jembatan loopback ditambahkan secara otomatis ke konfigurasi yang berjalan dan diterapkan secara langsung. Biarkan kosong untuk koneksi langsung.",
"outboundTagPlaceholder": "Koneksi langsung",
"inboundSyncMode": "Impor inbound",
"inboundSyncModeHint": "Pilih inbound yang diimpor dari node ini. Node yang sudah ada mengimpor semua inbound secara default.",
"allInbounds": "Semua inbound",
"selectedInbounds": "Inbound terpilih",
"inboundTags": "Inbound",
"inboundTagsHint": "Pilihan dicocokkan berdasarkan tag inbound. Pilihan kosong tidak mengimpor apa pun.",
"inboundTagsPlaceholder": "Muat dan pilih inbound",
"loadInbounds": "Muat inbound dari node",
"inboundsLoaded": "{{count}} inbound dimuat",
"inboundsLoadFailed": "Gagal memuat inbound",
"enable": "Aktif",
"status": "Status",
"cpu": "CPU",
"mem": "Memori",
"netUp": "Upload Jaringan (KB/s)",
"netDown": "Download Jaringan (KB/s)",
"uptime": "Uptime",
"latency": "Latensi",
"lastHeartbeat": "Heartbeat Terakhir",
"xrayVersion": "Versi Xray",
"panelVersion": "Versi panel",
"actions": "Aksi",
"probe": "Probe Sekarang",
"updatePanel": "Perbarui Panel",
"updateSelected": "Perbarui Terpilih ({count})",
"updateAvailable": "Pembaruan tersedia",
"updateConfirmTitle": "Perbarui {count} node ke versi terbaru?",
"updateConfirmContent": "Setiap node terpilih mengunduh rilis terbaru dan memulai ulang. Hanya node aktif dan online yang diperbarui.",
"updateDevChannel": "Perbarui ke kanal dev (commit terbaru)",
"testConnection": "Tes Koneksi",
"connectionOk": "Koneksi OK ({ms} ms)",
"connectionFailed": "Koneksi gagal",
"never": "tidak pernah",
"justNow": "baru saja",
"subNode": "Sub-node",
"subNodeTip": "Hanya-baca: node turunan yang dijangkau melalui {parent}. Kelola dari panel {parent} sendiri.",
"deleteConfirmTitle": "Hapus node \"{name}\"?",
"deleteConfirmContent": "Ini menghentikan pemantauan node. Panel jarak jauh itu sendiri tidak terpengaruh.",
"statusValues": {
"online": "Online",
"offline": "Offline",
"unknown": "Tidak diketahui",
"xrayError": "Kesalahan Xray",
"xrayStopped": "Berhenti"
},
"toasts": {
"list": "Gagal memuat node",
"obtain": "Gagal memuat node",
"add": "Tambah node",
"update": "Perbarui node",
"delete": "Hapus node",
"deleted": "Node dihapus",
"test": "Tes koneksi",
"fillRequired": "Nama, alamat, port, dan token API wajib diisi",
"probeFailed": "Probe gagal",
"updateStarted": "Pembaruan panel dimulai",
"updateResult": "Pembaruan dipicu pada {ok} node, {failed} gagal",
"updateNoneEligible": "Pilih minimal satu node online dan aktif",
"saveMtls": "Simpan mTLS node",
"reloadMtls": "Reload master mTLS credential"
},
"tlsVerifyMode": "Verifikasi TLS",
"tlsVerifyModeHint": "Cara panel memvalidasi sertifikat HTTPS node. Pin atau Lewati untuk sertifikat self-signed (hanya node https).",
"tlsVerify": "Verifikasi (CA bawaan)",
"tlsPin": "Pin sertifikat (SHA-256)",
"tlsSkip": "Lewati verifikasi",
"tlsMtls": "TLS mutual (sertifikat klien)",
"mtlsFormHint": "Node ini mengautentikasi panel dengan sertifikat klien. Salin CA panel ini dari bagian mTLS Node ke node, atur CA tepercayanya, lalu mulai ulang.",
"mtls": {
"title": "mTLS Node",
"intro": "TLS mutual menambahkan faktor sertifikat klien di atas token API untuk panggilan antar-node. Bersifat opsional: biarkan kosong untuk tetap menggunakan autentikasi token saja.",
"copyCa": "Salin CA panel ini",
"copyCaHint": "Berikan CA ini ke node yang dikelola panel ini, lalu atur verifikasi TLS mereka ke TLS mutual.",
"caCopied": "Sertifikat CA disalin ke papan klip",
"caFailed": "Gagal memperoleh sertifikat CA",
"trustLabel": "CA induk tepercaya",
"trustHint": "Jika panel ini sendiri merupakan node, tempelkan CA panel pengelola di sini untuk mewajibkan sertifikat kliennya. Mulai ulang panel untuk menerapkan.",
"trustPlaceholder": "-----BEGIN CERTIFICATE-----",
"save": "Simpan CA tepercaya",
"saved": "CA tepercaya disimpan — mulai ulang panel untuk menerapkan"
},
"tlsSkipWarning": "Melewati verifikasi menghilangkan perlindungan terhadap serangan man-in-the-middle — token API bisa disadap. Lebih baik pin sertifikat.",
"pinnedCert": "SHA-256 sertifikat yang dipin",
"pinnedCertHint": "SHA-256 sertifikat node dalam base64 atau hex. Gunakan Ambil untuk membacanya dari node sekarang.",
"pinnedCertPlaceholder": "SHA-256 base64 atau hex",
"fetchPin": "Ambil",
"pinFetched": "Berhasil mengambil sertifikat node saat ini",
"pinFetchFailed": "Tidak dapat mengambil sertifikat"
},
"settings": {
"defaultTag": "Bawaan",
"title": "Pengaturan Panel",
"save": "Simpan",
"infoDesc": "Setiap perubahan yang dibuat di sini perlu disimpan. Harap restart panel untuk menerapkan perubahan.",
"restartPanel": "Mulai ulang panel",
"restartPanelDesc": "Apakah Anda yakin ingin merestart panel? Jika Anda tidak dapat mengakses panel setelah merestart, lihat info log panel di server.",
"restartPanelSuccess": "Panel berhasil dimulai ulang",
"actions": "Tindakan",
"resetDefaultConfig": "Reset ke Default",
"panelSettings": "Umum",
"securitySettings": "Otentikasi",
"securityWarnings": "Peringatan keamanan",
"panelExposed": "Panel Anda mungkin terekspos:",
"warnHttp": "Panel disajikan melalui HTTP biasa — siapkan TLS untuk produksi.",
"warnDefaultPort": "Port default 2053 sudah umum diketahui — ubah ke port acak.",
"warnDefaultBasePath": "Base path default \"/\" sudah umum diketahui — ubah ke path acak.",
"warnDefaultSubPath": "Path langganan default \"/sub/\" sudah umum diketahui — ubahlah.",
"warnDefaultJsonPath": "Path langganan JSON default \"/json/\" sudah umum diketahui — ubahlah.",
"TGBotSettings": "Bot Telegram",
"panelListeningIP": "IP Pendengar",
"panelListeningIPDesc": "Alamat IP untuk panel web. (biarkan kosong untuk mendengarkan semua IP)",
"panelListeningDomain": "Domain Pendengar",
"panelListeningDomainDesc": "Nama domain untuk panel web. (biarkan kosong untuk mendengarkan semua domain dan IP)",
"panelPort": "Port Pendengar",
"panelPortDesc": "Nomor port untuk panel web. (harus menjadi port yang tidak digunakan)",
"publicKeyPath": "Path Kunci Publik",
"publicKeyPathDesc": "Path berkas kunci publik untuk panel web. (dimulai dengan ‘/‘)",
"privateKeyPath": "Path Kunci Privat",
"privateKeyPathDesc": "Path berkas kunci privat untuk panel web. (dimulai dengan ‘/‘)",
"panelUrlPath": "Path URI",
"panelUrlPathDesc": "URI path untuk panel web. (dimulai dengan ‘/‘ dan diakhiri dengan ‘/‘)",
"pageSize": "Ukuran Halaman",
"pageSizeDesc": "Tentukan ukuran halaman untuk tabel masuk. (0 = nonaktif)",
"panelOutbound": "Outbound lalu lintas panel",
"panelOutboundDesc": "Mengarahkan permintaan panel sendiri — pemeriksaan versi dan unduhan panel/Xray, Telegram, dan pembaruan file geo biasa — melalui outbound Xray ini untuk melewati pemfilteran GitHub/Telegram di sisi server. Inbound jembatan lokal ditambahkan secara otomatis ke konfigurasi yang berjalan dan diterapkan langsung. Pembaruan Otomatis Geodata bawaan Xray tidak terpengaruh; ia memiliki outbound unduhan sendiri. Kosongkan untuk koneksi langsung.",
"panelOutboundPh": "Koneksi langsung",
"datepicker": "Jenis Kalender",
"datepickerPlaceholder": "Pilih tanggal",
"datepickerDescription": "Tugas terjadwal akan berjalan berdasarkan kalender ini.",
"oldUsername": "Username Saat Ini",
"currentPassword": "Kata Sandi Saat Ini",
"newUsername": "Username Baru",
"newPassword": "Kata Sandi Baru",
"telegramBotEnable": "Aktifkan Bot Telegram",
"telegramBotEnableDesc": "Mengaktifkan bot Telegram.",
"telegramToken": "Token Telegram",
"telegramTokenDesc": "Token bot Telegram yang diperoleh dari '{'@'}BotFather'.",
"telegramProxy": "Proxy SOCKS",
"telegramProxyDesc": "Mengaktifkan proxy SOCKS5 untuk terhubung ke Telegram. (sesuaikan pengaturan sesuai panduan)",
"telegramAPIServer": "Server API Telegram",
"telegramAPIServerDesc": "Server API Telegram yang akan digunakan. Biarkan kosong untuk menggunakan server default.",
"telegramChatId": "ID Obrolan Admin",
"telegramChatIdDesc": "ID Obrolan Admin Telegram. (dipisahkan koma)(dapatkan di sini {'@'}userinfobot) atau (gunakan perintah '/id' di bot)",
"telegramNotifyTime": "Waktu Notifikasi",
"telegramNotifyTimeDesc": "Seberapa sering bot Telegram mengirim laporan berkala. Pilih interval siap pakai, atau pilih Kustom untuk memasukkan ekspresi crontab.",
"notifyTime": {
"every": "@every — ulangi dalam interval",
"hourly": "@hourly — setiap jam",
"daily": "@daily — setiap hari pukul 00:00",
"weekly": "@weekly — setiap minggu",
"monthly": "@monthly — setiap bulan",
"custom": "Kustom (crontab)",
"seconds": "Detik",
"minutes": "Menit",
"hours": "Jam",
"interval": "Interval",
"unit": "Satuan"
},
"tgNotifyBackup": "Cadangan Database",
"tgNotifyBackupDesc": "Kirim berkas cadangan database dengan laporan.",
"tgNotifyLogin": "Notifikasi Login",
"tgNotifyLoginDesc": "Dapatkan notifikasi tentang username, alamat IP, dan waktu setiap kali seseorang mencoba masuk ke panel web Anda.",
"sessionMaxAge": "Durasi Sesi",
"sessionMaxAgeDesc": "Durasi di mana Anda dapat tetap masuk. (unit: menit)",
"expireTimeDiff": "Notifikasi Tanggal Kedaluwarsa",
"expireTimeDiffDesc": "Dapatkan notifikasi tentang tanggal kedaluwarsa saat mencapai ambang batas ini. (unit: hari)",
"trafficDiff": "Notifikasi Batas Traffic",
"trafficDiffDesc": "Dapatkan notifikasi tentang batas traffic saat mencapai ambang batas ini. (unit: GB)",
"tgNotifyCpu": "Notifikasi Beban CPU",
"tgNotifyCpuDesc": "Dapatkan notifikasi jika beban CPU melebihi ambang batas ini. (unit: %)",
"timeZone": "Zone Waktu",
"timeZoneDesc": "Tugas terjadwal akan berjalan berdasarkan zona waktu ini.",
"subSettings": "Langganan",
"subEnable": "Aktifkan Layanan Langganan",
"subEnableDesc": "Mengaktifkan layanan langganan.",
"subJsonEnable": "Aktifkan/Nonaktifkan endpoint langganan JSON secara mandiri.",
"subJsonEnableTitle": "Langganan JSON",
"subClashEnableTitle": "Langganan Clash / Mihomo",
"subFormatsTipTitle": "Pengaturan langganan khusus format",
"subFormatsTipDesc": "Konfigurasikan jalur URL, URL proksi balik, dan deteksi otomatis klien untuk JSON serta Clash / Mihomo secara terpisah.",
"subFormatsTipAction": "Buka Format Langganan",
"subJsonAutoDetect": "Deteksi otomatis klien Xray JSON",
"subJsonAutoDetectDesc": "Jika diaktifkan, klien kompatibel yang dikenali dan meminta URL langganan standar akan otomatis menerima larik konfigurasi Xray JSON. Klien lain tetap menerima respons mentah/Base64. Langganan JSON harus diaktifkan dan panel harus dimulai ulang.",
"subJsonAlwaysArray": "Selalu kembalikan larik JSON",
"subJsonAlwaysArrayDesc": "Mengembalikan endpoint langganan JSON eksplisit sebagai larik meski hanya berisi satu profil, sesuai standar XTLS. Respons JSON yang terdeteksi otomatis selalu menggunakan larik. Nonaktifkan untuk mempertahankan respons objek tunggal lama.",
"subJsonUserAgentRegex": "Regex User-Agent Xray JSON",
"subJsonUserAgentRegexDesc": "Ekspresi reguler Go RE2 yang dicocokkan dengan User-Agent klien untuk memilih format Xray JSON secara otomatis pada URL langganan standar. Kosong secara bawaan, sehingga deteksi otomatis tetap nonaktif hingga Anda menetapkan pola untuk klien yang ingin dilayani. Klien lain tetap menerima respons mentah/Base64. Mulai ulang panel setelah mengubahnya.",
"subClashAutoDetect": "Deteksi otomatis klien Clash/Mihomo",
"subClashAutoDetectDesc": "Jika diaktifkan, klien Clash/Mihomo yang dikenali dan meminta URL langganan standar akan otomatis menerima YAML Clash. Browser tetap menampilkan halaman langganan, klien lain tetap menerima respons mentah/Base64, dan URL JSON serta Clash eksplisit tetap tersedia. Langganan Clash/Mihomo harus diaktifkan dan panel harus dimulai ulang agar perubahan diterapkan.",
"subClashUserAgentRegex": "Regex User-Agent Clash/Mihomo",
"subClashUserAgentRegexDesc": "Ekspresi reguler Go RE2 yang dicocokkan dengan User-Agent klien untuk mengenali klien Clash/Mihomo pada URL langganan standar. Kosongkan untuk memakai pola bawaan. Mulai ulang panel setelah mengubahnya.",
"subTitle": "Judul Langganan",
"subTitleDesc": "Judul yang ditampilkan di klien VPN. Mendukung token identitas klien: {{EMAIL}}, {{ID}}, {{SHORT_ID}}, {{SUB_ID}}, {{TELEGRAM_ID}}.",
"subSupportUrl": "URL Dukungan",
"subSupportUrlDesc": "Tautan dukungan teknis yang ditampilkan di klien VPN. Mendukung token identitas klien: {{EMAIL}}, {{ID}}, {{SHORT_ID}}, {{SUB_ID}}, {{TELEGRAM_ID}}.",
"subProfileUrl": "URL Profil",
"subProfileUrlDesc": "Tautan ke situs web Anda yang ditampilkan di klien VPN. Mendukung token identitas klien: {{EMAIL}}, {{ID}}, {{SHORT_ID}}, {{SUB_ID}}, {{TELEGRAM_ID}}.",
"subAnnounce": "Pengumuman",
"subAnnounceDesc": "Teks pengumuman yang ditampilkan di klien VPN. Mendukung token identitas klien: {{EMAIL}}, {{ID}}, {{SHORT_ID}}, {{SUB_ID}}, {{TELEGRAM_ID}}.",
"subThemeDir": "Direktori Tema Langganan",
"subThemeDirDesc": "Path absolut ke folder yang berisi template kustom (index.html/sub.html) untuk halaman langganan (mis. /etc/3x-ui/sub_templates/my-theme/). Biarkan kosong untuk menggunakan halaman default.",
"subThemeDirDocs": "Panduan templat ↗",
"subEnableRouting": "Aktifkan perutean",
"subEnableRoutingDesc": "Pengaturan global untuk mengaktifkan perutean (routing) di klien VPN. (Hanya untuk Happ)",
"subRoutingRules": "Aturan routing",
"subRoutingRulesDesc": "Tempel deeplink happ:// siap pakai atau satu URL HTTPS permanen. Panel memperbarui aturan jarak jauh di latar belakang dan menyimpan nilai valid terakhir, sehingga permintaan langganan tidak menunggu sumber. (Hanya untuk Happ)",
"subHideSettings": "Sembunyikan pengaturan server",
"subHideSettingsDesc": "Menyembunyikan kemampuan untuk melihat dan mengedit konfigurasi server di klien VPN. (Hanya untuk Happ)",
"subIncyEnableRouting": "Aktifkan perutean",
"subIncyEnableRoutingDesc": "Menyuntikkan profil perutean ke dalam body langganan untuk klien Incy. (Hanya untuk Incy)",
"subIncyRoutingRules": "Aturan routing",
"subIncyRoutingRulesDesc": "Tempel deeplink incy:// siap pakai atau URL HTTPS permanen ke JSON. Incy membuat profil autorouting dan memperbaruinya secara otomatis. (Hanya untuk Incy)",
"subClashEnableRouting": "Aktifkan routing",
"subClashEnableRoutingDesc": "Sertakan aturan routing global Clash/Mihomo dalam langganan YAML yang dibuat.",
"subClashRoutingRules": "Aturan routing global",
"subClashRoutingRulesDesc": "Tempel aturan/YAML atau satu URL HTTPS permanen. Panel memperbaruinya di latar belakang, hanya mengimpor grup, penyedia aturan, dan aturan, serta mempertahankan node VPN buatan panel dan nilai valid terakhir.",
"subListen": "IP Pendengar",
"subListenDesc": "Alamat IP untuk layanan langganan. (biarkan kosong untuk mendengarkan semua IP)",
"subPort": "Port Pendengar",
"subPortDesc": "Nomor port untuk layanan langganan. (harus menjadi port yang tidak digunakan). Juga digunakan untuk membangun tautan/QR langganan yang ditampilkan di panel ketika \"URI Proxy Terbalik\" di bawah kosong — jika langganan diakses melalui reverse proxy pada port yang berbeda, atur \"URI Proxy Terbalik\" sebagai gantinya.",
"subCertPath": "Path Kunci Publik",
"subCertPathDesc": "Path berkas kunci publik untuk layanan langganan. (dimulai dengan ‘/‘)",
"subKeyPath": "Path Kunci Privat",
"subKeyPathDesc": "Path berkas kunci privat untuk layanan langganan. (dimulai dengan ‘/‘)",
"subPath": "Path URI",
"subPathDesc": "URI path untuk layanan langganan. (dimulai dengan ‘/‘ dan diakhiri dengan ‘/‘)",
"subDomain": "Domain Pendengar",
"subDomainDesc": "Nama domain untuk layanan langganan. (biarkan kosong untuk mendengarkan semua domain dan IP). Juga digunakan sebagai domain cadangan untuk tautan langganan yang ditampilkan ketika \"URI Proxy Terbalik\" kosong — atur \"URI Proxy Terbalik\" jika panel dan langganan diakses melalui domain yang berbeda (misalnya di belakang reverse proxy).",
"subUpdates": "Interval Pembaruan",
"subUpdatesDesc": "Interval pembaruan URL langganan dalam aplikasi klien. (unit: jam)",
"subEncrypt": "Encode",
"subEncryptDesc": "Konten yang dikembalikan dari layanan langganan akan dienkripsi Base64.",
"subURI": "URI Proxy Terbalik",
"subURIDesc": "URL dasar lengkap (scheme://domain[:port]/path/) untuk tautan langganan dan kode QR, digunakan sebagai pengganti Domain/Port Pendengar. Atur ini kapan pun langganan diakses melalui reverse proxy atau domain/port yang berbeda dari yang di atas.",
"externalTrafficInformEnable": "Informasikan API eksternal pada setiap pembaruan lalu lintas.",
"externalTrafficInformEnableDesc": "Beritahu API eksternal setiap kali ada pembaruan trafik.",
"externalTrafficInformURI": "Lalu Lintas Eksternal Menginformasikan URI",
"externalTrafficInformURIDesc": "Pembaruan lalu lintas dikirim ke URI ini.",
"restartXrayOnClientDisable": "Nyalakan Ulang Xray Setelah Nonaktif Otomatis",
"restartXrayOnClientDisableDesc": "Saat klien otomatis dinonaktifkan karena kedaluwarsa atau batas trafik, mulai ulang Xray.",
"fragment": "Fragmentasi",
"fragmentDesc": "Aktifkan fragmentasi untuk paket hello TLS",
"fragmentSett": "Pengaturan Fragmentasi",
"noisesDesc": "Aktifkan Noises.",
"noisesSett": "Pengaturan Noises",
"trustedProxyCidrs": "CIDR proxy tepercaya",
"trustedProxyCidrsDesc": "IP/CIDR (dipisahkan koma) yang diizinkan mengatur header forwarded host, proto, dan client IP.",
"ldap": {
"enable": "Aktifkan sinkronisasi LDAP",
"host": "LDAP host",
"port": "Port LDAP",
"useTls": "Gunakan TLS (LDAPS)",
"skipTlsVerify": "Lewati verifikasi sertifikat TLS",
"skipTlsVerifyDesc": "Tidak aman — menonaktifkan validasi sertifikat server. Gunakan hanya dengan CA internal/tidak terpercaya.",
"bindDn": "Bind DN",
"passwordConfigured": "Terkonfigurasi; biarkan kosong untuk mempertahankan kata sandi saat ini.",
"passwordUnconfigured": "Tidak terkonfigurasi.",
"passwordPlaceholder": "Terkonfigurasi — masukkan nilai baru untuk menggantikan",
"baseDn": "Base DN",
"userFilter": "Filter pengguna",
"userAttr": "Atribut pengguna (username/email)",
"vlessField": "Atribut flag VLESS",
"flagField": "Atribut flag umum (opsional)",
"flagFieldDesc": "Jika diatur, menimpa flag VLESS — mis. shadowInactive.",
"truthyValues": "Nilai truthy",
"truthyValuesDesc": "Dipisahkan koma; default: true,1,yes,on",
"invertFlag": "Balik flag",
"invertFlagDesc": "Aktifkan saat atribut berarti «dinonaktifkan» (mis. shadowInactive).",
"syncSchedule": "Jadwal sinkronisasi",
"syncScheduleDesc": "String mirip cron, mis. @every 1m",
"inboundTags": "Tag inbound",
"inboundTagsDesc": "Inbound di mana sinkronisasi LDAP dapat membuat/menghapus klien secara otomatis.",
"noInbounds": "Tidak ada inbound. Buat dulu di Inbound.",
"autoCreate": "Buat klien otomatis",
"autoDelete": "Hapus klien otomatis",
"defaultTotalGb": "Total default (GB)",
"defaultExpiryDays": "Kedaluwarsa default (hari)",
"defaultIpLimit": "Batas IP default"
},
"subFormats": {
"finalMask": "Final Mask",
"finalMaskDesc": "Menyisipkan mask TCP/UDP Xray finalmask dan parameter QUIC ke setiap profil Xray JSON yang dibuat. Membutuhkan aplikasi klien yang mendukung langganan Xray JSON dan inti Xray terbaru.",
"packets": "Paket",
"length": "Panjang",
"interval": "Interval",
"maxSplit": "Maks. pembagian",
"noises": "Noise",
"noiseItem": "Noise №{n}",
"type": "Tipe",
"packet": "Paket",
"delayMs": "Penundaan (ms)",
"applyTo": "Terapkan ke",
"addNoise": "+ Noise",
"concurrency": "Konkurensi",
"xudpConcurrency": "Konkurensi xudp",
"xudpUdp443": "xudp UDP 443"
},
"mux": "Mux",
"muxDesc": "Mengirimkan beberapa aliran data independen dalam aliran data yang sudah ada.",
"muxSett": "Pengaturan Mux",
"direct": "Koneksi langsung",
"directDesc": "Secara langsung membuat koneksi dengan domain atau rentang IP negara tertentu.",
"notifications": "Notifikasi",
"certs": "Sertifikat",
"externalTraffic": "Lalu Lintas Eksternal",
"dateAndTime": "Tanggal dan Waktu",
"proxyAndServer": "Proxy dan Server",
"intervals": "Interval",
"information": "Informasi",
"profile": "Profil",
"language": "Bahasa",
"telegramBotLanguage": "Bahasa Bot Telegram",
"security": {
"admin": "Kredensial admin",
"twoFactor": "Autentikasi dua faktor",
"twoFactorEnable": "Aktifkan 2FA",
"twoFactorEnableDesc": "Menambahkan lapisan autentikasi tambahan untuk keamanan lebih.",
"twoFactorModalSetTitle": "Aktifkan autentikasi dua faktor",
"twoFactorModalDeleteTitle": "Nonaktifkan autentikasi dua faktor",
"twoFactorModalSteps": "Untuk menyiapkan autentikasi dua faktor, lakukan beberapa langkah:",
"twoFactorModalFirstStep": "1. Pindai kode QR ini di aplikasi autentikasi atau salin token di dekat kode QR dan tempelkan ke aplikasi",
"twoFactorModalSecondStep": "2. Masukkan kode dari aplikasi",
"twoFactorModalRemoveStep": "Masukkan kode dari aplikasi untuk menghapus autentikasi dua faktor.",
"twoFactorModalChangeCredentialsTitle": "Ubah kredensial",
"twoFactorModalChangeCredentialsStep": "Masukkan kode dari aplikasi untuk mengubah kredensial administrator.",
"twoFactorModalSetSuccess": "Autentikasi dua faktor telah berhasil dibuat",
"twoFactorModalDeleteSuccess": "Autentikasi dua faktor telah berhasil dihapus",
"twoFactorModalError": "Kode salah",
"show": "Tampilkan",
"hide": "Sembunyikan",
"apiTokenNew": "Token baru",
"apiTokenName": "Nama",
"apiTokenNamePlaceholder": "misalnya central-panel-a",
"apiTokenNameRequired": "Nama wajib diisi",
"apiTokenEmpty": "Belum ada token — buat satu untuk mengautentikasi bot atau panel jarak jauh.",
"apiTokenDeleteWarning": "Setiap pemanggil yang menggunakan token ini akan berhenti terautentikasi segera.",
"apiTokenCreatedTitle": "Token dibuat",
"apiTokenCreatedNotice": "Salin token ini sekarang. Demi keamanan, token tidak disimpan dalam bentuk yang dapat dibaca dan tidak akan ditampilkan lagi."
},
"toasts": {
"modifySettings": "Parameter telah diubah.",
"getSettings": "Terjadi kesalahan saat mengambil parameter.",
"modifyUserError": "Terjadi kesalahan saat mengubah kredensial administrator.",
"modifyUser": "Anda telah berhasil mengubah kredensial administrator.",
"originalUserPassIncorrect": "Username atau password saat ini tidak valid",
"userPassMustBeNotEmpty": "Username dan password baru tidak boleh kosong",
"getOutboundTrafficError": "Gagal mendapatkan lalu lintas keluar",
"resetOutboundTrafficError": "Gagal mereset lalu lintas keluar"
},
"smtpSettings": "Pengaturan SMTP",
"smtpEnable": "Aktifkan Notifikasi Email",
"smtpEnableDesc": "Aktifkan notifikasi email melalui SMTP",
"smtpHost": "Host SMTP",
"smtpHostDesc": "Nama host server SMTP (mis. smtp.gmail.com)",
"smtpPort": "Port SMTP",
"smtpPortDesc": "Port server SMTP (bawaan: 587)",
"smtpUsername": "Nama Pengguna SMTP",
"smtpUsernameDesc": "Nama pengguna autentikasi SMTP",
"smtpFrom": "Alamat Pengirim (From)",
"smtpFromDesc": "Alamat yang dipakai pada header From email. Kosongkan untuk memakai nama pengguna.",
"smtpFromName": "Nama Pengirim (From)",
"smtpFromNameDesc": "Nama tampilan opsional sebelum alamat pada header From.",
"smtpPassword": "Kata Sandi SMTP",
"smtpPasswordDesc": "Kata sandi autentikasi SMTP",
"smtpTo": "Penerima",
"smtpToDesc": "Alamat email penerima dipisahkan dengan koma",
"emailSettings": "Email",
"emailNotifications": "Notifikasi",
"smtpEventBusNotify": "Notifikasi Peristiwa Email",
"smtpEventBusNotifyDesc": "Pilih peristiwa yang memicu notifikasi email",
"tgEventBusNotify": "Notifikasi Peristiwa Telegram",
"tgEventBusNotifyDesc": "Pilih peristiwa yang memicu notifikasi Telegram",
"testSmtp": "Kirim Email Uji",
"testTgBot": "Kirim Pesan Uji",
"eventGroupOutbound": "Outbound",
"eventGroupXray": "Xray Core",
"eventGroupSystem": "Sistem",
"eventGroupSecurity": "Keamanan",
"eventGroupNode": "Node",
"eventOutboundDown": "Mati",
"eventOutboundUp": "Aktif",
"eventXrayCrash": "Crash",
"eventNodeDown": "Mati",
"eventNodeUp": "Aktif",
"eventCPUHigh": "CPU tinggi (%)",
"requestFailed": "Permintaan gagal",
"smtpEncryption": "Enkripsi",
"smtpEncryptionDesc": "Metode enkripsi koneksi SMTP",
"smtpEncryptionNone": "Tidak ada (teks biasa)",
"smtpEncryptionStartTLS": "STARTTLS",
"smtpEncryptionTLS": "TLS (implisit)",
"smtpStageConnect": "Koneksi",
"smtpStageAuth": "Autentikasi",
"smtpStageSend": "Kirim",
"smtpTestSuccess": "Email uji berhasil dikirim",
"smtpHostNotConfigured": "Host SMTP belum dikonfigurasi",
"smtpNoRecipients": "Tidak ada penerima yang dikonfigurasi",
"smtpFromNotConfigured": "Alamat pengirim SMTP belum dikonfigurasi",
"eventLoginAttempt": "Percobaan masuk",
"telegramTokenConfigured": "Terkonfigurasi; kosongkan untuk mempertahankan token saat ini.",
"telegramTokenPlaceholder": "Terkonfigurasi - masukkan token baru untuk mengganti",
"smtpPasswordConfigured": "Terkonfigurasi; kosongkan untuk mempertahankan kata sandi saat ini.",
"smtpPasswordPlaceholder": "Terkonfigurasi - masukkan kata sandi baru untuk mengganti",
"smtpNotInitialized": "SMTP belum diinisialisasi",
"tgBotNotEnabled": "Bot Telegram tidak aktif",
"tgTestFailed": "Uji Telegram gagal",
"tgTestSuccess": "Pesan uji terkirim ke Telegram",
"tgBotNotRunning": "Bot Telegram tidak berjalan",
"smtpErrorAuth": "Autentikasi gagal — periksa nama pengguna dan kata sandi",
"smtpErrorStarttls": "Server memerlukan STARTTLS — ubah jenis enkripsi",
"smtpErrorTls": "Server memerlukan TLS — ubah jenis enkripsi",
"smtpErrorRefused": "Koneksi ditolak — periksa host dan port",
"smtpErrorTimeout": "Koneksi waktu habis — host tidak dapat dijangkau",
"smtpErrorRelay": "Server menolak pengiriman dari alamat ini",
"smtpErrorEof": "Koneksi ditutup oleh server",
"smtpErrorUnknown": "Kesalahan SMTP: {{ .Error }}",
"eventMemoryHigh": "Penggunaan memori tinggi (%)",
"remarkTemplate": "Templat Catatan",
"remarkTemplateDesc": "Jika diatur, ini menggantikan model catatan untuk setiap tautan langganan — tulis format Anda sendiri dengan token variabel (gunakan tombol untuk menyisipkannya). Biarkan kosong untuk memakai model di atas.",
"subShowIdentityOnAllLinks": "Tampilkan identitas di setiap tautan",
"subShowIdentityOnAllLinksDesc": "Jika diaktifkan, {{EMAIL}} dan {{USERNAME}} tetap ada di catatan setiap tautan isi langganan. Token penggunaan tetap hanya di tautan pertama.",
"validation": {
"pathLeadingSlash": "Path harus diawali dengan /"
},
"secretClear": "Hapus",
"secretClearUndo": "Batalkan hapus",
"calendarGregorian": "Gregorian (Standard)",
"calendarJalalian": "Jalalian (شمسی)",
"ipLimitAllowlist": "Daftar izin batas IP",
"ipLimitAllowlistDesc": "Alamat dan jaringan yang tidak pernah dihitung maupun diblokir oleh batas IP, sehingga alamat kantor atau kampus bersama tidak menghabiskan batas klien. IP/CIDR (dipisahkan koma).",
"subBalancers": {
"menu": "Penyeimbang langganan",
"title": "Penyeimbang langganan",
"add": "Tambah penyeimbang",
"desc": "Setiap penyeimbang yang aktif ditambahkan ke langganan JSON sebagai profil tambahan yang otomatis memilih titik akhir terbaik dari inbound terpilih.",
"remark": "Keterangan",
"remarkPlaceholder": "Otomatis · tercepat",
"strategy": "Strategi",
"strategyLeastLoad": "Beban terendah",
"strategyLeastPing": "Ping terendah",
"strategyRandom": "Acak",
"strategyRoundRobin": "Round robin",
"sortOrder": "Urutan",
"sortOrderHelp": "Posisi dalam daftar langganan, berselang-seling dengan urutan inbound; jika sama, penyeimbang berada setelah inbound.",
"inbounds": "Inbound",
"inboundsCount": "{count} Inbound",
"enabled": "Aktif",
"empty": "Belum ada penyeimbang",
"deleteConfirm": "Hapus penyeimbang ini?",
"errRemarkRequired": "Keterangan wajib diisi",
"errInboundsRequired": "Pilih minimal satu inbound",
"errSortOrder": "Urutan harus bilangan bulat ≥ 1",
"toasts": {
"list": "Gagal menampilkan daftar penyeimbang langganan",
"create": "Gagal membuat penyeimbang langganan",
"update": "Gagal memperbarui penyeimbang langganan",
"delete": "Gagal menghapus penyeimbang langganan",
"invalidId": "Id tidak valid"
},
"tabBalancers": "Penyeimbang",
"tabObservatory": "Observatory",
"observatory": {
"title": "Observatorium penyeimbang",
"desc": "Parameter probe untuk burstObservatory yang disisipkan ke setiap profil leastPing/leastLoad. random/roundRobin tanpa observatorium. Disimpan sebagai pengaturan langganan JSON tingkat panel.",
"destination": "URL probe",
"destinationDesc": "Alamat yang di-probe klien untuk mengukur setiap outbound anggota.",
"connectivity": "URL konektivitas",
"connectivityDesc": "Alamat opsional untuk memeriksa sekali bahwa anggota menjangkau tujuan. Kosongkan untuk melewati.",
"interval": "Interval probe",
"intervalDesc": "Waktu antar ronde probe, mis. 1m.",
"timeout": "Waktu habis probe",
"timeoutDesc": "Waktu habis per probe, mis. 5s.",
"sampling": "Pengambilan sampel",
"samplingDesc": "Jumlah probe beruntun untuk merata-ratakan stabilitas.",
"httpMethod": "Metode HTTP",
"httpMethodDesc": "Metode yang dipakai untuk permintaan probe.",
"note": "Penyeimbang leastPing/leastLoad selalu membawa burstObservatory. Sakelar ini menyesuaikan parameter probe-nya — matikan untuk memakai bawaan default. Perubahan berlaku setelah panel dimulai ulang."
}
}
},
"xray": {
"save": "Simpan",
"restartSuccess": "Xray berhasil diluncurkan ulang",
"stopSuccess": "Xray telah berhasil dihentikan",
"restartError": "Terjadi kesalahan saat memulai ulang Xray.",
"stopError": "Terjadi kesalahan saat menghentikan Xray.",
"basicTemplate": "Dasar",
"advancedTemplate": "Lanjutan",
"generalConfigs": "Strategi Umum",
"generalConfigsDesc": "Opsi ini akan menentukan penyesuaian strategi umum.",
"logConfigs": "Log",
"logConfigsDesc": "Log dapat mempengaruhi efisiensi server Anda. Disarankan untuk mengaktifkannya dengan bijak hanya jika diperlukan",
"basicRouting": "Perutean Dasar",
"blockConnectionsConfigsDesc": "Opsi ini akan memblokir lalu lintas berdasarkan negara yang diminta.",
"directConnectionsConfigsDesc": "Koneksi langsung memastikan bahwa lalu lintas tertentu tidak dialihkan melalui server lain.",
"blockips": "Blokir IP",
"blockdomains": "Blokir Domain",
"directips": "IP Langsung",
"directdomains": "Domain Langsung",
"ipv4Routing": "Perutean IPv4",
"ipv4RoutingDesc": "Opsi ini akan mengalihkan lalu lintas berdasarkan tujuan tertentu melalui IPv4.",
"Template": "Template Konfigurasi Xray Lanjutan",
"TemplateDesc": "File konfigurasi Xray akhir akan dibuat berdasarkan template ini.",
"FreedomStrategy": "Strategi Protokol Freedom",
"FreedomStrategyDesc": "Atur strategi output untuk jaringan dalam Protokol Freedom.",
"FreedomHappyEyeballs": "Freedom Happy Eyeballs (IPv4/IPv6)",
"FreedomHappyEyeballsDesc": "Panggilan dual-stack untuk outbound langsung (freedom) — berguna pada server keluar dengan IPv4 dan IPv6.",
"FreedomHappyEyeballsTryDelayDesc": "Milidetik sebelum mencoba keluarga alamat lainnya. 150–250 ms adalah titik awal yang baik.",
"RoutingStrategy": "Strategi Pengalihan Keseluruhan",
"RoutingStrategyDesc": "Atur strategi pengalihan lalu lintas keseluruhan untuk menyelesaikan semua permintaan.",
"outboundTestUrl": "URL tes outbound",
"outboundTestUrlDesc": "URL yang digunakan saat menguji konektivitas outbound",
"Torrent": "Blokir Protokol BitTorrent",
"Inbounds": "Inbound",
"Outbounds": "Outbound",
"importRules": "Impor aturan",
"exportRules": "Ekspor aturan",
"importOutbounds": "Impor outbound",
"exportOutbounds": "Ekspor outbound",
"importInvalidJson": "JSON tidak valid — diharapkan berupa array atau objek dengan kunci yang sesuai.",
"metricsListen": "Endpoint metrik",
"metricsListenDesc": "Tampilkan metrik gaya Prometheus dari Xray pada alamat:port ini (mis. 127.0.0.1:11111). Biarkan kosong untuk menonaktifkan. Ikat ke localhost dan reverse-proxy — endpoint ini tanpa autentikasi.",
"metricsTag": "Tag metrik",
"Balancers": "Penyeimbang",
"balancerTagRequired": "Tag wajib diisi",
"balancerSelectorRequired": "Pilih setidaknya satu outbound",
"balancerLive": "Target Saat Ini",
"balancerOverride": "Paksa Tujuan",
"balancerOverridePh": "Otomatis (strategi)",
"balancerLiveRefresh": "Perbarui status penyeimbang beban",
"balancerNotRunning": "Penyeimbang ini tidak aktif di Xray yang berjalan — simpan perubahan atau mulai Xray terlebih dahulu",
"routeTester": "Uji Rute",
"routeTesterDesc": "Tanyakan kepada Xray yang berjalan outbound mana yang akan menangani koneksi. Tidak ada lalu lintas yang dikirim — keputusan langsung datang dari mesin routing langsung.",
"routeTesterDest": "Domain atau IP",
"routeTesterPort": "Port",
"routeTesterInbound": "Inbound",
"routeTesterProtocol": "Protokol yang terdeteksi",
"routeTesterTest": "Uji Rute",
"routeTesterMatchedOutbound": "Outbound yang cocok",
"routeTesterViaBalancer": "melalui penyeimbang",
"routeTesterDefaultOutbound": "Tidak ada aturan routing yang cocok — lalu lintas menuju outbound default (pertama).",
"Routings": "Aturan Pengalihan",
"completeTemplate": "Semua",
"logLevel": "Tingkat Log",
"logLevelDesc": "Tingkat log untuk log kesalahan, menunjukkan informasi yang perlu dicatat.",
"accessLog": "Log Akses",
"accessLogDesc": "Jalur file untuk log akses. Nilai khusus 'tidak ada' menonaktifkan log akses",
"errorLog": "Catatan eror",
"errorLogDesc": "Jalur file untuk log kesalahan. Nilai khusus 'tidak ada' menonaktifkan log kesalahan",
"dnsLog": "Log DNS",
"dnsLogDesc": "Apakah akan mengaktifkan log kueri DNS",
"maskAddress": "Alamat Masker",
"maskAddressDesc": "Masker alamat IP, ketika diaktifkan, akan secara otomatis mengganti alamat IP yang muncul di log.",
"statistics": "Statistik",
"statsInboundUplink": "Statistik Unggah Masuk",
"statsInboundDownlink": "Statistik Unduh Masuk",
"statsOutboundUplink": "Statistik Unggah Keluar",
"statsOutboundDownlink": "Statistik Unduh Keluar",
"connectionLimits": "Batas Koneksi",
"connectionLimitsDesc": "Kebijakan tingkat koneksi untuk level pengguna 0. Biarkan kolom kosong untuk menggunakan nilai bawaan Xray.",
"connIdle": "Batas Waktu Idle",
"connIdleDesc": "Menutup koneksi setelah idle selama sekian detik. Menurunkannya membebaskan memori dan file descriptor lebih cepat pada server yang sibuk (bawaan Xray: 300).",
"bufferSize": "Ukuran Buffer",
"bufferSizeDesc": "Ukuran buffer internal per koneksi dalam KB. Setel ke 0 untuk meminimalkan penggunaan memori pada server ber-RAM rendah (nilai bawaan Xray bergantung pada platform).",
"bufferSizePlaceholder": "otomatis",
"seconds": "detik",
"rules": {
"source": "Sumber",
"dest": "Tujuan",
"inbound": "Masuk",
"balancer": "Pengimbang",
"useComma": "Item yang dipisahkan koma"
},
"routing": {
"dragToReorder": "Seret untuk mengurutkan ulang"
},
"geoBrowser": {
"title": "Kategori geo",
"openTooltip": "Jelajahi kategori geo",
"database": "Basis data",
"searchCategory": "Cari kategori",
"searchEntries": "Filter di dalam kategori",
"selectFound": "Pilih hasil pencarian",
"selected": "Dipilih {count}",
"clearAll": "Hapus semua",
"apply": "Terapkan",
"emptySelection": "Centang kategori — semuanya menjadi token aturan",
"pickCategory": "Pilih kategori di sebelah kiri untuk melihat isinya",
"noMatches": "Tidak ada yang ditemukan",
"noFiles": "Tidak ada basis data geo di folder Xray",
"noFilesHint": "Akan muncul setelah Xray mengunduh geosite.dat dan geoip.dat",
"fileMeta": "{count} kategori · {size} · diperbarui {date}",
"entriesCount": "{count} entri",
"subnetsCount": "{count} subnet",
"shownRange": "Menampilkan {from}–{to} dari {total}",
"loadFailed": "Gagal memuat basis data geo",
"checkFailed": "Tidak dapat memeriksa nilai ini terhadap basis data geo",
"parseFailed": "Berkas rusak atau bukan basis data geosite/geoip",
"tooLarge": "Terlalu besar untuk ditelusuri",
"unknownCategories": "Tidak ada di basis data: {tokens}",
"missingDatabase": "Berkas basis data tidak ditemukan: {tokens} — tambahkan di bagian Geodata",
"unknownAttribute": "Atribut tidak ditemukan, aturan tidak akan cocok dengan apa pun: {tokens}",
"invalidToken": "Xray tidak akan menerima entri ini: {tokens}",
"wrongKind": "Jenis basis data salah untuk kolom ini: {tokens}"
},
"ruleForm": {
"sourceIps": "IP sumber",
"sourcePort": "Port sumber",
"vlessRoute": "Rute VLESS",
"attributes": "Atribut",
"value": "Nilai",
"user": "Pengguna",
"userPlaceholder": "Pilih pengguna",
"userEmpty": "Tidak ada pengguna tersedia",
"userLoadError": "Gagal memuat pengguna",
"inboundTags": "Tag inbound",
"outboundTag": "Tag outbound",
"balancerTag": "Tag balancer",
"balancerTagTooltip": "Mengarahkan trafik melalui salah satu balancer yang dikonfigurasi"
},
"outboundForm": {
"tagDuplicate": "Tag sudah digunakan oleh outbound lain",
"tagRequired": "Tag wajib diisi",
"tagPlaceholder": "tag-unik",
"localIpPlaceholder": "IP lokal",
"dialerProxyPlaceholder": "Pilih outbound untuk dirantai",
"dialerProxyHint": "Hubungkan outbound ini melalui outbound lain (berdasarkan tag) untuk membuat rantai proxy. Kosongkan untuk terhubung langsung.",
"targetStrategyHint": "Cara domain tujuan diresolusi sebelum terhubung: AsIs (default) mengirim apa adanya, UseIP… meresolusi dengan fallback, ForceIP… wajib berhasil diresolusi.",
"addressRequired": "Alamat wajib diisi",
"portRequired": "Port wajib diisi",
"optional": "opsional",
"udpOverTcp": "UDP over TCP",
"uotVersion": "Versi UoT",
"inboundTag": "Tag inbound",
"inboundTagPlaceholder": "tag inbound yang digunakan dalam aturan routing",
"responseType": "Tipe respons",
"rewriteNetwork": "Tulis ulang jaringan",
"unchanged": "(tidak berubah)",
"unchangedAddress": "(tidak berubah) mis. 1.1.1.1",
"rules": "Aturan",
"ruleN": "Aturan {n}",
"action": "Aksi",
"redirect": "Redirect",
"finalRules": "Aturan akhir",
"overrideXrayPrivateIp": "Timpa blok IP privat default Xray",
"blockDelay": "Penundaan blokir (ms)",
"reverseSniffing": "Sniffing terbalik",
"reserved": "Dicadangkan",
"minUploadInterval": "Min. interval upload (ms)",
"maxUploadSizeBytes": "Ukuran upload maks. (byte)",
"uplinkChunkSize": "Ukuran chunk Uplink",
"noGrpcHeader": "Tanpa header gRPC",
"maxConcurrency": "Maks. konkurensi",
"maxConnections": "Maks. koneksi",
"maxReuseTimes": "Maks. pemakaian ulang",
"maxRequestTimes": "Maks. permintaan",
"maxReusableSecs": "Maks. detik dapat dipakai ulang",
"keepAlivePeriod": "Periode keep alive",
"authPassword": "Kata sandi auth",
"visionTestpre": "Vision testpre",
"serverNamePlaceholder": "nama server",
"verifyPeerName": "Verifikasi nama peer",
"pinnedSha256": "SHA256 pinned",
"shortId": "Short ID",
"sockopts": "Sockopts",
"keepAliveInterval": "Interval keep alive",
"markFwmark": "Mark (fwmark)",
"interface": "Interface",
"proxyProtocol": "Proxy protocol",
"tcpUserTimeoutMs": "TCP user timeout (ms)",
"tcpKeepAliveIdleS": "TCP keep-alive idle (d)"
},
"outbound": {
"tag": "Tag",
"egress": "Egress",
"egressHint": "Run an HTTP test to show egress IP and country.",
"outboundStatus": "Status Keluar",
"sendThrough": "Kirim Melalui",
"targetStrategy": "Strategi Target",
"modeRealDelay": "Delay nyata",
"testModeTooltip": "TCP: probe dial-only cepat. HTTP: permintaan penuh via xray. Delay nyata: total waktu termasuk pembentukan koneksi.",
"testAll": "Tes semua",
"httpStatus": "Status HTTP",
"breakdownConnect": "Koneksi proxy",
"breakdownTls": "TLS melalui outbound",
"breakdownTtfb": "Byte pertama",
"country": "Negara",
"server": "Server",
"city": "Kota",
"allCities": "Semua Kota",
"moveToTop": "Pindahkan ke atas"
},
"outboundSub": {
"manage": "Langganan",
"title": "Langganan Outbound",
"remark": "Catatan (opsional)",
"remarkPlaceholder": "mis. node HK",
"url": "URL langganan",
"urlPlaceholder": "https://... (daftar tautan base64)",
"tagPrefix": "Awalan tag",
"tagPrefixPlaceholder": "hk-",
"interval": "Interval pembaruan",
"hours": "j",
"minutes": "mnt",
"intervalHint": "Default 10 menit. Tugas latar belakang memeriksa secara berkala; setiap langganan hanya diambil ulang ketika intervalnya sendiri telah terlewati.",
"enabled": "Aktif",
"allowPrivate": "Izinkan alamat privat",
"allowPrivateHint": "Izinkan localhost / LAN / IP privat untuk URL langganan ini. Nonaktif secara default demi keamanan — aktifkan hanya untuk sumber lokal yang tepercaya.",
"prepend": "Sebelum outbound manual",
"prependHint": "Tempatkan outbound dari langganan ini sebelum outbound manual Anda, sehingga salah satunya dapat menjadi default.",
"preview": "Pratinjau",
"previewEmpty": "Tidak ada outbound yang ditemukan di URL ini.",
"refreshAll": "Segarkan semua",
"statusOk": "OK",
"toastUpdated": "Langganan diperbarui",
"addButton": "Tambah",
"active": "Langganan aktif",
"empty": "Belum ada langganan. Tambahkan satu di atas.",
"colRemark": "Catatan",
"colLastFetch": "Pengambilan terakhir",
"colEnabled": "Aktif",
"auto": "otomatis",
"never": "tidak pernah",
"refreshNow": "Segarkan sekarang",
"deleteConfirm": "Hapus langganan ini?",
"restartHint": "Setelah menambahkan atau menyegarkan, mulai ulang Xray (atau tunggu muat ulang otomatis berikutnya) agar outbound menjadi aktif.",
"fromSubsTitle": "Dari langganan outbound (hanya-baca)",
"fromSubsDesc": "Diimpor dari langganan aktif Anda. Kelola di panel Langganan di atas.",
"toastLoadFailed": "Gagal memuat langganan",
"toastUrlRequired": "URL langganan wajib diisi",
"toastAdded": "Langganan ditambahkan",
"toastAddFailed": "Gagal menambahkan langganan",
"toastRefreshed": "Disegarkan",
"toastRefreshFailed": "Gagal menyegarkan",
"toastDeleted": "Dihapus",
"toastDeleteFailed": "Gagal menghapus"
},
"pia": {
"menu": "PIA",
"username": "Nama pengguna PIA",
"password": "Kata sandi PIA",
"account": "Akun",
"region": "Wilayah",
"allRegions": "Semua wilayah",
"noServers": "Tidak ada server untuk negara yang dipilih",
"outboundAdded": "Outbound PIA ditambahkan",
"outboundUpdated": "Outbound PIA diperbarui",
"addedServers": "Server yang ditambahkan",
"alreadyAdded": "Server ini sudah ada di daftar outbound. Gunakan {reset} untuk memperbarui kuncinya.",
"provisionFailed": "Gagal membuat outbound PIA. Coba lagi."
},
"tabBalancerSettings": "Pengaturan Balancer",
"tabObservatory": "Observatory",
"observatory": {
"autoManaged": "Observer dikelola otomatis dari balancer Anda. Atur cara mereka melakukan probe di bawah; outbound yang dipantau mengikuti selector balancer.",
"emptyHint": "Tidak ada observer koneksi yang aktif. Satu akan ditambahkan otomatis saat Anda membuat balancer Least Ping atau Least Load — atau balancer Random / Round-robin dengan fallback — sehingga balancer yang memakai observer dapat memeriksa kesehatan outbound sebelum memilih target.",
"mixedLegacy": "Konfigurasi ini berisi Observatory dan Burst Observatory sekaligus. Xray memakai satu observer global, jadi status campuran lama ini tidak didukung; menyimpan balancer akan menormalkannya menjadi satu observer.",
"subjectSelector": "Outbound yang Dipantau",
"subjectSelectorDesc": "Tag outbound yang di-probe observer ini. Dikelola otomatis dari balancer Anda.",
"probeURL": "URL Probe",
"probeURLDesc": "URL yang diminta untuk mengukur setiap outbound. Harus mengembalikan HTTP 204.",
"probeInterval": "Interval Probe",
"probeIntervalDesc": "Seberapa sering memprobe tiap outbound, mis. 30s, 1m, 2h45m.",
"enableConcurrency": "Probe Bersamaan",
"enableConcurrencyDesc": "Probe semua outbound yang dipantau sekaligus, bukan satu per satu. Lebih cepat, tetapi lebih terlihat di jaringan.",
"destination": "Tujuan Probe",
"destinationDesc": "URL yang diminta untuk mengukur setiap outbound. Harus mengembalikan HTTP 204.",
"connectivity": "Pemeriksaan Konektivitas",
"connectivityDesc": "URL pemeriksaan jaringan lokal opsional, dicoba hanya setelah tujuan gagal. Kosongkan untuk melewati.",
"interval": "Interval Probe",
"intervalDesc": "Rata-rata waktu antar probe per outbound, mis. 1m. Minimal 10s.",
"timeout": "Batas Waktu Probe",
"timeoutDesc": "Berapa lama menunggu probe sebelum dianggap gagal, mis. 5s.",
"sampling": "Jumlah Sampling",
"samplingDesc": "Jumlah hasil probe terbaru yang disimpan untuk menilai tiap outbound.",
"httpMethod": "Metode HTTP",
"httpMethodDesc": "Metode HTTP yang digunakan untuk probe.",
"deleteAlsoObservatory": "Ini balancer terakhir yang memakai Observatory, jadi itu juga akan dihapus.",
"deleteAlsoBurst": "Ini balancer terakhir yang memakai Burst Observatory, jadi itu juga akan dihapus."
},
"refCleanup": {
"header": "Menghapus ini juga memperbarui perutean Anda:",
"ruleRemoved": "Aturan {label} — dihapus (tidak ada tujuan tersisa)",
"ruleModified": "Aturan {label} — dipertahankan (kini memakai {keeps})",
"balancerRemoved": "Balancer {tag} — dihapus (tidak ada target tersisa)"
},
"balancer": {
"balancerStrategy": "Strategi",
"tag": "Tag",
"tagDuplicate": "Tag sudah digunakan oleh balancer lain",
"tagPlaceholder": "tag balancer unik",
"selector": "Selector",
"fallback": "Fallback",
"cycleTooltip": "Siklus: {path} → (kembali ke {start})",
"expected": "Diharapkan",
"expectedPlaceholder": "jumlah node optimal",
"maxRtt": "Maks. RTT",
"tolerance": "Toleransi",
"baselines": "Baselines",
"costs": "Costs",
"costMatch": "Pola tag",
"costValue": "Bobot",
"costRegexp": "Pencocokan ekspresi reguler",
"balancerDeleteInUse": "Tidak dapat menghapus load balancer ini — digunakan sebagai fallback untuk: {names}",
"balancerFallbackCycle": "Tidak dapat mengatur load balancer ini sebagai fallback — akan menciptakan dependensi siklik.",
"balancerFallbackInfo": "Lalu lintas akan di-routing melalui: Load Balancer → Loopback → Server → Load Balancer tujuan → Koneksi keluar. Ini menambahkan hop tambahan melalui server, yang dapat menyebabkan sedikit penundaan.",
"fallbackBalancerHint": "Pilih load balancer lain sebagai fallback",
"reservedPrefix": "Awalan _bl_ dicadangkan untuk objek loopback internal load balancer"
},
"wireguard": {
"secretKey": "Kunci Rahasia",
"publicKey": "Kunci Publik",
"subnetIp": "Subnet",
"subnetCidr": "CIDR Subnet",
"allowedIPs": "IP yang Diizinkan",
"endpoint": "Titik Akhir",
"domainStrategy": "Strategi Domain"
},
"amneziawg": {
"privateKey": "Kunci Privat",
"publicKey": "Kunci Publik",
"subnetIp": "Subnet",
"subnetCidr": "CIDR Subnet",
"mtu": "MTU",
"primaryDns": "DNS Utama",
"secondaryDns": "DNS Cadangan",
"externalInterface": "Antarmuka Eksternal",
"externalInterfaceHint": "NIC host untuk NAT (PostUp/PostDown). Biarkan kosong untuk deteksi otomatis.",
"ipv6Enabled": "Aktifkan IPv6",
"ipv6Subnet": "Subnet IPv6",
"ipv6SubnetHint": "mis. fd86:ea04:1115::/64. Wajib diisi saat IPv6 diaktifkan.",
"ipv6ExternalInterface": "NIC Eksternal IPv6",
"ipv6ExternalInterfaceHint": "NIC host untuk entri proxy NDP. Biarkan kosong untuk menggunakan NIC Eksternal.",
"obfuscation": "Parameter obfuskasi",
"regenerateObfuscation": "Buat ulang",
"jc": "Jc (jumlah paket sampah)",
"jmin": "Jmin (ukuran min paket sampah)",
"jmax": "Jmax (ukuran maks paket sampah)",
"s1": "S1 (padding paket init)",
"s2": "S2 (padding paket response)",
"s3": "S3 (padding cookie reply)",
"s4": "S4 (padding paket transport)",
"h1": "H1 (header ajaib)",
"h2": "H2 (header ajaib)",
"h3": "H3 (header ajaib)",
"h4": "H4 (header ajaib)",
"hHint": "Satu bilangan bulat atau rentang. Biarkan kosong untuk nilai klasik 1/2/3/4.",
"i1": "I1 (paket tanda tangan)",
"i1Hint": "Paket tanda tangan opsional. Biarkan kosong untuk melewatkannya.",
"i2": "I2 (paket tanda tangan)",
"i3": "I3 (paket tanda tangan)",
"i4": "I4 (paket tanda tangan)",
"i5": "I5 (paket tanda tangan)",
"headerProtectionKey": "HeaderProtectionKey (perlindungan header)",
"headerProtectionKeyHint": "Kunci Base64 32 byte; harus sama di konfigurasi setiap klien. Biarkan kosong untuk menonaktifkan perlindungan header.",
"contentPaddingAddition": "ContentPaddingAddition (padding konten)",
"contentPaddingAdditionHint": "Satu bilangan bulat atau rentang byte yang ditambahkan ke paket konten. Biarkan kosong untuk menonaktifkan.",
"rekeyAfterTime": "RekeyAfterTime (detik)",
"rekeyTimeout": "RekeyTimeout (detik)",
"rejectAfterTime": "RejectAfterTime (detik)",
"keepaliveTimeout": "KeepaliveTimeout (detik)",
"maxHandshakeAttempts": "MaxHandshakeAttempts",
"timingRangeHint": "Satu bilangan bulat atau rentang. Biarkan kosong untuk memakai bawaan WireGuard.",
"maxHandshakeAttemptsHint": "Jumlah percobaan ulang handshake sebelum menyerah. Biarkan kosong untuk nilai bawaan.",
"randomTrailers": "RandomTrailers",
"randomTrailersHint": "Menambahkan byte acak ke setiap paket. Kedua sisi butuh AmneziaWG 3.1+.",
"disableCookies": "DisableCookies",
"disableCookiesHint": "Tidak pernah mengirim cookie reply — menghapus sidik jari DPI, tetapi melemahkan mitigasi banjir."
},
"tun": {
"userLevel": "Level Pengguna"
},
"nord": {
"accessToken": "Access token",
"privateKey": "Kunci privat",
"noServers": "Tidak ada server ditemukan untuk negara yang dipilih",
"noPublicKey": "Server yang dipilih tidak mengumumkan kunci publik NordLynx.",
"outboundAdded": "Outbound NordVPN ditambahkan",
"outboundUpdated": "Outbound NordVPN diperbarui"
},
"warp": {
"changeIp": "Ganti IP",
"changeIpSuccess": "IP WARP berhasil diganti!",
"autoUpdateIp": "Perbarui Alamat IP Otomatis",
"intervalDays": "Interval (Hari)",
"intervalDesc": "0 untuk menonaktifkan. Mengganti alamat IP secara otomatis.",
"licenseError": "Gagal mengatur lisensi WARP.",
"fetchFirst": "Ambil konfig WARP terlebih dahulu.",
"createAccount": "Buat akun WARP",
"accessToken": "Access token",
"deviceId": "ID perangkat",
"licenseKey": "Kunci lisensi",
"privateKey": "Kunci privat",
"deleteAccount": "Hapus akun",
"settings": "Pengaturan",
"licenseKeyLabel": "Kunci lisensi WARP / WARP+",
"key": "Kunci",
"keyPlaceholder": "kunci WARP+ 26 karakter",
"accountInfo": "Info akun",
"deviceName": "Nama perangkat",
"deviceModel": "Model perangkat",
"deviceEnabled": "Perangkat aktif",
"accountType": "Tipe akun",
"role": "Peran",
"warpPlusData": "Data WARP+",
"quota": "Kuota",
"usage": "Penggunaan",
"addOutbound": "Tambah outbound"
},
"dns": {
"enable": "Aktifkan DNS",
"enableDesc": "Aktifkan server DNS bawaan",
"tag": "Tanda DNS Masuk",
"tagDesc": "Tanda ini akan tersedia sebagai tanda masuk dalam aturan penataan.",
"clientIp": "IP Klien",
"clientIpDesc": "Digunakan untuk memberi tahu server tentang lokasi IP yang ditentukan selama kueri DNS",
"disableCache": "Nonaktifkan cache",
"disableCacheDesc": "Menonaktifkan caching DNS",
"disableFallback": "Nonaktifkan Fallback",
"disableFallbackDesc": "Menonaktifkan kueri DNS fallback",
"disableFallbackIfMatch": "Nonaktifkan Fallback Jika Cocok",
"disableFallbackIfMatchDesc": "Menonaktifkan kueri DNS fallback ketika daftar domain yang cocok dari server DNS terpenuhi",
"enableParallelQuery": "Aktifkan Kueri Paralel",
"enableParallelQueryDesc": "Aktifkan kueri DNS paralel ke beberapa server untuk resolusi yang lebih cepat",
"strategy": "Strategi Kueri",
"strategyDesc": "Strategi keseluruhan untuk menyelesaikan nama domain",
"add": "Tambahkan Server",
"edit": "Sunting Server",
"domains": "Domain",
"expectIPs": "IP yang Diharapkan",
"unexpectIPs": "IP tak terduga",
"useSystemHosts": "Gunakan Hosts Sistem",
"useSystemHostsDesc": "Gunakan file hosts dari sistem yang terinstal",
"serveStale": "Sajikan Kedaluwarsa",
"serveStaleDesc": "Mengembalikan hasil cache yang kedaluwarsa saat memperbarui di latar belakang",
"serveExpiredTTL": "TTL Kedaluwarsa",
"serveExpiredTTLDesc": "Masa berlaku (detik) entri cache kedaluwarsa; 0 = tidak pernah kedaluwarsa",
"timeoutMs": "Batas waktu (ms)",
"skipFallback": "Lewati Fallback",
"finalQuery": "Kueri Akhir",
"hosts": "Hosts",
"hostsAdd": "Tambah Host",
"hostsEmpty": "Tidak ada Host yang ditentukan",
"hostsDomain": "Domain (mis. domain:example.com)",
"hostsValues": "IP atau domain — ketik dan tekan Enter",
"usePreset": "Gunakan templat",
"dnsPresetTitle": "Templat DNS",
"dnsPresetFamily": "Keluarga",
"clearAll": "Hapus Semua",
"clearAllTitle": "Hapus semua server DNS?",
"clearAllConfirm": "Ini akan menghapus semua server DNS dari daftar. Tidak dapat dibatalkan.",
"dnsLeakWarning": "DNS dapat bocor lewat localhost, UDP/TCP polos, DoH/DoQ mode lokal, kueri fallback, atau EDNS client IP. Gunakan DoH yang dirutekan, pin resolver di hosts, dan nonaktifkan fallback saat privasi penting."
},
"fakedns": {
"add": "Tambahkan DNS Palsu",
"ipPool": "Subnet Kumpulan IP",
"poolSize": "Ukuran Kolam"
},
"defaultOutbound": "Outbound default",
"defaultOutboundDesc": "Lalu lintas tanpa aturan routing memakai outbound ini (yang pertama dalam daftar)."
},
"hosts": {
"addHost": "Tambah Host",
"editHost": "Ubah Host",
"selectInbound": "Pilih sebuah inbound",
"selectedCount": "{count} dipilih",
"summary": {
"total": "Total",
"enabled": "Aktif",
"disabled": "Nonaktif"
},
"moveUp": "Naik",
"moveDown": "Turun",
"bulkEnable": "Aktifkan",
"bulkDisable": "Nonaktifkan",
"bulkDelete": "Hapus",
"bulkDeleteConfirm": "Hapus {count} host yang dipilih?",
"deleteConfirmTitle": "Hapus host \"{name}\"?",
"sections": {
"basic": "Dasar",
"security": "Keamanan",
"advanced": "Lanjutan",
"general": "Umum",
"clash": "Clash (mihomo)"
},
"fields": {
"remark": "Catatan",
"serverDescription": "Deskripsi",
"inbound": "Inbound",
"address": "Alamat",
"port": "Port",
"endpoint": "Endpoint",
"enable": "Aktifkan",
"actions": "Aksi",
"security": "Keamanan",
"sni": "SNI",
"overrideSniFromAddress": "Gunakan alamat sebagai SNI",
"keepSniBlank": "Biarkan SNI kosong",
"hostHeader": "Header Host",
"path": "Path",
"alpn": "ALPN",
"fingerprint": "Fingerprint",
"pins": "SHA-256 sertifikat tersemat",
"allowInsecure": "Izinkan tidak aman",
"echConfigList": "Daftar konfig ECH",
"muxParams": "Mux",
"sockoptParams": "Sockopt",
"finalMask": "Final Mask",
"vlessRoute": "Rute VLESS",
"mihomoIpVersion": "Versi IP",
"mihomoX25519": "Mihomo X25519",
"shuffleHost": "Acak host",
"tags": "Tag",
"nodeGuids": "Node",
"excludeFromSubTypes": "Kecualikan dari format",
"verifyPeerCertByName": "Verifikasi sertifikat peer berdasarkan nama",
"inheritAddress": "Warisi alamat"
},
"hints": {
"address": "Biarkan kosong untuk mewarisi alamat inbound itu sendiri.",
"port": "0 mewarisi port inbound.",
"tags": "Tidak terlihat oleh pengguna akhir; hanya dikirim dengan langganan RAW. Hanya huruf kapital, angka, _ dan :.",
"nodeGuids": "Pilih node yang teresolusi dari host ini. Hanya penetapan visual.",
"serverDescription": "Catatan opsional yang ditampilkan di bawah catatan.",
"allowInsecure": "Lewati verifikasi sertifikat TLS (allowInsecure / skip-cert-verify).",
"vlessRoute": "Satu nilai rute VLESS (0-65535) yang disisipkan ke UUID, mis. 443. Biarkan kosong jika tidak ada.",
"remark": "Label sederhana untuk host ini. Ditampilkan sebagai nama konfigurasi hanya ketika inbound tidak memiliki catatan tersendiri."
},
"remarkVars": {
"title": "Variabel Templat",
"intro": "Klik sebuah variabel untuk menambahkannya. Variabel diganti per klien saat langganan dibuat.",
"preview": "Pratinjau",
"groups": {
"client": "Klien",
"traffic": "Trafik",
"time": "Waktu & status",
"connection": "Koneksi"
},
"descEMAIL": "Email klien",
"descINBOUND": "Catatan inbound itu sendiri (nama konfigurasi)",
"descHOST": "Catatan host",
"descID": "UUID klien",
"descSHORT_ID": "8 karakter pertama dari UUID",
"descTELEGRAM_ID": "ID Telegram klien (kosong jika tidak diatur)",
"descSUB_ID": "ID langganan",
"descCOMMENT": "Komentar klien",
"descTRAFFIC_USED": "Trafik terpakai (mudah dibaca)",
"descTRAFFIC_LEFT": "Trafik tersisa (disembunyikan jika tanpa batas)",
"descTRAFFIC_TOTAL": "Total trafik (disembunyikan jika tanpa batas)",
"descTRAFFIC_USED_BYTES": "Trafik terpakai dalam byte",
"descTRAFFIC_LEFT_BYTES": "Trafik tersisa dalam byte",
"descTRAFFIC_TOTAL_BYTES": "Total trafik dalam byte",
"descUP": "Trafik unggah",
"descDOWN": "Trafik unduh",
"descSTATUS": "aktif / kedaluwarsa / nonaktif / habis",
"descSTATUS_EMOJI": "Status sebagai emoji (✅ ⏳ 🚫)",
"descDAYS_LEFT": "Hari hingga kedaluwarsa (disembunyikan jika tanpa batas)",
"descTIME_LEFT": "Waktu tersisa (mis. 12d 4h 30m)",
"descUSAGE_PERCENTAGE": "Trafik terpakai dalam persentase (disembunyikan jika tanpa batas)",
"descEXPIRE_DATE": "Tanggal kedaluwarsa (YYYY-MM-DD)",
"descJALALI_EXPIRE_DATE": "Tanggal kedaluwarsa dalam kalender Jalali (YYYY/MM/DD)",
"descEXPIRE_UNIX": "Kedaluwarsa sebagai timestamp Unix (detik)",
"descCREATED_UNIX": "Waktu pembuatan sebagai timestamp Unix (detik)",
"descRESET_DAYS": "Periode reset trafik dalam hari",
"descRESET_DAY": "Tanggal perpanjangan setiap bulan",
"descPROTOCOL": "Protokol inbound (VLESS, VMess, Trojan, …)",
"descTRANSPORT": "Jaringan transport (tcp, ws, grpc, …)",
"descSECURITY": "Keamanan transport (TLS, REALITY, NONE)"
},
"toasts": {
"list": "Gagal memuat host",
"obtain": "Gagal memuat host",
"add": "Tambah host",
"update": "Perbarui host",
"delete": "Hapus host",
"badTag": "Tag tidak valid",
"badVlessRoute": "Masukkan satu angka antara 0 dan 65535"
}
}
},
"tgbot": {
"keyboardClosed": "❌ Keyboard ditutup!",
"noResult": "❗ Tidak ada hasil!",
"noQuery": "❌ Kueri tidak ditemukan! Silakan gunakan perintah lagi!",
"wentWrong": "❌ Terjadi kesalahan!",
"noIpRecord": "❗ Tidak ada Catatan IP!",
"noInbounds": "❗ Tidak ada inbound yang ditemukan!",
"unlimited": "♾ Tidak terbatas (Reset)",
"add": "Tambah",
"month": "Bulan",
"months": "Bulan",
"days": "Hari",
"hours": "Jam",
"minutes": "Menit",
"unknown": "Tidak diketahui",
"inbounds": "Inbound",
"clients": "Klien",
"offline": "🔴 Offline",
"online": "🟢 Online",
"commands": {
"unknown": "❗ Perintah tidak dikenal.",
"pleaseChoose": "👇 Harap pilih:\r\n",
"help": "🤖 Selamat datang di bot ini! Ini dirancang untuk menyediakan data tertentu dari panel web dan memungkinkan Anda melakukan modifikasi sesuai kebutuhan.\r\n\r\n",
"start": "👋 Halo <i>{{ .Firstname }}</i>.\r\n",
"welcome": "🤖 Selamat datang di <b>{{.Hostname }}</b> bot managemen.\r\n",
"status": "✅ Bot dalam keadaan baik!",
"usage": "❗ Harap berikan teks untuk mencari!",
"getID": "🆔 ID Anda: <code>{{ .ID }}</code>",
"helpAdminCommands": "Untuk memulai ulang Xray Core:\r\n<code>/restart</code>\r\n\r\nUntuk mencari email klien:\r\n<code>/usage [Email]</code>\r\n\r\nUntuk mencari inbound (dengan statistik klien):\r\n<code>/inbound [Catatan]</code>\r\n\r\nID Obrolan Telegram:\r\n<code>/id</code>",
"helpClientCommands": "Untuk mencari statistik, gunakan perintah berikut:\r\n<code>/usage [Email]</code>\r\n\r\nID Obrolan Telegram:\r\n<code>/id</code>",
"restartUsage": "\r\n\r\n<code>/restart</code>",
"restartSuccess": "✅ Operasi berhasil!",
"restartFailed": "❗ Kesalahan dalam operasi.\r\n\r\n<code>Error: {{ .Error }}</code>.",
"xrayNotRunning": "❗ Xray Core tidak berjalan.",
"startDesc": "Tampilkan menu utama",
"helpDesc": "Bantuan bot",
"statusDesc": "Periksa status bot",
"idDesc": "Tampilkan ID Telegram Anda",
"usageDesc": "Lihat pemakaian klien: /usage email",
"inboundDesc": "Cari inbound: /inbound nama (admin)",
"restartDesc": "Mulai ulang inti Xray (admin)",
"clearallDesc": "Reset trafik semua klien (admin)"
},
"messages": {
"cpuThreshold": "Beban CPU {{ .Percent }}% melebihi batas {{ .Threshold }}%",
"selectUserFailed": "❌ Kesalahan dalam pemilihan pengguna!",
"userSaved": "✅ Pengguna Telegram tersimpan.",
"loginSuccess": "✅ Berhasil masuk ke panel.\r\n",
"loginFailed": "❗️ Gagal masuk ke panel.\r\n",
"report": "🕰 Laporan Terjadwal: {{ .RunTime }}\r\n",
"datetime": "⏰ Tanggal & Waktu: {{ .DateTime }}\r\n",
"hostname": "💻 Host: {{ .Hostname }}\r\n",
"version": "🚀 Versi 3X-UI: {{ .Version }}\r\n",
"xrayVersion": "📡 Versi Xray: {{ .XrayVersion }}\r\n",
"ipv6": "🌐 IPv6: {{ .IPv6 }}\r\n",
"ipv4": "🌐 IPv4: {{ .IPv4 }}\r\n",
"ip": "🌐 IP: {{ .IP }}\r\n",
"ips": "🔢 IP:\r\n{{ .IPs }}\r\n",
"serverUpTime": "⏳ Waktu Aktif: {{ .UpTime }} {{ .Unit }}\r\n",
"serverLoad": "📈 Beban Sistem: {{ .Load1 }}, {{ .Load2 }}, {{ .Load3 }}\r\n",
"serverMemory": "📋 RAM: {{ .Current }}/{{ .Total }}\r\n",
"tcpCount": "🔹 TCP: {{ .Count }}\r\n",
"udpCount": "🔸 UDP: {{ .Count }}\r\n",
"traffic": "🚦 Lalu Lintas: {{ .Total }} (↑{{ .Upload }},↓{{ .Download }})\r\n",
"xrayStatus": "ℹ️ Status: {{ .State }}\r\n",
"username": "👤 Nama Pengguna: {{ .Username }}\r\n",
"reason": "❗️ Alasan: {{ .Reason }}\r\n",
"time": "⏰ Waktu: {{ .Time }}\r\n",
"inbound": "📍 Inbound: {{ .Remark }}\r\n",
"port": "🔌 Port: {{ .Port }}\r\n",
"expire": "📅 Tanggal Kadaluarsa: {{ .Time }}\r\n",
"expireIn": "📅 Kadaluarsa Dalam: {{ .Time }}\r\n",
"active": "💡 Aktif: {{ .Enable }}\r\n",
"enabled": "🚨 Diaktifkan: {{ .Enable }}\r\n",
"online": "🌐 Status Koneksi: {{ .Status }}\r\n",
"lastOnline": "🔙 Terakhir online: {{ .Time }}\r\n",
"email": "📧 Email: {{ .Email }}\r\n",
"upload": "🔼 Unggah: ↑{{ .Upload }}\r\n",
"download": "🔽 Unduh: ↓{{ .Download }}\r\n",
"total": "📊 Total: ↑↓{{ .UpDown }} / {{ .Total }}\r\n",
"TGUser": "👤 Pengguna Telegram: {{ .TelegramID }}\r\n",
"exhaustedCount": "🚨 Jumlah Habis {{ .Type }}:\r\n",
"onlinesCount": "🌐 Klien Online: {{ .Count }}\r\n",
"disabled": "🛑 Dinonaktifkan: {{ .Disabled }}\r\n",
"depleteSoon": "🔜 Habis Sebentar: {{ .Deplete }}\r\n\r\n",
"backupTime": "🗄 Waktu Backup: {{ .Time }}\r\n",
"refreshedOn": "\r\n📋🔄 Diperbarui Pada: {{ .Time }}\r\n\r\n",
"yes": "✅ Ya",
"no": "❌ Tidak",
"received_email": "📧📥 Email diperbarui.",
"received_comment": "💬📥 Komentar diperbarui.",
"email_prompt": "📧 Email Default: {{ .ClientEmail }}\n\nMasukkan email Anda.",
"comment_prompt": "💬 Komentar Default: {{ .ClientComment }}\n\nMasukkan komentar Anda.",
"cancel": "❌ Proses Dibatalkan! \n\nAnda dapat /start lagi kapan saja. 🔄",
"error_add_client": "⚠️ Error:\n\n {{ .error }}",
"using_default_value": "Oke, saya akan tetap menggunakan nilai default. 😊",
"incorrect_input": "Masukan Anda tidak valid.\nFrasa harus berlanjut tanpa spasi.\nContoh benar: aaaaaa\nContoh salah: aaa aaa 🚫",
"AreYouSure": "Apakah kamu yakin? 🤔",
"SuccessResetTraffic": "📧 Email: {{ .ClientEmail }}\n🏁 Hasil: ✅ Berhasil",
"FailedResetTraffic": "📧 Email: {{ .ClientEmail }}\n🏁 Hasil: ❌ Gagal \n\n🛠️ Kesalahan: [ {{ .ErrorMessage }} ]",
"FinishProcess": "🔚 Proses reset traffic selesai untuk semua klien.",
"eventOutboundDown": "Outbound {{ .Tag }} MATI",
"eventOutboundUp": "Outbound {{ .Tag }} AKTIF",
"eventErrorDetail": "Kesalahan: {{ .Error }}",
"eventDelayDetail": "Penundaan: {{ .Delay }}ms",
"eventXrayCrash": "Xray CRASH",
"eventXrayCrashError": "Kesalahan: {{ .Error }}",
"eventNodeDown": "Node {{ .Name }} MATI",
"eventNodeUp": "Node {{ .Name }} AKTIF",
"eventLoginFallback": "Gagal masuk dari {{ .Source }}",
"memoryThreshold": "Penggunaan memori {{ .Percent }}% melebihi ambang batas {{ .Threshold }}%"
},
"buttons": {
"closeKeyboard": "❌ Tutup Papan Ketik",
"cancel": "❌ Batal",
"cancelReset": "❌ Batal Reset",
"cancelIpLimit": "❌ Batal Batas IP",
"confirmResetTraffic": "✅ Konfirmasi Reset Lalu Lintas?",
"confirmClearIps": "✅ Konfirmasi Hapus IPs?",
"confirmRemoveTGUser": "✅ Konfirmasi Hapus Pengguna Telegram?",
"confirmToggle": "✅ Konfirmasi Aktifkan/Nonaktifkan Pengguna?",
"dbBackup": "Dapatkan Cadangan DB",
"serverUsage": "Penggunaan Server",
"getInbounds": "Dapatkan Inbounds",
"depleteSoon": "Habis Sebentar",
"clientUsage": "Dapatkan Penggunaan",
"onlines": "Klien Online",
"commands": "Perintah",
"refresh": "🔄 Perbarui",
"clearIPs": "❌ Hapus IPs",
"removeTGUser": "❌ Hapus Pengguna Telegram",
"selectTGUser": "👤 Pilih Pengguna Telegram",
"selectOneTGUser": "👤 Pilih Pengguna Telegram:",
"resetTraffic": "📈 Reset Lalu Lintas",
"resetExpire": "📅 Ubah Tanggal Kadaluarsa",
"ipLog": "🔢 Log IP",
"ipLimit": "🔢 Batas IP",
"setTGUser": "👤 Set Pengguna Telegram",
"toggle": "🔘 Aktifkan / Nonaktifkan",
"custom": "🔢 Kustom",
"confirmNumber": "✅ Konfirmasi: {{ .Num }}",
"confirmNumberAdd": "✅ Konfirmasi menambahkan: {{ .Num }}",
"limitTraffic": "🚧 Batas Lalu Lintas",
"getBanLogs": "Dapatkan Log Pemblokiran",
"allClients": "Semua Klien",
"addClient": "Tambah Klien",
"submitDisable": "Kirim Sebagai Nonaktif ☑️",
"submitEnable": "Kirim Sebagai Aktif ✅",
"use_default": "🏷️ Gunakan Default",
"change_email": "⚙️📧 Email",
"change_comment": "⚙️💬 Komentar",
"ResetAllTraffics": "Reset Semua Lalu Lintas",
"SortedTrafficUsageReport": "Laporan Penggunaan Lalu Lintas yang Terurut"
},
"answers": {
"successfulOperation": "✅ Operasi berhasil!",
"errorOperation": "❗ Kesalahan dalam operasi.",
"getInboundsFailed": "❌ Gagal mendapatkan inbounds.",
"getClientsFailed": "❌ Gagal mendapatkan klien.",
"canceled": "❌ {{ .Email }}: Operasi dibatalkan.",
"clientRefreshSuccess": "✅ {{ .Email }}: Klien diperbarui dengan berhasil.",
"IpRefreshSuccess": "✅ {{ .Email }}: IP diperbarui dengan berhasil.",
"TGIdRefreshSuccess": "✅ {{ .Email }}: Pengguna Telegram Klien diperbarui dengan berhasil.",
"resetTrafficSuccess": "✅ {{ .Email }}: Lalu lintas direset dengan berhasil.",
"setTrafficLimitSuccess": "✅ {{ .Email }}: Batas lalu lintas disimpan dengan berhasil.",
"expireResetSuccess": "✅ {{ .Email }}: Hari kadaluarsa direset dengan berhasil.",
"resetIpSuccess": "✅ {{ .Email }}: Batas IP {{ .Count }} disimpan dengan berhasil.",
"clearIpSuccess": "✅ {{ .Email }}: IP dihapus dengan berhasil.",
"getIpLog": "✅ {{ .Email }}: Dapatkan Log IP.",
"getUserInfo": "✅ {{ .Email }}: Dapatkan Info Pengguna Telegram.",
"removedTGUserSuccess": "✅ {{ .Email }}: Pengguna Telegram dihapus dengan berhasil.",
"enableSuccess": "✅ {{ .Email }}: Diaktifkan dengan berhasil.",
"disableSuccess": "✅ {{ .Email }}: Dinonaktifkan dengan berhasil.",
"askToAddUserId": "Konfigurasi Anda tidak ditemukan!\r\nSilakan minta admin Anda untuk menggunakan ChatID Telegram Anda dalam konfigurasi Anda.\r\n\r\nChatID Pengguna Anda: <code>{{ .TgUserID }}</code>",
"chooseClient": "Pilih Klien untuk Inbound {{ .Inbound }}",
"chooseInbound": "Pilih Inbound"
}
},
"email": {
"labelStatus": "Status",
"labelOutbound": "Outbound",
"labelNode": "Node",
"labelError": "Kesalahan",
"labelDelay": "Penundaan",
"labelUsername": "Nama Pengguna",
"labelIP": "IP",
"labelReason": "Alasan",
"labelSource": "Sumber",
"statusCrashed": "CRASH",
"statusHigh": "TINGGI",
"statusSuccess": "BERHASIL",
"statusFailed": "GAGAL",
"statusDown": "MATI",
"statusUp": "AKTIF"
}
}
Reference in New Issue View Git Blame Copy Permalink