feat: move acme certificate automation into a plugin (C7)

src/ui/locales/en.json

@@ -1554,7 +1554,7 @@
     "sectionDatabase": "Database",
     "sectionApiKeys": "API Keys",
     "sectionAuditLog": "Audit Log",
-    "sectionSsl": "SSL / Let's Encrypt",
+    "sectionSsl": "HTTPS certificate",
     "sectionBranding": "White Label",
     "brandingAppName": "Application Name",
     "brandingAppNameDesc": "Shown on the login screen and browser tab. Leave empty to use \"Termix\".",
@@ -1567,38 +1567,15 @@
     "brandingLogoInvalid": "Invalid image. Use a PNG, JPEG or WEBP file up to 750 KB.",
     "brandingSaved": "Branding settings saved",
     "brandingSaveFailed": "Failed to save branding settings",
-    "sslDescription": "Automatically issue and renew a trusted SSL certificate from Let's Encrypt. Requires a public domain and port 80 or DNS access.",
+    "sslDescription": "The certificate Termix serves over HTTPS. Upload your own here, or let the ACME Certificates plugin get and renew one from Let's Encrypt.",
     "sslDocsLink": "View SSL docs",
-    "sslDomain": "Domain",
-    "sslDomainPlaceholder": "termix.example.com",
-    "sslDomainDesc": "The public domain name for the certificate.",
-    "sslEmail": "Email",
-    "sslEmailPlaceholder": "admin@example.com",
-    "sslEmailDesc": "Contact email for Let's Encrypt notifications and account.",
-    "sslChallengeType": "Challenge Type",
-    "sslChallengeTypeDesc": "How to prove domain ownership to Let's Encrypt.",
-    "sslChallengeHttp": "HTTP (webroot) - requires port 80 accessible from the internet",
-    "sslChallengeDns": "DNS (Cloudflare) - requires a Cloudflare API token",
-    "sslCloudflareToken": "Cloudflare API Token",
-    "sslCloudflareTokenPlaceholder": "Enter token...",
-    "sslCloudflareTokenDesc": "Scoped token with Zone:DNS:Edit permission for your domain.",
     "sslCertStatus": "Certificate Status",
     "sslCertStatusNone": "No certificate",
     "sslCertStatusValid": "Valid",
     "sslCertStatusExpiring": "Expiring soon",
     "sslCertStatusExpired": "Expired",
     "sslCertExpiresAt": "Expires {{date}}",
-    "sslLastIssued": "Last issued {{date}}",
-    "sslRequestCert": "Issue / Renew Certificate",
-    "sslRequestCertLoading": "Requesting certificate...",
-    "sslRequestCertSuccess": "Certificate issued and installed successfully",
-    "sslRequestCertFailed": "Certificate request failed",
-    "sslSave": "Save Settings",
-    "sslSaved": "SSL settings saved",
-    "sslSaveFailed": "Failed to save SSL settings",
-    "sslRequiresDomain": "Domain and email are required",
     "sslInfoNote": "After issuing or uploading a certificate, Termix will automatically enable HTTPS on SSL_PORT (default 8443) in addition to the existing HTTP port. Make sure that port is published/mapped to this container so it is reachable.",
-    "sslManualOption": "Manual (upload certificate)",
     "sslManualCert": "Certificate (PEM)",
     "sslManualCertPlaceholder": "-----BEGIN CERTIFICATE-----",
     "sslManualKey": "Private Key (PEM)",
@@ -1921,7 +1898,13 @@
     "resetSecondFactorsConfirm": "Remove every second factor for {{username}}? They can sign in with their password or SSO and enrol again.",
     "secondFactorsResetSuccess": "Second factors reset",
     "secondFactorsResetFailed": "Failed to reset second factors",
-    "passwordLoginForced": "Password login is turned off, but no other login method is enabled, so it stays on for now. Nobody gets locked out."
+    "passwordLoginForced": "Password login is turned off, but no other login method is enabled, so it stays on for now. Nobody gets locked out.",
+    "sslNotRenewed": "Nothing renews this certificate. It expires {{date}}. Turn on the ACME Certificates plugin and its automatic renewal, or upload a new one before then.",
+    "sslSelfSigned": "Self-signed certificate made by Termix. Browsers will warn about it.",
+    "sslRenewedBy": "Renewed automatically by {{plugin}}",
+    "sslIssuer": "Issued by {{issuer}}",
+    "sslNames": "Covers {{names}}",
+    "sslManualTitle": "Upload a certificate"
   },
   "newUi": {
     "sidebar": {
@@ -2513,7 +2496,7 @@
       },
       "system:tls": {
         "title": "Manage certificates",
-        "consequence": "It can request and replace the server certificate."
+        "consequence": "It can replace the certificate Termix serves over HTTPS and answer domain checks from certificate authorities."
       },
       "device:serial": {
         "title": "Access serial and USB devices",