Add client source settings to the UI

[L8X]

Prerequisites

• [X] I have checked the Wiki and Discussions and found no answer

• [X] I have searched other issues and found no duplicates

• [X] I want to request a feature or enhancement and not ask a question

Description

What problem are you trying to solve?

I use NGINX on the server my AdGuardHome instance is on, and the hosts file reading feature does not cache if AGH crashes or restarts due to an update, etc, meaning you can't rely on it always using the --no-etc-hosts option passed to it via the service arguments.

NGINX needs entries in /etc/hosts to point to the real IP address of the server, which means that if I'm using Cloudflare or any other proxied CDN provider, my AGH could leak the IP address should a domain be queried.

This is a security risk for Origins that are proxied, and requires a resolution as soon as possible.

Proposed solution

1. De-deprecate --no-etc-hosts and add it to the DNS Settings menu in the AGH Web Panel, so that people using web proxies and CDNs can disallow the reading of their sensitive IP data that /etc/hosts contains.

2. De-deprecate --no-etc-hosts and allow it to be set in the config file only, which would allow it to be cached across system reboots and service restarts, so that people using web proxies and CDNs can disallow the reading of their sensitive IP data that /etc/hosts contains.

Alternatives considered

I tried using DNS rewrites, however this is highly impractical and also generates a security risk because the TTL given downstream is only 10, not that of the original response from the upstream resolver, meaning anyone with a brain can figure out that something is at play here.

There is no other alternative to this, --no-etc-hosts needs to return to AGH for proxied web origins to be safe.

Additional information

N/A

[ainar-g]

Solution №2 is already implemented, and that is documented in the changelog. See clients.runtime_sources.hosts.

Control for client sources in the UI may be coming in one of the next releases. I'll turn this task into a task about that feature, if you don't mind.

[L8X]

Solution №2 is already implemented, and that is documented in the changelog. See clients.runtime_sources.hosts.

Control for client sources in the UI may be coming in one of the next releases. I'll turn this task into a task about that feature, if you don't mind.

Feel free.

[L8X]

bump