all: sync with master; upd chlog

internal/home/home.go

@@ -539,13 +539,13 @@ func fatalOnError(err error) {
 
 // run configures and starts AdGuard Home.
 func run(opts options, clientBuildFS fs.FS, done chan struct{}) {
-	// Configure config filename.
-	initConfigFilename(opts)
-
-	// Configure working dir and config path.
+	// Configure working dir.
 	err := initWorkingDir(opts)
 	fatalOnError(err)
 
+	// Configure config filename.
+	initConfigFilename(opts)
+
 	// Configure log level and output.
 	err = configureLogger(opts)
 	fatalOnError(err)
@@ -674,8 +674,10 @@ func initUsers() (auth *Auth, err error) {
 		log.Info("authratelimiter is disabled")
 	}
 
+	trustedProxies := netutil.SliceSubnetSet(netutil.UnembedPrefixes(config.DNS.TrustedProxies))
+
 	sessionTTL := config.HTTPConfig.SessionTTL.Seconds()
-	auth = InitAuth(sessFilename, config.Users, uint32(sessionTTL), rateLimiter)
+	auth = InitAuth(sessFilename, config.Users, uint32(sessionTTL), rateLimiter, trustedProxies)
 	if auth == nil {
 		return nil, errors.Error("initializing auth module failed")
 	}
@@ -758,11 +760,12 @@ func writePIDFile(fn string) bool {
 }
 
 // initConfigFilename sets up context config file path.  This file path can be
-// overridden by command-line arguments, or is set to default.
+// overridden by command-line arguments, or is set to default.  Must only be
+// called after initializing the workDir with initWorkingDir.
 func initConfigFilename(opts options) {
 	confPath := opts.confFilename
 	if confPath == "" {
-		Context.confFilePath = "AdGuardHome.yaml"
+		Context.confFilePath = filepath.Join(Context.workDir, "AdGuardHome.yaml")
 
 		return
 	}