all: sync with master

internal/home/home.go

@@ -35,8 +35,10 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/version"
 	"github.com/AdguardTeam/dnsproxy/upstream"
 	"github.com/AdguardTeam/golibs/errors"
+	"github.com/AdguardTeam/golibs/hostsfile"
 	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/netutil"
+	"github.com/AdguardTeam/golibs/osutil"
 	"github.com/AdguardTeam/golibs/stringutil"
 	"golang.org/x/exp/slices"
 )
@@ -231,11 +233,12 @@ func setupHostsContainer() (err error) {
 		return fmt.Errorf("initing hosts watcher: %w", err)
 	}
 
-	Context.etcHosts, err = aghnet.NewHostsContainer(
-		aghos.RootDirFS(),
-		hostsWatcher,
-		aghnet.DefaultHostsPaths()...,
-	)
+	paths, err := hostsfile.DefaultHostsPaths()
+	if err != nil {
+		return fmt.Errorf("getting default system hosts paths: %w", err)
+	}
+
+	Context.etcHosts, err = aghnet.NewHostsContainer(osutil.RootDirFS(), hostsWatcher, paths...)
 	if err != nil {
 		closeErr := hostsWatcher.Close()
 		if errors.Is(err, aghnet.ErrNoHostsPaths) {
@@ -357,6 +360,11 @@ func setupDNSFilteringConf(conf *filtering.Config) (err error) {
 	)
 
 	conf.EtcHosts = Context.etcHosts
+	// TODO(s.chzhen):  Use empty interface.
+	if Context.etcHosts == nil {
+		conf.EtcHosts = nil
+	}
+
 	conf.ConfigModified = onConfigModified
 	conf.HTTPRegister = httpRegister
 	conf.DataDir = Context.getDataDir()
@@ -605,7 +613,7 @@ func run(opts options, clientBuildFS fs.FS, done chan struct{}) {
 	Context.auth, err = initUsers()
 	fatalOnError(err)
 
-	Context.tls, err = newTLSManager(config.TLS)
+	Context.tls, err = newTLSManager(config.TLS, config.DNS.ServePlainDNS)
 	if err != nil {
 		log.Error("initializing tls: %s", err)
 		onConfigModified()