client: upd locales

2024-08-07 10:46:09 +05:00
148 changed files with 27469 additions and 29805 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,7 +1,7 @@
 'name': 'build'

 'env':
-  'GO_VERSION': '1.23.2'
+  'GO_VERSION': '1.22.5'
  'NODE_VERSION': '16'

 'on':
@@ -95,7 +95,7 @@
        'key': "${{ runner.os }}-node-${{ hashFiles('client/package-lock.json') }}"
        'restore-keys': '${{ runner.os }}-node-'
    - 'name': 'Set up Snapcraft'
-      'run': 'sudo snap install snapcraft --classic'
+      'run': 'sudo apt-get -yq --no-install-suggests --no-install-recommends install snapcraft'
    - 'name': 'Set up QEMU'
      'uses': 'docker/setup-qemu-action@v1'
    - 'name': 'Set up Docker Buildx'
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,7 +1,7 @@
 'name': 'lint'

 'env':
-  'GO_VERSION': '1.23.2'
+  'GO_VERSION': '1.22.5'

 'on':
  'push':
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,116 +16,35 @@ TODO(a.garipov): Use the common markdown formatting tools.
 ## [Unreleased]

 <!--
-## [v0.107.54] - 2024-10-09 (APPROX.)
+## [v0.108.0] - TBA

-See also the [v0.107.54 GitHub milestone][ms-v0.107.54].
+## [v0.107.53] - 2024-07-24 (APPROX.)

-[ms-v0.107.54]: https://github.com/AdguardTeam/AdGuardHome/milestone/89?closed=1
+See also the [v0.107.53 GitHub milestone][ms-v0.107.53].
+
+[ms-v0.107.53]: https://github.com/AdguardTeam/AdGuardHome/milestone/88?closed=1

 NOTE: Add new changes BELOW THIS COMMENT.
 -->

-### Security
-
- Incorrect handling of sensitive files permissions on Windows ([#7314]).
-
-### Changed
-
- Improved filtering performance ([#6818]).
-
-### Fixed
-
- Repetitive statistics log messages ([#7338]).
- Custom client cache ([#7250]).
- Missing runtime clients with information from the system hosts file on first
-  AdGuard Home start ([#7315]).
-
-[#6818]: https://github.com/AdguardTeam/AdGuardHome/issues/6818
-[#7250]: https://github.com/AdguardTeam/AdGuardHome/issues/7250
-[#7314]: https://github.com/AdguardTeam/AdGuardHome/issues/7314
-[#7315]: https://github.com/AdguardTeam/AdGuardHome/issues/7315
-[#7338]: https://github.com/AdguardTeam/AdGuardHome/issues/7338
-
-<!--
-NOTE: Add new changes ABOVE THIS COMMENT.
-->
-
-
-
-## [v0.107.53] - 2024-10-03
-
-See also the [v0.107.53 GitHub milestone][ms-v0.107.53].
-
-### Security
-
- Previous versions of AdGuard Home allowed users to add any system file it had
-  access to as filters, exposing them to be world-readable.  To prevent this,
-  AdGuard Home now allows adding filtering-rule list files only from files
-  matching the patterns enumerated in the `filtering.safe_fs_patterns` property
-  in the configuration file.
-
-  We thank @itz-d0dgy for reporting this vulnerability, designated
-  CVE-2024-36814, to us.
- Additionally, AdGuard Home will now try to change the permissions of its files
-  and directories to more restrictive ones to prevent similar vulnerabilities
-  as well as limit the access to the configuration.
-
-  We thank @go-compile for reporting this vulnerability, designated
-  CVE-2024-36586, to us.
- Go version has been updated to prevent the possibility of exploiting the Go
-  vulnerabilities fixed in [1.23.2][go-1.23.2].
-
 ### Added

- Support for 64-bit RISC-V architecture ([#5704]).
 - Ecosia search engine is now supported in safe search ([#5009]).

-### Changed
-
- Upstream server URL domain names requirements has been relaxed and now follow
-  the same rules as their domain specifications.
-
-#### Configuration changes
-
-In this release, the schema version has changed from 28 to 29.
-
- The new array `filtering.safe_fs_patterns` contains glob patterns for paths of
-  files that can be added as local filtering-rule lists.  The migration should
-  add list files that have already been added, as well as the default value,
-  `$DATA_DIR/userfilters/*`.
-
 ### Fixed

- Property `clients.runtime_sources.dhcp` in the configuration file not taking
-  effect.
- Stale Google safe search domains list ([#7155]).
- Bing safe search from Edge sidebar ([#7154]).
+- Update Google safe search domains list ([#7155]).
+- Enforce Bing safe search from Edge sidebar ([#7154]).
 - Text overflow on the query log page ([#7119]).

-### Known issues
-
- Due to the complexity of the Windows permissions architecture and poor support
-  from the standard Go library, we have to postpone the proper automated Windows
-  fix until the next release.
-
-  **Temporary workaround:**  Set the permissions of the `AdGuardHome` directory
-  to more restrictive ones manually.  To do that:
-
-  1. Locate the `AdGuardHome` directory.
-  2. Right-click on it and navigate to *Properties → Security → Advanced.*
-  3. (You might need to disable permission inheritance to make them more
-     restricted.)
-  4. Adjust to give the `Full control` access to only the user which runs
-     AdGuard Home.  Typically, `Administrator`.
-
 [#5009]: https://github.com/AdguardTeam/AdGuardHome/issues/5009
-[#5704]: https://github.com/AdguardTeam/AdGuardHome/issues/5704
 [#7119]: https://github.com/AdguardTeam/AdGuardHome/issues/7119
 [#7154]: https://github.com/AdguardTeam/AdGuardHome/pull/7154
 [#7155]: https://github.com/AdguardTeam/AdGuardHome/pull/7155

-[go-1.23.2]:    https://groups.google.com/g/golang-announce/c/NKEc8VT7Fz0
-[ms-v0.107.53]: https://github.com/AdguardTeam/AdGuardHome/milestone/88?closed=1
+<!--
+NOTE: Add new changes ABOVE THIS COMMENT.
+-->



@@ -3163,12 +3082,11 @@ See also the [v0.104.2 GitHub milestone][ms-v0.104.2].


 <!--
-[Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.54...HEAD
-[v0.107.54]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.53...v0.107.54
-->
-
 [Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.53...HEAD
 [v0.107.53]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.52...v0.107.53
+-->
+
+[Unreleased]: https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.52...HEAD
 [v0.107.52]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.51...v0.107.52
 [v0.107.51]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.50...v0.107.51
 [v0.107.50]:  https://github.com/AdguardTeam/AdGuardHome/compare/v0.107.49...v0.107.50
--- a/50
+++ b/50
@@ -8,7 +8,7 @@
 # Makefile.  Bump this number every time a significant change is made to
 # this Makefile.
 #
-# AdGuard-Project-Version: 6
+# AdGuard-Project-Version: 4

 # Don't name these macros "GO" etc., because GNU Make apparently makes
 # them exported environment variables with the literal value of
@@ -23,12 +23,11 @@ VERBOSE.MACRO = $${VERBOSE:-0}
 CHANNEL = development
 CLIENT_DIR = client
 COMMIT = $$( git rev-parse --short HEAD )
-DEPLOY_SCRIPT_PATH = not/a/real/path
 DIST_DIR = dist
 GOAMD64 = v1
-GOPROXY = https://proxy.golang.org|direct
-GOTOOLCHAIN = go1.23.2
-GOTELEMETRY = off
+GOPROXY = https://goproxy.cn|https://proxy.golang.org|direct
+GOSUMDB = sum.golang.google.cn
+GOTOOLCHAIN = go1.22.5
 GPG_KEY = devteam@adguard.com
 GPG_KEY_PASSPHRASE = not-a-real-password
 NPM = npm
@@ -37,7 +36,6 @@ NPM_INSTALL_FLAGS = $(NPM_FLAGS) --quiet --no-progress --ignore-engines\
 	--ignore-optional --ignore-platform --ignore-scripts
 RACE = 0
 SIGN = 1
-SIGNER_API_KEY = not-a-real-key
 VERSION = v0.0.0
 YARN = yarn

@@ -61,27 +59,20 @@ BUILD_RELEASE_DEPS_1 = go-deps
 ENV = env\
 	CHANNEL='$(CHANNEL)'\
 	COMMIT='$(COMMIT)'\
-	DEPLOY_SCRIPT_PATH='$(DEPLOY_SCRIPT_PATH)' \
 	DIST_DIR='$(DIST_DIR)'\
 	GO="$(GO.MACRO)"\
-	GOAMD64='$(GOAMD64)'\
+	GOAMD64="$(GOAMD64)"\
 	GOPROXY='$(GOPROXY)'\
-	GOTELEMETRY='$(GOTELEMETRY)'\
+	GOSUMDB='$(GOSUMDB)'\
 	GOTOOLCHAIN='$(GOTOOLCHAIN)'\
 	GPG_KEY='$(GPG_KEY)'\
 	GPG_KEY_PASSPHRASE='$(GPG_KEY_PASSPHRASE)'\
 	PATH="$${PWD}/bin:$$( "$(GO.MACRO)" env GOPATH )/bin:$${PATH}"\
 	RACE='$(RACE)'\
 	SIGN='$(SIGN)'\
-	SIGNER_API_KEY='$(SIGNER_API_KEY)' \
 	NEXTAPI='$(NEXTAPI)'\
 	VERBOSE="$(VERBOSE.MACRO)"\
-	VERSION="$(VERSION)"\
-
-# Keep the line above blank.
-
-ENV_MISC = env\
-	VERBOSE="$(VERBOSE.MACRO)"\
+	VERSION='$(VERSION)'\

 # Keep the line above blank.

@@ -110,22 +101,23 @@ js-deps:  ; $(NPM) $(NPM_INSTALL_FLAGS) ci
 js-lint:  ; $(NPM) $(NPM_FLAGS) run lint
 js-test:  ; $(NPM) $(NPM_FLAGS) run test

-go-bench:     ; $(ENV) "$(SHELL)"    ./scripts/make/go-bench.sh
-go-build:     ; $(ENV) "$(SHELL)"    ./scripts/make/go-build.sh
-go-deps:      ; $(ENV) "$(SHELL)"    ./scripts/make/go-deps.sh
-go-env:       ; $(ENV) "$(GO.MACRO)" env
-go-fuzz:      ; $(ENV) "$(SHELL)"    ./scripts/make/go-fuzz.sh
-go-lint:      ; $(ENV) "$(SHELL)"    ./scripts/make/go-lint.sh
+go-bench: ; $(ENV) "$(SHELL)" ./scripts/make/go-bench.sh
+go-build: ; $(ENV) "$(SHELL)" ./scripts/make/go-build.sh
+go-deps:  ; $(ENV) "$(SHELL)" ./scripts/make/go-deps.sh
+go-fuzz:  ; $(ENV) "$(SHELL)" ./scripts/make/go-fuzz.sh
+go-lint:  ; $(ENV) "$(SHELL)" ./scripts/make/go-lint.sh
+go-tools: ; $(ENV) "$(SHELL)" ./scripts/make/go-tools.sh
+
 # TODO(a.garipov): Think about making RACE='1' the default for all
 # targets.
-go-test:      ; $(ENV) RACE='1' "$(SHELL)" ./scripts/make/go-test.sh
-go-tools:     ; $(ENV)          "$(SHELL)" ./scripts/make/go-tools.sh
-go-upd-tools: ; $(ENV)          "$(SHELL)" ./scripts/make/go-upd-tools.sh
+go-test:  ; $(ENV) RACE='1' "$(SHELL)" ./scripts/make/go-test.sh
+
+go-upd-tools: ; $(ENV) "$(SHELL)" ./scripts/make/go-upd-tools.sh

 go-check: go-tools go-lint go-test

-# A quick check to make sure that all operating systems relevant to the
-# development of the project can be typechecked and built successfully.
+# A quick check to make sure that all supported operating systems can be
+# typechecked and built successfully.
 go-os-check:
 	env GOOS='darwin'  "$(GO.MACRO)" vet ./internal/...
 	env GOOS='freebsd' "$(GO.MACRO)" vet ./internal/...
@@ -133,11 +125,7 @@ go-os-check:
 	env GOOS='linux'   "$(GO.MACRO)" vet ./internal/...
 	env GOOS='windows' "$(GO.MACRO)" vet ./internal/...

-
 openapi-lint: ; cd ./openapi/ && $(YARN) test
 openapi-show: ; cd ./openapi/ && $(YARN) start

 txt-lint: ; $(ENV) "$(SHELL)" ./scripts/make/txt-lint.sh
-
-md-lint:  ; $(ENV_MISC) "$(SHELL)" ./scripts/make/md-lint.sh
-sh-lint:  ; $(ENV_MISC) "$(SHELL)" ./scripts/make/sh-lint.sh
--- a/README.md
+++ b/README.md
@@ -205,7 +205,7 @@ Run `make init` to prepare the development environment.

 You will need this to build AdGuard Home:

- [Go](https://golang.org/dl/) v1.23 or later;
+- [Go](https://golang.org/dl/) v1.22 or later;
 - [Node.js](https://nodejs.org/en/download/) v18.18 or later;
 - [npm](https://www.npmjs.com/) v8 or later;

--- a/bamboo-specs/release.yaml
+++ b/bamboo-specs/release.yaml
@@ -8,7 +8,7 @@
 'variables':
    'channel': 'edge'
    'dockerFrontend': 'adguard/home-js-builder:2.0'
-    'dockerGo': 'adguard/go-builder:1.23.2--1'
+    'dockerGo': 'adguard/go-builder:1.22.5--1'

 'stages':
  - 'Build frontend':
@@ -91,11 +91,6 @@
    'tasks':
      - 'checkout':
            'force-clean-build': true
-      - 'checkout':
-            'repository': 'bamboo-deploy-publisher'
-            # The paths are always relative to the working directory.
-            'path': 'bamboo-deploy-publisher'
-            'force-clean-build': true
      - 'script':
            'interpreter': 'SHELL'
            'scripts':
@@ -104,9 +99,6 @@

                set -e -f -u -x

-                # Explicitly checkout the revision that we need.
-                git checkout "${bamboo.repository.revision.number}"
-
                # Run the build with the specified channel.
                echo "${bamboo.gpgSecretKeyPart1}${bamboo.gpgSecretKeyPart2}"\
                        | awk '{ gsub(/\\n/, "\n"); print; }'\
@@ -115,8 +107,6 @@
                make\
                        CHANNEL=${bamboo.channel}\
                        GPG_KEY_PASSPHRASE=${bamboo.gpgPassword}\
-                        DEPLOY_SCRIPT_PATH="./bamboo-deploy-publisher/deploy.sh"\
-                        SIGNER_API_KEY="${bamboo.adguardHomeWinSignerSecretApiKey}"\
                        FRONTEND_PREBUILT=1\
                        PARALLELISM=1\
                        VERBOSE=2\
@@ -276,7 +266,7 @@
        'variables':
            'channel': 'beta'
            'dockerFrontend': 'adguard/home-js-builder:2.0'
-            'dockerGo': 'adguard/go-builder:1.23.2--1'
+            'dockerGo': 'adguard/go-builder:1.22.5--1'
    # release-vX.Y.Z branches are the branches from which the actual final
    # release is built.
  - '^release-v[0-9]+\.[0-9]+\.[0-9]+':
@@ -292,4 +282,4 @@
        'variables':
            'channel': 'release'
            'dockerFrontend': 'adguard/home-js-builder:2.0'
-            'dockerGo': 'adguard/go-builder:1.23.2--1'
+            'dockerGo': 'adguard/go-builder:1.22.5--1'
--- a/bamboo-specs/test.yaml
+++ b/bamboo-specs/test.yaml
@@ -6,7 +6,7 @@
    'name': 'AdGuard Home - Build and run tests'
 'variables':
    'dockerFrontend': 'adguard/home-js-builder:2.0'
-    'dockerGo': 'adguard/go-builder:1.23.2--1'
+    'dockerGo': 'adguard/go-builder:1.22.5--1'
    'channel': 'development'

 'stages':
@@ -54,7 +54,6 @@
    'requirements':
      - 'adg-docker': 'true'

-# TODO(e.burkov):  Add the linting stage for markdown docs and shell scripts.
 'Test backend':
    'docker':
        'image': '${bamboo.dockerGo}'
@@ -196,5 +195,5 @@
        # may need to build a few of these.
        'variables':
            'dockerFrontend': 'adguard/home-js-builder:2.0'
-            'dockerGo': 'adguard/go-builder:1.23.2--1'
+            'dockerGo': 'adguard/go-builder:1.22.5--1'
            'channel': 'candidate'
--- a/client/src/__locales/ar.json
+++ b/client/src/__locales/ar.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "استخدم الاستعلامات المتوازية لتسريع عملية الحل عن طريق الاستعلام عن جميع الخوادم المنبع في وقت واحد.",
    "parallel_requests": "الطلبات الموازية",
    "load_balancing": "موازنة الأحمال",
-    "load_balancing_desc": "الاستعلام عن خادم واحد في كل مرة سيستخدم AdGuard  الرئيسية الخوارزمية العشوائية الموزونة لاختيار الخادم بحيث يتم استخدام أسرع خادم في كثير من الأحيان",
    "bootstrap_dns": "خوادم Bootstrap DNS",
    "bootstrap_dns_desc": "عناوين IP لخوادم DNS المستخدمة لحل عناوين IP الخاصة بمحللات DoH/DoT التي تحددها كمصدرين رئيسيين. التعليقات غير مسموح بها.",
    "fallback_dns_title": "خوادم DNS الاحتياطية",
    "fallback_dns_desc": "قائمة الخوادم الاحتياطية المستخدمة في حالة عدم الاستجابة من خوادم DNS الرئيسية. تمتلك تلك الخوادم والخوادم الرئيسية نفس الأوامر.",
    "fallback_dns_placeholder": "أدخل خادم DNS احتياطي واحد لكل سطر",
    "local_ptr_title": "خوادم DNS العكسية الخاصة",
-    "local_ptr_desc": "خوادم DNS التي يستخدمها AdGuard Home لاستعلامات PTR المحلية. تُستخدم هذه الخوادم لحل أسماء المضيفين للعملاء بعناوين IP خاصة ، على سبيل المثال \"192.168.12.34\" ، باستخدام DNS العكسي. في حالة عدم التعيين ، يستخدم AdGuard Home عناوين محللات DNS الافتراضية لنظام التشغيل الخاص بك باستثناء عناوين AdGuard Home نفسها.",
    "local_ptr_default_resolver": "بشكل افتراضي ، يستخدم AdGuard Home محللات DNS العكسية التالية: {{ip}}.",
    "local_ptr_no_default_resolver": "لم يتمكن AdGuard Home من تحديد محللات DNS العكسية المناسبة لهذا النظام.",
    "local_ptr_placeholder": "أدخل عنوان IP واحد لكل سطر",
    "resolve_clients_title": "تفعيل التحليل العكسي لعناوين IP للعملاء",
    "resolve_clients_desc": "حل عكسيًا لعناوين IP للعملاء في أسماء مضيفيهم عن طريق إرسال استعلامات PTR إلى أدوات الحل المقابلة (خوادم DNS الخاصة للعملاء المحليين ، والخوادم الأولية للعملاء الذين لديهم عناوين IP عامة).",
    "use_private_ptr_resolvers_title": "استخدم محللات DNS العكسية الخاصة",
-    "use_private_ptr_resolvers_desc": "قم بإجراء عمليات بحث DNS عكسية عن العناوين التي يتم تقديمها محليًا باستخدام هذه الخوادم الأولية. في حالة التعطيل ، يستجيب AdGuard Home مع NXDOMAIN لجميع طلبات PTR هذه باستثناء العملاء المعروفين من DHCP و / etc / hosts وما إلى ذلك.",
    "check_dhcp_servers": "تحقق من خوادم DHCP",
    "save_config": "حفظ الإعدادات",
    "enabled_dhcp": "خادم DHCP مفعل",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "استخدام خدمة AdGuard للرقابة الأبوية على الويب",
    "use_adguard_parental_hint": "سيتحقق AdGuard Home مما إذا كان النطاق يحتوي على محتوى للبالغين. إنه يستخدم نفس واجهة برمجة التطبيقات الصديقة للخصوصية مثل خدمة الويب الأمنية للتصفح.",
    "enforce_safe_search": "استخدم البحث الآمن",
-    "enforce_save_search_hint": "سيفرض AdGuard Home البحث الآمن في محركات البحث التالية: Google وYouTube وBing وDuckDuckGo وYandex وPixabay.",
    "no_servers_specified": "لم يتم تحديد خوادم",
    "general_settings": "الإعدادات العامة",
    "dns_settings": "إعدادات الـ DNS",
@@ -291,7 +287,7 @@
    "custom_ip": "عنوان IP مخصص",
    "blocking_ipv4": "حجب عنوان IPv4",
    "blocking_ipv6": "حجب عنوان IPv6",
-    "blocked_response_ttl": "حظر استجابة TTL",
+    "blocked_response_ttl": "زمن حظر الاستجابة",
    "blocked_response_ttl_desc": "تحديد عدد الثواني التي يجب على العملاء تخزين الاستجابة التي تمت تصفيتها مؤقتًا",
    "form_enter_blocked_response_ttl": "أدخل وقت الاستجابة المحظورة TTL (بالثواني)",
    "dnscrypt": "DNSCrypt",
@@ -734,10 +730,10 @@
    "thursday": "الخميس",
    "friday": "الجمعة",
    "saturday": "السبت",
-    "sunday_short": "الأحد",
+    "sunday_short": "الاحد",
    "monday_short": "الإثنين",
    "tuesday_short": "الثلاثاء",
-    "wednesday_short": "الأربعاء",
+    "wednesday_short": "الاربعاء",
    "thursday_short": "الخميس",
    "friday_short": "الجمعة",
    "saturday_short": "السبت",
--- a/client/src/__locales/be.json
+++ b/client/src/__locales/be.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Ужыць адначасныя запыты да ўсіх сервераў для паскарэння апрацоўкі запыту",
    "parallel_requests": "Паралельныя запыты",
    "load_balancing": "Размеркаванне нагрузкі",
-    "load_balancing_desc": "Запытвайце па адным серверы за раз. AdGuard Home будзе выкарыстоўваць выпадковы алгарытм для выбару сервера, так што самы хуткі сервер будзе выкарыстоўвацца часцей.",
    "bootstrap_dns": "Bootstrap DNS-серверы",
    "bootstrap_dns_desc": "IP-адрасы DNS-сервераў, якія выкарыстоўваюцца для вырашэння IP-адрасоў распознавальнікаў DoH/DoT, якія вы ўказваеце ў якасці перадачы. Каментары не дапускаюцца.",
    "fallback_dns_title": "Рэзервовыя DNS-серверы",
    "fallback_dns_desc": "Спіс рэзервовых DNS-сервераў, якія выкарыстоўваюцца, калі вышэйшыя DNS-серверы не адказваюць. Сінтаксіс такі ж, як і ў галоўным полі ўверх.",
    "fallback_dns_placeholder": "Увядзіце па адным рэзервовым серверы DNS у радку",
    "local_ptr_title": "Прыватныя DNS-серверы",
-    "local_ptr_desc": "DNS-серверы, якія AdGuard Home выкарыстоўвае для лакальных PTR-запытаў. Гэтыя серверы выкарыстоўваюцца, каб атрымаць даменавыя імёны кліентаў з прыватнымі IP-адрасамі, напрыклад «192.168.12.34», з дапамогай rDNS. Калі спіс пусты, AdGuard Home выкарыстоўвае прадвызначаныя DNS-серверы вашай АС.",
    "local_ptr_default_resolver": "Па змаўчанні AdGuard Home выкарыстоўвае наступныя зваротныя DNS-рэзолверы: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home не змог вызначыць прыдатныя прыватныя адваротныя DNS-рэзолверы для гэтай сістэмы.",
    "local_ptr_placeholder": "Увядзіце па адным адрасе на радок",
    "resolve_clients_title": "Уключыць запытванне даменавых імёнаў для кліентаў",
    "resolve_clients_desc": "AdGuard Home будзе спрабаваць аўтаматычна вызначыць даменавыя імёны кліентаў праз PTR-запыты да адпаведных сервераў (прыватны DNS-сервер для лакальных кліентаў, upstream-серверы для кліентаў з публічным IP-адрасам).",
    "use_private_ptr_resolvers_title": "Ужываць прыватныя адваротныя DNS-рэзолверы",
-    "use_private_ptr_resolvers_desc": "Пасылаць адваротныя DNS-запыты для лакальна абслугоўных адрасоў на паказаныя серверы. Калі адключана, AdGuard Home будзе адказваць NXDOMAIN на ўсе падобныя PTR-запыты, апроч запытаў пра кліентаў, ужо вядомых па DHCP, /etc/hosts і гэтак далей.",
    "check_dhcp_servers": "Праверыць DHCP-серверы",
    "save_config": "Захаваць канфігурацыю",
    "enabled_dhcp": "DHCP-сервер улучаны",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "Ужывайце модуль Бацькоўскага кантролю AdGuard ",
    "use_adguard_parental_hint": "AdGuard Home праверыць, ці ўтрымвае дамен матэрыялы 18+. Ён выкарыстоўвае той жа API для забеспячэння прыватнасці, што і ўэб-служба бяспекі браўзара.",
    "enforce_safe_search": "Узмацніць бяспечны пошук",
-    "enforce_save_search_hint": "AdGuard Home можа забяспечыць бяспечны пошук у наступных пошукавых сістэмах: Google, Youtube, Bing, DuckDuckGo, Yandex і Pixabay.",
    "no_servers_specified": "Не паказаных сервераў",
    "general_settings": "Асноўныя налады",
    "dns_settings": "Налады DNS",
@@ -675,7 +671,6 @@
    "use_saved_key": "Скарыстаць захаваны раней ключ",
    "parental_control": "Бацькоўскі кантроль",
    "safe_browsing": "Бяспечны інтэрнэт",
-    "served_from_cache": "{{value}} <i>(атрымана з кэша)</i>",
    "form_error_password_length": "Пароль павінен утрымліваць ад {{min}} да {{max}} сімвалаў",
    "anonymizer_notification": "<0>Заўвага:</0> Ананімізацыя IP уключана. Вы можаце адключыць яе ў <1>Агульных наладах</1>.",
    "confirm_dns_cache_clear": "Вы ўпэўнены, што хочаце ачысціць кэш DNS?",
--- a/client/src/__locales/bg.json
+++ b/client/src/__locales/bg.json
@@ -65,14 +65,12 @@
    "stats_malware_phishing": "вируси/атаки",
    "stats_adult": "сайтове за възрастни",
    "stats_query_domain": "Най-отваряни страници",
-    "for_last_24_hours": "за последните 24 часа",
    "no_domains_found": "Няма намерени резултати",
    "requests_count": "Сума на заявките",
    "top_blocked_domains": "Най-блокирани страници",
    "top_clients": "Най-активни IP адреси",
    "no_clients_found": "Нямa намерени адреси",
    "general_statistics": "Обща статисика",
-    "number_of_dns_query_24_hours": "Сума на DNS заявки за последните 24 часа",
    "number_of_dns_query_blocked_24_hours": "Сума на блокирани DNS заявки от филтрите за реклама и местни",
    "number_of_dns_query_blocked_24_hours_by_sec": "Сума на блокирани DNS заявки от AdGuard свързани със сигурността",
    "number_of_dns_query_blocked_24_hours_adult": "Сума на блокирани сайтове за възрастни",
@@ -87,7 +85,6 @@
    "use_adguard_parental": "Включи AdGuard Родителски Надзор",
    "use_adguard_parental_hint": "Модул XXX в AdGuard Home ще провери дали страницата има материали за възвъстни. Използва се същия API за анонимност като при модула за Сигурност.",
    "enforce_safe_search": "Включи Безопасно Търсене",
-    "enforce_save_search_hint": "AdGuard Home прилага Безопасно Търсене в следните търсачки и сайтове: Google, Youtube, Bing, и Yandex.",
    "no_servers_specified": "Няма избрани услуги",
    "general_settings": "Общи настройки",
    "custom_filtering_rules": "Местни правила за филтриране",
@@ -159,8 +156,6 @@
    "dns_over_https": "DNS-пред-HTTPS",
    "dns_over_quic": "DNS-over-QUIC",
    "plain_dns": "Обикновен DNS",
-    "theme_light": "Светла тема",
-    "theme_dark": "Тъмна тема",
    "source_label": "Източник",
    "found_in_known_domain_db": "Намерен в списъците с домейни.",
    "category_label": "Категория",
@@ -211,7 +206,6 @@
    "install_devices_android_list_5": "Променете стойностите на DNS 1 и DNS 2 да използват AdGuard Home сървъра.",
    "install_devices_ios_list_1": "От начален екран, цъкнете на Settings.",
    "install_devices_ios_list_2": "Изберете Wi-Fi от лявото меню (там няма възможност за въвеждане на DNS настройки).",
-    "install_devices_ios_list_3": "Клинете на името на активната мрежа към която сте свързани.",
    "install_devices_ios_list_4": "В полето за DNS изберете ръчно и въведете адреса на AdGuard Home сървъра.",
    "get_started": "Да започваме",
    "next": "Следващ",
@@ -222,7 +216,6 @@
    "encryption_config_saved": "Конфигурацията е успешно записана",
    "encryption_server": "Име на сървъра",
    "encryption_server_enter": "Въведете име на домейна",
-    "encryption_server_desc": "За да използвате HTTPS, трябва името на сървъра да съвпада с това на SSL сертификата.",
    "encryption_redirect": "Автоматично пренасочване към HTTPS",
    "encryption_redirect_desc": "Служи за автоматично пренасочване от HTTP към HTTPS на страницата за Администрация в AdGuard Home.",
    "encryption_https": "HTTPS порт",
@@ -285,12 +278,5 @@
    "filter_category_general": "General",
    "filter_category_security": "Сигурност",
    "port_53_faq_link": "Порт 53 често е зает от \"DNSStubListener\" или \"systemd-resolved\" услуги. Моля, прочетете <0>тази инструкция</0> как да решите това.",
-    "parental_control": "Родителски контрол",
-    "sunday_short": "Нд",
-    "monday_short": "Пон",
-    "tuesday_short": "Вт",
-    "wednesday_short": "Ср",
-    "thursday_short": "Чт",
-    "friday_short": "Пт",
-    "saturday_short": "Съб"
+    "parental_control": "Родителски контрол"
 }
--- a/client/src/__locales/de.json
+++ b/client/src/__locales/de.json
@@ -641,7 +641,7 @@
    "show_processed_responses": "Verarbeitet",
    "blocked_safebrowsing": "Gesperrt durch Internetsicherheit",
    "blocked_adult_websites": "Gesperrt durch Kindersicherung",
-    "blocked_threats": "Gesperrte Bedrohungen",
+    "blocked_threats": "Bedrohungen blockiert",
    "allowed": "Zugelassen",
    "filtered": "Gefiltert",
    "rewritten": "Umgeschrieben",
--- a/client/src/__locales/fa.json
+++ b/client/src/__locales/fa.json
@@ -5,21 +5,17 @@
    "upstream_parallel": "استفاده از جستار موازی برای سرعت دادن به تفکیک با جستار همزمان همه جریان های ارسالی",
    "parallel_requests": "درخواست های موازی",
    "load_balancing": "متعادل کننده بار",
-    "load_balancing_desc": "یک سرور بالادستی را در یک زمان پرس و جو کنید. AdGuard Home از الگوریتم تصادفی وزنی خود برای انتخاب سرور استفاده می کند تا سریع ترین سرور بیشتر مورد استفاده قرار گیرد.",
    "bootstrap_dns": "خودراه انداز سرورهای DNS",
    "bootstrap_dns_desc": "آدرس‌های IP سرورهای DNS که برای حل کردن آدرس‌های IP حل‌کننده‌های DoH/DoT که به‌عنوان upstream مشخص می‌کنید، استفاده می‌شوند. اظهار نظر مجاز نیست.",
    "fallback_dns_title": "سرورهای DNS بازگشتی",
    "fallback_dns_desc": "لیست سرورهای DNS بازگشتی که در زمانی که سرورهای DNS بالادستی پاسخ نمی‌دهند استفاده می‌شوند. نحو مانند فیلد بالادستی اصلی بالا است.",
    "fallback_dns_placeholder": "یک سرور DNS بازگشتی در هر خط وارد کنید",
    "local_ptr_title": "سرورهای خصوصی DNS",
-    "local_ptr_desc": "سرور یا سرور های DNS ای که AdGuard Home برای درخواست های منابع محلی ارائه شده مورد استفاده قرار خواهد داد. برای مثال، این سرور برای تعیین نام های سرویس دهنده برای سرویس گیرنده با آدرس های آی پی خصوصی مورد استفاده قرار خواهد گرفت. اگر تعیین نشود،AdGuard Home به طور خودکار از تعیین کننده ی DNS پیش فرض شما استفاده خواهد کرد.",
    "local_ptr_default_resolver": "به طور پیش فرض، AdGuard Home از تعیین کننده های DNS معکوس زیر استفاده می کند: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home نتوانست برای این دستگاه تعیین کننده های DNS معکوس محرمانه مناسب را معین کند.",
-    "local_ptr_placeholder": "در هر خط یک آدرس سرور را وارد کنید",
    "resolve_clients_title": "فعال سازی تعیین نام های سرویس دهنده ی سرویس گیرندگان",
    "resolve_clients_desc": "در صورت فعال بودن،AdGuard Home به طور خودکار اقدام به تعیین نام های سرویس دهنده ی سرویس گیرندگان از آدرس های آی پی با ارسال یک درخواست PTR به یک تعیین کننده ی همتا خواهد کرد (سرور خصوصی DNS برای سرویس گیرندگان محلی،سرور مادر برای سرویس گیرندگان با آی پی عمومی).",
    "use_private_ptr_resolvers_title": "از تعیین کننده های rDNS محرمانه استفاده کنید",
-    "use_private_ptr_resolvers_desc": "داده گیری های دی ان اس معکوس را برای آدرس های اینترنتی خدمات منظقه ای با استفاده از سرور های مادر اجرا کنید. چنانچه غیر فعال باشد،AdGuard Home با NXDOMAIN به همه چنین درخواست های PTR پاسخ می دهد به استثناء خدمات گیرنده های شناخته شده از طرف DHCP،/و غیره/هوست ها، و سایر.",
    "check_dhcp_servers": "بررسی برای سرورهای DHCP",
    "save_config": "ذخیره پیکربندی",
    "enabled_dhcp": "سرور DHCP  فعال شده است",
@@ -117,7 +113,6 @@
    "stats_malware_phishing": "بدافزار/فیشینگ مسدود شده است",
    "stats_adult": "وبسایت غیراخلاقی مسدود شده است",
    "stats_query_domain": "دامنه جستار بالا",
-    "for_last_24_hours": "برای 24 ساعت گذشته",
    "for_last_days": "برای {{count}} روز آخر",
    "for_last_days_plural": "برای {{count}} روز گذشته",
    "stats_disabled": "آمار غیرفعال شده است. شما می توانید از قسمت <0>صفحه تنظیمات</0> آن را روشن نمایید.",
@@ -132,7 +127,6 @@
    "no_upstreams_data_found": "هیچ اطلاعاتی در مورد سرورهای بالادست یافت نشد",
    "number_of_dns_query_days": "تعداد جستار DNS پردازش شده در {{count}} روز آخر",
    "number_of_dns_query_days_plural": "تعداد جستار DNS پردازش شده در {{count}} روز گذشته",
-    "number_of_dns_query_24_hours": "تعداد جستار DNS پردازش شده در 24 ساعت گذشته",
    "number_of_dns_query_blocked_24_hours": "تعداد درخواست DNS مسدود شده با فیلترهای مسدودساز تبلیغ و لیست سیاه میزبان",
    "number_of_dns_query_blocked_24_hours_by_sec": "تعداد درخواست DNS مسدود شده با مدل امنیت وب گردی AdGuard",
    "number_of_dns_query_blocked_24_hours_adult": "تعداد وبسایت های غیر اخلاقی مسدود شده",
@@ -147,7 +141,6 @@
    "use_adguard_parental": "از سرویس وب نظارت والدین AdGuard استفاده کن",
    "use_adguard_parental_hint": "AdGuard Home بررسی می کند اگر دامنه حاوی موارد غیر اخلاقی است.آن از همان اِی پی آی دارای حریم خصوصی سرویس وب امنیت وب گردی استفاده می کند.",
    "enforce_safe_search": "اجبار جستجوی اَمن",
-    "enforce_save_search_hint": "AdGuard Home میتواند جستجوی اَمن را در موتور جستجوهای زیر اعمال کند:گوگل،یوتوب،بینگ و یاندکس",
    "no_servers_specified": "سروری تعیین نشده است",
    "general_settings": "تنظیمات عمومی",
    "dns_settings": "تنظیمات DNS",
@@ -430,7 +423,6 @@
    "client_confirm_delete": "آیا واقعا میخواهید \"{{key}}\" کلاینت را حذف کنید؟",
    "list_confirm_delete": "آیا واقعا میخواهید این لیست را حذف کنید؟",
    "auto_clients_title": "کلاینت ها (زمان اِجرا)",
-    "auto_clients_desc": "داده در کلاینت ها که از AdGuard Home استفاده می کند،اما در پیکربندی ذخیره نمی شود",
    "access_title": "تنظیمات دسترسی",
    "access_desc": "در اینجا میتوانید دستورات دسترسی را برای DNS سرور AdGuard Home وارد کنید.",
    "access_allowed_title": "کلاینت های مجاز",
@@ -594,7 +586,6 @@
    "use_saved_key": "از کلید ذخیره شده قبلی استفاده کنید",
    "parental_control": "نظارت والدین",
    "safe_browsing": "وب گردی اَمن",
-    "form_error_password_length": "رمزعبور باید حداقل {{value}} کاراکتر باشد.",
    "protection_section_label": "حفاظت",
    "log_and_stats_section_label": "گزارش پرس و جو و آمار",
    "ignore_query_log": "این مشتری را در گزارش پرس و جو نادیده بگیرید",
--- a/client/src/__locales/fi.json
+++ b/client/src/__locales/fi.json
@@ -6,7 +6,6 @@
    "upstream_parallel": "Käytä rinnakkaisia pyyntöjä ja nopeuta selvitystä käyttämällä kaikkia ylävirtapalvelimia samanaikaisesti.",
    "parallel_requests": "Rinnakkaiset pyynnöt",
    "load_balancing": "Kuormantasaus",
-    "load_balancing_desc": "Lähetä kysely kerrallaan yhdelle ylävirtapalvelimelle. AdGuard Home valitsee painotetun satunnaisalgoritmin avulla palvelimet, joilla on vähiten epäonnistuneita hakuja ja keskimääräisesti lyhin hakuaika.",
    "bootstrap_dns": "Bootstrap DNS-palvelimet",
    "bootstrap_dns_desc": "Ylävirroiksi määrittämiesi DoH/DoT-resolverien IP-osoitteiden selvitykseen käytettävien DNS-palvelimien IP-osoitteet. Kommentteja ei sallita.",
    "fallback_dns_title": "DNS-varapalvelimet",
@@ -154,7 +153,6 @@
    "use_adguard_parental": "Käytä AdGuardin lapsilukko-palvelua",
    "use_adguard_parental_hint": "AdGuard Home tarkistaa, sisältääkö verkkotunnus aikuisille tarkoitettua sisältöä. Se käyttää samaa tietosuojapainotteista rajapintaa, kuin turvallisen selauksen palvelu.",
    "enforce_safe_search": "Käytä turvallista hakua",
-    "enforce_save_search_hint": "AdGuard Home pakottaa turvallisen haun käyttöön seuraavissa hakukoneissa: Google, YouTube, Bing, DuckDuckGo, Ecosia, Yandex ja Pixabay.",
    "no_servers_specified": "Palvelimia ei ole määritetty",
    "general_settings": "Yleiset asetukset",
    "dns_settings": "DNS-asetukset",
--- a/client/src/__locales/hr.json
+++ b/client/src/__locales/hr.json
@@ -6,7 +6,6 @@
    "upstream_parallel": "Koristi paralelne upite kako bi ubrzali rješavanje istovremenim ispitavanjem svih upstream poslužitelja.",
    "parallel_requests": "Paralelni zahtjevi",
    "load_balancing": "Load-balancing",
-    "load_balancing_desc": "Pitajte jedan po jedan uzvodni poslužitelj. AdGuard Home koristi svoj ponderirani slučajni algoritam za odabir poslužitelja tako da se najbrži poslužitelj koristi češće.",
    "bootstrap_dns": "Bootstrap DNS poslužitelji",
    "bootstrap_dns_desc": "IP adrese DNS poslužitelja koji se koriste za rješavanje IP adresa DoH/DoT razrjeđivača koje navedete kao uzvodne. Komentari nisu dopušteni.",
    "fallback_dns_title": "Rezervni DNS poslužitelji",
@@ -154,7 +153,6 @@
    "use_adguard_parental": "Koristi web uslugu AdGuard roditeljske zaštite",
    "use_adguard_parental_hint": "AdGuard Home provjeriti će sadrži li domena sadržaj za odrasle. Koristi isti API za zaštitu privatnosti kao i naša usluga zaštite pregledavanja.",
    "enforce_safe_search": "Koristi sigurno pretraživanje",
-    "enforce_save_search_hint": "AdGuard Home provodit će sigurno pretraživanje u sljedećim tražilicama: Google, YouTube, Bing, DuckDuckGo, Yandex, Pixabay.",
    "no_servers_specified": "Nije odabran nijedan poslužitelj",
    "general_settings": "Opće postavke",
    "dns_settings": "DNS postavke",
--- a/client/src/__locales/hu.json
+++ b/client/src/__locales/hu.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Használjon párhuzamos lekéréseket a domainek feloldásának felgyorsításához az összes upstream kiszolgálóra való egyidejű lekérdezéssel.",
    "parallel_requests": "Párhuzamos lekérések",
    "load_balancing": "Terheléselosztás",
-    "load_balancing_desc": "Egyszerre csak egy szerverről történjen lekérdezés. Az AdGuard Home egy súlyozott, véletlenszerű algoritmust fog használni a megfelelő szerver kiválasztására, így a leggyorsabb szervert fogja a leggyakrabban használni.",
    "bootstrap_dns": "Bootstrap DNS kiszolgálók",
    "bootstrap_dns_desc": "A DNS-kiszolgálók IP-címei, amelyek a DoH/DoT-feloldók IP-címeinek feloldására szolgálnak, amelyeket upstreamként megadott. Megjegyzések nem megengedettek.",
    "fallback_dns_title": "Tartalék DNS-szerverek",
    "fallback_dns_desc": "Azoknak a tartalék DNS-szervereknek a listája, amelyeket akkor használnak, ha a felsőbbrendű DNS-szerverek nem válaszolnak. A szintaxis ugyanaz, mint a fő felsőbbrendű mezőben.",
    "fallback_dns_placeholder": "Adjon meg egy alternatív DNS szervert soronként",
    "local_ptr_title": "Privát DNS szerverek",
-    "local_ptr_desc": "Azok a DNS szerverek, amiket az AdGuard Home a helyi PTR kérésekhez használ. ",
    "local_ptr_default_resolver": "Alapesetben az AdGuard Home a következő reverse DNS feloldókat használja: {{ip}}.",
    "local_ptr_no_default_resolver": "Az AdGuard Home nem tudta meghatározni a privát reverse DNS feloldókat ehhez a rendszerhez.",
    "local_ptr_placeholder": "Adjon meg egy IP-címet soronként",
    "resolve_clients_title": "Kliensek IP címeinek fordított feloldása",
    "resolve_clients_desc": "Fordítva oldja fel a kliensek IP címeit a hosztneveikre azáltal, hogy PTR lekérdezéseket küld a megfelelő feloldóknak (privát DNS szerverek a helyi kliensek számára, upstream szerverek a nyilvános IP címmel rendelkező kliensek számára).",
    "use_private_ptr_resolvers_title": "Privát reverse DNS feloldók használata",
-    "use_private_ptr_resolvers_desc": "Reverse DNS keresések végzése a helyileg kiszolgált címekre ezeknek a szervereknek a használatával. Ha le van tiltva, az AdGuard Home az NXDOMAIN használatával válaszol minden ilyen PTR kérésre, kivéve azokat a klienseket, amelyeket már ismer a DHCP, /etc/hosts, stb. által.",
    "check_dhcp_servers": "DHCP szerverek keresése",
    "save_config": "Konfiguráció mentése",
    "enabled_dhcp": "DHCP szerver engedélyezve",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "Használja az AdGuard szülői felügyelet webszolgáltatását",
    "use_adguard_parental_hint": "Az AdGuard Home ellenőrzi, hogy a domain tartalmaz-e felnőtteknek szóló anyagokat. Ugyanazokat az adatvédelmi API-kat használja, mint a böngésző biztonsági webszolgáltatás.",
    "enforce_safe_search": "Biztonságos keresés használata",
-    "enforce_save_search_hint": "Az AdGuard Home a következő keresőmotorokban biztosíthatja a biztonságos keresést: Google, Youtube, Bing, DuckDuckGo, Yandex és Pixabay.",
    "no_servers_specified": "Nincsenek megadott kiszolgálók",
    "general_settings": "Általános beállítások",
    "dns_settings": "DNS beállítások",
@@ -675,7 +671,6 @@
    "use_saved_key": "Előzőleg mentett kulcs használata",
    "parental_control": "Szülői felügyelet",
    "safe_browsing": "Biztonságos böngészés",
-    "served_from_cache": "{{value}} <i>(gyorsítótárból kiszolgálva)</i>",
    "form_error_password_length": "A jelszó legyen {{min}} és {{max}} karakter között",
    "anonymizer_notification": "<0>Megjegyzés:</0> Az IP anonimizálás engedélyezve van. Az <1>Általános beállításoknál letilthatja</1> .",
    "confirm_dns_cache_clear": "Biztos benne, hogy törölni szeretné a DNS-gyorsítótárat?",
--- a/client/src/__locales/id.json
+++ b/client/src/__locales/id.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Gunakan kueri paralel untuk mempercepat resoluasi dengan menanyakan semua server upstream secara bersamaan",
    "parallel_requests": "Permintaan paralel",
    "load_balancing": "Penyeimbang beban",
-    "load_balancing_desc": "Permintaan satu server pada satu waktu. AdGuard Home akan menggunakan algoritma acak tertimbang untuk memilih server sehingga server tercepat akan lebih sering digunakan.",
    "bootstrap_dns": "Server DNS bootstrap",
    "bootstrap_dns_desc": "Alamat IP server DNS yang digunakan untuk menyelesaikan alamat IP resolver DoH/DoT yang Anda tentukan sebagai upstream. Komentar tidak diizinkan.",
    "fallback_dns_title": "Server DNS cadangan",
    "fallback_dns_desc": "Daftar server DNS cadangan yang digunakan ketika server hulu DNS tidak merespons. Sintaksnya sama dengan kolom hulu utama di atas.",
    "fallback_dns_placeholder": "Masukkan satu server DNS cadangan per baris",
    "local_ptr_title": "Server pembalik DNS pribadi",
-    "local_ptr_desc": "Server DNS yang digunakan AdGuard Home untuk kueri PTR lokal. Server ini digunakan untuk menyelesaikan nama host klien dengan alamat IP pribadi, misalnya \"192.168.12.34\", menggunakan DNS terbalik. Jika tidak disetel, AdGuard Home menggunakan alamat resolver DNS default OS Anda kecuali untuk alamat AdGuard Home itu sendiri.",
    "local_ptr_default_resolver": "Secara bawaan, AdGuard Home menggunakan pemecah DNS terbalik: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home tidak dapat menentukan pemecah DNS terbalik yang sesuai untuk sistem ini.",
    "local_ptr_placeholder": "Masukkan satu alamat IP per baris",
    "resolve_clients_title": "Aktifkan resolusi hostname klien",
    "resolve_clients_desc": "Menyelesaikan alamat IP klien secara terbalik ke nama host mereka dengan mengirimkan kueri PTR ke resolver yang sesuai (server DNS pribadi untuk klien lokal, server upstream untuk klien dengan alamat IP publik).",
    "use_private_ptr_resolvers_title": "Gunakan server pembalik DNS pribadi",
-    "use_private_ptr_resolvers_desc": "Lakukan pencarian DNS terbalik untuk alamat yang disajikan secara lokal menggunakan server hulu ini. Jika dinonaktifkan, Adguard Home merespons dengan NXDOMAIN untuk semua permintaan PTR tersebut kecuali untuk klien yang diketahui dari DHCP, /etc/hosts, dan seterusnya.",
    "check_dhcp_servers": "Cek untuk server DHCP",
    "save_config": "Simpan pengaturan",
    "enabled_dhcp": "Server DHCP diaktifkan",
@@ -72,13 +69,11 @@
    "dhcp_error": "AdGuard Home tidak dapat menentukan apakah ada server DHCP aktif lain pada jaringan",
    "dhcp_static_ip_error": "Jika ingin menggunakan server DHCP, alamat IP statis harus diatur. AdGuard Home gagal menentukan jika antarmuka jaringan ini dikonfigurasi menggunakan alamat IP statis. Silakan atur alamat IP statis secara manual.",
    "dhcp_dynamic_ip_found": "Sistem Anda menggunakan konfigurasi alamat IP dinamis untuk antarmuka <0>{{interfaceName}}</0>. Untuk menggunakan server DHCP, alamat IP statis harus ditetapkan. Alamat IP Anda saat ini adalah <0>{{ipAddress}}</0>. AdGuard Home akan secara otomatis menetapkan alamat IP ini sebagai statis jika Anda menekan tombol Aktifkan DHCP.",
-    "dhcp_lease_added": "Static lease \"{{key}}\" berhasil ditambahkan",
    "dhcp_lease_deleted": "Static lease \"{{key}}\" berhasil dihapus",
    "dhcp_lease_updated": "Static lease \"{{key}}\" berhasil diperbarui",
    "dhcp_new_static_lease": "Static lease baru",
    "dhcp_edit_static_lease": "Mengedit static lease",
    "dhcp_static_leases_not_found": "DHCP static lease tidak ditemukan",
-    "dhcp_add_static_lease": "Tambah static lease",
    "dhcp_reset_leases": "Atur ulang semua kontrak",
    "dhcp_reset_leases_confirm": "Apakah Anda yakin ingin mengatur ulang kontrak Anda?",
    "dhcp_reset_leases_success": "Kontrak DHCP berhasil diatur ulang",
@@ -154,7 +149,6 @@
    "use_adguard_parental": "Gunakan layanan web kontrol orang tua AdGuard",
    "use_adguard_parental_hint": "AdGuard Home akan mengecek jika domain mengandung materi dewasa. Akan menggunakan API yang ramah privasi yang sama sebagai layanan web keamanan penjelajahan.",
    "enforce_safe_search": "Pakai pencarian aman",
-    "enforce_save_search_hint": "AdGuard Home dapat memaksa penelusuran aman pada mesin pencari berikut: Google, Youtube, Bing, DuckDuckGo, Yandex, dan Pixabay.",
    "no_servers_specified": "Sever tidak disebutkan",
    "general_settings": "Pengaturan umum",
    "dns_settings": "Pengaturan DNS",
@@ -678,7 +672,6 @@
    "use_saved_key": "Gunakan kunci yang disimpan sebelumnya",
    "parental_control": "Pengawasan Orang Tua",
    "safe_browsing": "Penjelajahan Aman",
-    "served_from_cache": "{{value}} <i>(disajikan dari cache)</i>",
    "form_error_password_length": "Kata sandi harus terdiri dari {{min}} hingga {{max}}",
    "anonymizer_notification": "<0>Catatan:</0> Anonimisasi IP diaktifkan. Anda dapat menonaktifkannya di <1>Pengaturan umum</1> .",
    "confirm_dns_cache_clear": "Apakah Anda yakin ingin menghapus cache DNS?",
--- a/client/src/__locales/nl.json
+++ b/client/src/__locales/nl.json
@@ -676,7 +676,7 @@
    "filter_allowlist": "WAARSCHUWING: Deze actie zal ook de regel \"{{disallowed_rule}}\" uitsluiten van de lijst met toegestane clients.",
    "last_rule_in_allowlist": "Kan deze client niet weigeren omdat het uitsluiten van de regel \"{{disallowed_rule}}\" de lijst \"Toegestane clients\" zal UITSCHAKELEN.",
    "use_saved_key": "De eerder opgeslagen sleutel gebruiken",
-    "parental_control": "Ouderlijk toezicht",
+    "parental_control": "Ouderlijk Toezicht ",
    "safe_browsing": "Veilig browsen",
    "served_from_cache_label": "Geleverd vanuit cache",
    "form_error_password_length": "Wachtwoord moet {{min}} tot {{max}} tekens lang zijn",
--- a/client/src/__locales/no.json
+++ b/client/src/__locales/no.json
@@ -5,17 +5,14 @@
    "upstream_parallel": "Bruk parallele forespørsler for å få oppfarten på behandlinger, ved å forespørre til alle oppstrømstjenerne samtidig",
    "parallel_requests": "Parallelle forespørsler",
    "load_balancing": "Pågangstrykk-utjevning",
-    "load_balancing_desc": "Forespør én tjener om gangen. AdGuard Home vil bruke en 'vektlagt tilfeldig valg'-algoritme for å velge tjener, slik at den raskeste tjeneren blir brukt oftere.",
    "bootstrap_dns": "Bootstrap-DNS-tjenere",
    "bootstrap_dns_desc": "IP-adresser til DNS-servere som brukes til å løse IP-adresser til DoH/DoT-løsere du spesifiserer som oppstrøms. Kommentarer er ikke tillatt.",
    "fallback_dns_title": "Reserve DNS-servere",
    "fallback_dns_desc": "Liste over reserve-DNS-servere som brukes når oppstrøms DNS-servere ikke svarer. Syntaksen er den samme som i hovedoppstrømsfeltet ovenfor.",
    "fallback_dns_placeholder": "Angi én reserve-DNS-server per linje",
    "local_ptr_title": "Private DNS-tjenere",
-    "local_ptr_desc": "DNS-tjenerne som AdGuard Home bruker for lokale PTR-spørringer. Disse tjenerne brukes til å løse vertsnavnene til klienter med private IP-adresser, for eksempel \"192.168.12.34\", ved bruk av omvendt DNS. Hvis det ikke er angitt, bruker AdGuard Home adressene til standard-DNS-løserne til operativsystemet ditt, bortsett fra adressene til selve AdGuard Home.",
    "local_ptr_default_resolver": "Som standard, bruker AdGuard Home følgende revers-DNS-oppletere: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home klarte ikke å finne egnede private revers-DNS-oppletere for dette systemet.",
-    "local_ptr_placeholder": "Skriv inn én tjeneradresse per linje",
    "resolve_clients_title": "Skru på revers-oppleting av klienters IP-adresser",
    "use_private_ptr_resolvers_title": "Bruk private omvendte DNS-løsere",
    "check_dhcp_servers": "Se etter DHCP-tjenere",
@@ -106,7 +103,6 @@
    "stats_malware_phishing": "Blokkert skadevare/phishing",
    "stats_adult": "Blokkerte voksennettsteder",
    "stats_query_domain": "Mest forespurte domener",
-    "for_last_24_hours": "de siste 24 timene",
    "for_last_days": "for den siste {{count}} dagen",
    "for_last_days_plural": "de siste {{count}} dagene",
    "stats_disabled": "Statistikkene har blitt skrudd av. Du kan skru den på fra <0>innstillingssiden</0>.",
@@ -121,7 +117,6 @@
    "no_upstreams_data_found": "Ingen oppstrøms servere data funnet",
    "number_of_dns_query_days": "Antall DNS-spørringer behandlet for de siste {{count}} dagene",
    "number_of_dns_query_days_plural": "Antall DNS-forespørsler som ble behandlet de siste {{count}} dagene",
-    "number_of_dns_query_24_hours": "Antall DNS-forespørsler som ble behandlet de siste 24 timene",
    "number_of_dns_query_blocked_24_hours": "Antall DNS-forespørsler som ble blokkert av adblock-filtre, hosts-lister, og domene-lister",
    "number_of_dns_query_blocked_24_hours_by_sec": "Antall DNS-forespørsler som ble blokkert av AdGuard sin nettlesersikkerhetsmodul",
    "number_of_dns_query_blocked_24_hours_adult": "Antall voksennettsteder som ble blokkert",
@@ -137,7 +132,6 @@
    "use_adguard_parental": "Benytt AdGuard sin foreldrekontroll-nettjeneste",
    "use_adguard_parental_hint": "AdGuard Home vil sjekke om domenet inneholder erotisk materiale. Den benytter den samme privatlivsvennlige API-en som nettlesersikkerhetstjenesten.",
    "enforce_safe_search": "Påtving barnevennlige søk",
-    "enforce_save_search_hint": "AdGuard Home kan fremtvinge \"Safe Search\" i de følgende søkemotorene: Google, YouTube, Bing, DuckDuckGo, Yandex, og Pixabay.",
    "no_servers_specified": "Ingen tjenere er spesifisert",
    "general_settings": "Generelle innstillinger",
    "dns_settings": "DNS-innstillinger",
@@ -627,7 +621,6 @@
    "use_saved_key": "Bruk den tidligere lagrede nøkkelen",
    "parental_control": "Foreldrekontroll",
    "safe_browsing": "Sikker surfing",
-    "served_from_cache": "{{value}} <i>(formidlet fra mellomlageret)</i>",
    "theme_dark_desc": "Mørkt tema",
    "theme_light_desc": "Lyst tema",
    "disable_notify_until_tomorrow": "Deaktiver beskyttelsen til i morgen",
--- a/client/src/__locales/pl.json
+++ b/client/src/__locales/pl.json
@@ -6,7 +6,6 @@
    "upstream_parallel": "Użyj zapytań równoległych, aby przyspieszyć rozwiązywanie przez jednoczesne wysyłanie zapytań do wszystkich serwerów nadrzędnych.",
    "parallel_requests": "Równoległe żądania",
    "load_balancing": "Równoważenie obciążenia",
-    "load_balancing_desc": "Zapytaj jeden serwer nadrzędny na raz. AdGuard Home używa ważonego, losowego algorytmu do wybierania serwerów z najmniejszą liczbą nieudanych wyszukiwań i najniższym uśrednionym czasem wyszukiwania.",
    "bootstrap_dns": "Serwery DNS Bootstrap",
    "bootstrap_dns_desc": "Adresy IP serwerów DNS używanych do rozpoznawania adresów IP programów rozpoznawania nazw DoH/DoT określonych jako nadrzędne. Komentarze są niedozwolone.",
    "fallback_dns_title": "Rezerwowe serwery DNS",
@@ -154,7 +153,6 @@
    "use_adguard_parental": "Użyj usługi Kontrola Rodzicielska AdGuard",
    "use_adguard_parental_hint": "AdGuard Home sprawdzi, czy domena zawiera materiały dla dorosłych. Używa tego samego interfejsu API przyjaznego prywatności, co usługa sieciowa Bezpieczne Przeglądanie. ",
    "enforce_safe_search": "Użyj bezpiecznego wyszukiwania",
-    "enforce_save_search_hint": "AdGuard Home wymusza bezpieczne wyszukiwanie w następujących wyszukiwarkach: Google, YouTube, Bing, DuckDuckGo, Ecosia, Yandex, Pixabay.",
    "no_servers_specified": "Nie określono serwerów",
    "general_settings": "Ustawienia główne",
    "dns_settings": "Ustawienia DNS",
--- a/client/src/__locales/ro.json
+++ b/client/src/__locales/ro.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Folosiți interogări paralele pentru a accelera rezolvarea, interogând simultan toate serverele în amonte.",
    "parallel_requests": "Solicitări paralele",
    "load_balancing": "Echilibrare-sarcini",
-    "load_balancing_desc": "Interoghează câte un server în amonte la un moment dat. AdGuard Home utilizează un algoritm de randomizare ponderat pentru a alege serverul, astfel încât cel mai rapid server să fie utilizat mai des.",
    "bootstrap_dns": "Serverele DNS Bootstrap",
    "bootstrap_dns_desc": "Adresele IP ale serverelor DNS utilizate pentru a rezolva adresele IP ale soluțiilor DoH/DoT pe care le specificați ca fiind în amonte. Comentariile nu sunt permise.",
    "fallback_dns_title": "Servere DNS de rezervă",
    "fallback_dns_desc": "Lista serverelor DNS de rezervă utilizate atunci când serverele DNS din amonte nu răspund. Sintaxa este aceeași ca în câmpul principal din amonte de mai sus.",
    "fallback_dns_placeholder": "Introduceți un server DNS de rezervă pe linie",
    "local_ptr_title": "Servere DNS inverse private",
-    "local_ptr_desc": "Serverele DNS pe care AdGuard Home le utilizează pentru interogările PTR locale. Aceste servere sunt utilizate pentru a rezolva solicitările PTR pentru adrese din intervale IP private, de exemplu „192.168.12.34”, utilizând DNS invers. Dacă nu este configurat, AdGuard Home utilizează adresele rezolvatorilor DNS impliciți ai sistemului dvs. de operare, cu excepția adreselor AdGuard Home în sine.",
    "local_ptr_default_resolver": "În mod implicit, AdGuard Home utilizează următorii rezolvatori DNS inverși: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home nu a putut determina rezolvatorii DNS privați adecvați pentru acest sistem.",
    "local_ptr_placeholder": "Introduceți o adresă IP per linie",
    "resolve_clients_title": "Permiteți rezolvarea inversa a adreselor IP ale clienților",
    "resolve_clients_desc": "Rezolvă invers adresele IP ale clienților în numele lor de gazde prin trimiterea interogărilor PTR la rezolvatorii corespunzători (servere DNS private pentru clienți locali, servere în amonte pentru clienți cu adrese IP publice).",
    "use_private_ptr_resolvers_title": "Utilizați rezolvatori DNS inverși privați",
-    "use_private_ptr_resolvers_desc": "Efectuează examinări DNS inverse pentru adresele deservite local folosind aceste servere în amonte. Dacă este dezactivată, AdGuard Home răspunde cu NXDOMAIN la toate aceste cereri PTR, cu excepția clienților cunoscuți din DHCP, /etc/hosts și așa mai departe.",
    "check_dhcp_servers": "Căutați servere DHCP",
    "save_config": "Salvare configurare",
    "enabled_dhcp": "Server DHCP activat",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "Utilizați Controlul Parental AdGuard",
    "use_adguard_parental_hint": "AdGuard Home va verifica pentru conținut adult pe domeniu. Utilizează același API discret ca cel utilizat de serviciul de securitate de navigare.",
    "enforce_safe_search": "Folosiți Căutarea Sigură",
-    "enforce_save_search_hint": "AdGuard Home va impune Căutarea Sigură în următoarele motoare de căutare: Google, YouTube, Bing, DuckDuckGo, Yandex, Pixabay.",
    "no_servers_specified": "Nu sunt specificate servere",
    "general_settings": "Setări Generale",
    "dns_settings": "Setări DNS",
@@ -675,7 +671,6 @@
    "use_saved_key": "Folosiți cheia salvată anterior",
    "parental_control": "Control Parental",
    "safe_browsing": "Navigare în siguranță",
-    "served_from_cache": "{{value}} <i>(furnizat din cache)</i>",
    "form_error_password_length": "Parola trebuie să aibă între {{min}} și {{max}} caractere",
    "anonymizer_notification": "<0>Nota:</0> Anonimizarea IP este activată. Puteți să o dezactivați în <1>Setări generale</1>.",
    "confirm_dns_cache_clear": "Sunteți sigur că doriți să ștergeți memoria cache DNS?",
--- a/client/src/__locales/si-lk.json
+++ b/client/src/__locales/si-lk.json
@@ -4,10 +4,8 @@
    "parallel_requests": "සමාන්තර ඉල්ලීම්",
    "load_balancing": "ධාරිතාව තුලනය",
    "local_ptr_title": "පෞද්ගලික ප්‍රතිවර්ත ව.නා.ප. සේවාදායක",
-    "local_ptr_desc": "ස්ථානීය PTR විමසුම් සඳහා ඇඩ්ගාර්ඩ් හෝම් භාවිතා කරන ව.නා.ප. සේවාදායක. මෙම සේවාදායක පුද්ගලික අ.ජා.කෙ. ලිපින පරාසවල PTR විමසුම් විසඳීමට භාවිතා කරයි, උදාහරණයක් ලෙස ප්‍රතිවර්ත ව.නා.ප. භාවිතයෙන් \"192.168.12.34\". මෙය සකසා නැති නම්, ඇඩ්ගාර්ඩ් හෝම් හි ලිපින සඳහා හැරුනු විට ඔබගේ මෙහෙයුම් පද්ධතියේ පෙරනිමි ව.නා.ප. විසදුම්වල ලිපින භාවිතා කරයි.",
    "local_ptr_default_resolver": "පෙරනිමි පරිදි, ඇඩ්ගාර්ඩ් හෝම් පහත ප්‍රතිවර්ත ව.නා.ප. පිළිවිසඳු භාවිතා කරයි: {{ip}}.",
    "local_ptr_no_default_resolver": "ඇඩ්ගාර්ඩ් හෝම් හට මෙම පද්ධතිය සඳහා සුදුසු පුද්ගලික ප්‍රතිවර්ත ව.නා.ප. පිළිවිසඳු නිශ්චය කරගත නොහැකි විය.",
-    "local_ptr_placeholder": "පේළියකට එක් සේවාදායක ලිපිනය බැගින් යොදන්න",
    "resolve_clients_title": "අනුග්‍රාහකවල අ.ජා.කෙ. ලිපින ප්‍රතිවර්ත විසඳීම සබල කරන්න",
    "use_private_ptr_resolvers_title": "පෞද්. ප්‍රතිවර්ත ව.නා.ප. පිළිවිසඳු භාවිතය",
    "check_dhcp_servers": "ග.ධා.වි.කෙ. සේවාදායක පරීක්‍ෂා කරන්න",
@@ -102,7 +100,6 @@
    "stats_malware_phishing": "අවහිර කළ ද්වේශාංග/තතුබෑම්",
    "stats_adult": "අවහිර කළ වැඩිහිටි වියමන අඩවි",
    "stats_query_domain": "ප්‍රචලිත විමසන ලද වසම්",
-    "for_last_24_hours": "පසුගිය පැය 24 සඳහා",
    "for_last_days": "පසුගිය දවස් {{count}} සඳහා",
    "for_last_days_plural": "පසුගිය දවස් {{count}} සඳහා",
    "stats_disabled": "සංඛ්‍යාලේඛන අබල කර ඇත. එය <0>සැකසුම් පිටුවෙන්</0> සබල කළ හැකිය.",
@@ -115,7 +112,6 @@
    "general_statistics": "පොදු සංඛ්‍යාලේඛන",
    "number_of_dns_query_days": "පසුගිය දවස් {{count}} සඳහා සැකසූ ව.නා.ප. විමසුම් ගණන",
    "number_of_dns_query_days_plural": "පසුගිය දවස් {{count}} සඳහා සැකසූ ව.නා.ප. විමසුම් ගණන",
-    "number_of_dns_query_24_hours": "පසුගිය පැය 24 සඳහා සැකසූ ව.නා.ප. විමසුම් ගණන",
    "number_of_dns_query_blocked_24_hours": "දැන්වීම් වාරණ පෙරහන් සහ සත්කාරක වාරණ ලැයිස්තු මගින් අවහිර කළ ව.නා.ප. ඉල්ලීම් ගණන",
    "number_of_dns_query_blocked_24_hours_by_sec": "ඇඩ්ගාර්ඩ් පිරික්සුම් ආරක්‍ෂණ ඒකකය මගින් අවහිර කළ ව.නා.ප. ඉල්ලීම් ගණන",
    "number_of_dns_query_blocked_24_hours_adult": "අවහිර කළ වැඩිහිටි වියමන අඩවි ගණන",
@@ -130,7 +126,6 @@
    "use_adguard_parental": "ඇඩ්ගාර්ඩ් දෙමාපිය පාලන වියමන සේවාව භාවිතා කරන්න",
    "use_adguard_parental_hint": "වසමේ වැඩිහිටියන්ට අදාල කරුණු අඩංගු දැයි ඇඩ්ගාර්ඩ් හෝම් විසින් පරීක්‍ෂා කරනු ඇත. එය පිරික්සුම් ආරක්‍ෂණ වියමන සේවාව මෙන් රහස්‍යතා හිතකාමී යෙ.ක්‍ර. අ.මු. (API) භාවිතා කරයි.",
    "enforce_safe_search": "ආරක්‍ෂිත සෙවුම භාවිතා කරන්න",
-    "enforce_save_search_hint": "ඇඩ්ගාර්ඩ් හෝම් පහත සෙවුම් යන්ත්‍ර තුළ ආරක්‍ෂිත සෙවුම බලාත්මක කරනු ඇත: ගූගල්, යූටියුබ්, බින්ග්, ඩක්ඩක්ගෝ, යාන්ඩෙක්ස් සහ පික්සාබේ.",
    "no_servers_specified": "සේවාදායක කිසිවක් නිශ්චිතව දක්වා නැත",
    "general_settings": "පොදු සැකසුම්",
    "dns_settings": "ව.නා.ප. සැකසුම්",
@@ -505,8 +500,6 @@
    "statistics_enable": "සංඛ්‍යාලේඛන සබල කරන්න",
    "ignore_domains": "නොසලකන වසම් (පේළියකට එක බැගින්)",
    "ignore_domains_title": "නොසලකන වසම්",
-    "ignore_domains_desc_stats": "සංඛ්‍යාලේඛනයෙහි මෙම වසම් සඳහා විමසුම් නොලියැවෙයි",
-    "ignore_domains_desc_query": "විමසුම් සටහනෙහි මෙම වසම් සඳහා විමසුම් නොලියැවෙයි",
    "interval_hours": "පැය {{count}}",
    "interval_hours_plural": "පැය {{count}}",
    "filters_configuration": "පෙරහන් වින්‍යාසය",
@@ -615,8 +608,6 @@
    "use_saved_key": "පෙර සුරැකි යතුර භාවිතා කරන්න",
    "parental_control": "දෙමාපිය පාලනය",
    "safe_browsing": "ආරක්‍ෂිත පිරික්සුම",
-    "served_from_cache": "{{value}} <i>(නිහිතයෙන් ගැනිණි)</i>",
-    "form_error_password_length": "මුරපදය අවම වශයෙන් අකුරු {{value}} ක් දිගු විය යුතුමයි",
    "anonymizer_notification": "<0>සටහන:</0> අ.ජා.කෙ. නිර්නාමිකකරණය සබලයි. ඔබට එය <1>පොදු සැකසුම්</1> හරහා අබල කිරීමට හැකිය .",
    "confirm_dns_cache_clear": "ඔබට ව.නා.ප. නිහිතය හිස් කිරීමට වුවමනාද?",
    "cache_cleared": "ව.නා.ප. නිහිතය හිස් කෙරිණි",
--- a/client/src/__locales/sk.json
+++ b/client/src/__locales/sk.json
@@ -484,7 +484,7 @@
    "access_disallowed_title": "Nepovolení klienti",
    "access_disallowed_desc": "Zoznam CIDR, IP adries alebo <a>ClientID</a>. Ak tento zoznam obsahuje položky, AdGuard Home zruší dopyty od týchto klientov. Toto pole sa ignoruje, ak sú v poli Povolení klienti položky.",
    "access_blocked_title": "Nepovolené domény",
-    "access_blocked_desc": "Nesmie byť zamieňaná s filtrami. AdGuard Home zruší DNS dopyty, ktoré sa zhodujú s týmito doménami, a tieto dopyty sa nezobrazia ani v denníku dopytov. Môžete určiť presné názvy domén, zástupné znaky alebo pravidlá filtrácie URL adries, napr. \"example.org\", \"*.example.org\" alebo ||example.org^\" zodpovedajúcim spôsobom.",
+    "access_blocked_desc": "Nesmie byť zamieňaná s filtrami. AdGuard Home zruší DNS dopyty, ktoré sa zhodujú s týmito doménami, a tieto dopyty sa nezobrazia ani v denníku dopytov. Môžete určiť presné názvy domén, zástupné znaky alebo pravidlá filtrovania URL adries, napr. \"example.org\", \"*.example.org\" alebo ||example.org^\" zodpovedajúcim spôsobom.",
    "access_settings_saved": "Nastavenia prístupu úspešne uložené",
    "updates_checked": "K dispozícii je nová verzia aplikácie AdGuard Home\n",
    "updates_version_equal": "AdGuard Home je aktuálny",
--- a/client/src/__locales/sl.json
+++ b/client/src/__locales/sl.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Uporabite vzporedne zahteve za pospešitev reševanja s hkratnim poizvedovanjem vseh gorvodnih strežnikov.",
    "parallel_requests": "Vzporedne zahteve",
    "load_balancing": "Uravnavanje obremenitve",
-    "load_balancing_desc": "Poizvedujte po enem strežniku navzgor. AdGuard Home s pomočjo tehtanega naključnega algoritma izbere strežnik, tako da se najpogosteje uporablja najhitrejši strežnik.",
    "bootstrap_dns": "Zagonski DNS strežniki",
    "bootstrap_dns_desc": "Naslovi IP strežnikov DNS, ki se uporabljajo za razreševanje naslovov IP razreševalcev DoH/DoT, ki jih določite kot navzgor. Komentarji niso dovoljeni.",
    "fallback_dns_title": "Rezervni strežniki DNS",
    "fallback_dns_desc": "Seznam rezervnih strežnikov DNS, ki se uporabljajo, ko se gorvodni strežniki DNS ne odzivajo. Sintaksa je enaka kot v zgornjem gorvodnem polju.",
    "fallback_dns_placeholder": "Vnesite en rezervni strežnik DNS na vrstico",
    "local_ptr_title": "Zasebni povratni strežniki DNS",
-    "local_ptr_desc": "Strežniki DNS, ki jih AdGuard Home uporablja za lokalne PTR poizvedbe. Ti strežniki se uporabljajo za reševanje zahtev PTR za naslove v zasebnih obsegih IP, na primer \"192.168.12.34\", z uporabo obratnega DNS. Če ni nastavljen, AdGuard Home uporablja naslove privzetih razreševalnikov DNS vašega OS, razen naslovov samega AdGuard Home.",
    "local_ptr_default_resolver": "AdGuard Home privzeto uporablja te povratne razreševalnike DNS: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home ni mogel določiti ustreznih zasebnih povratnih reševalcev DNS za ta sistem.",
    "local_ptr_placeholder": "Vnesite en naslov IP na vrstico",
    "resolve_clients_title": "Omogoči obratno reševanje naslovov IP gostiteljev",
    "resolve_clients_desc": "Povratno razrešite naslove IP odjemalcev v njihova gostiteljska imena, tako da pošljete poizvedbe PTR ustreznim razreševalcem (zasebni strežniki DNS za lokalne odjemalce, gorvodni strežniki za odjemalce z javnimi naslovi IP).",
    "use_private_ptr_resolvers_title": "Uporabi zasebne povratne razreševalnike rDNS",
-    "use_private_ptr_resolvers_desc": "Opravi povratne preglede DNS za lokalno vročene naslove s pomočjo teh strežnikov. Če je AdGuard onemogočen, se z NXDOMAIN odzove na vse takšne zahteve PTR, razen za odjemalce, znane iz DHCP/etc/hosts itd.",
    "check_dhcp_servers": "Preveri strežnike DHCP",
    "save_config": "Shrani nastavitve",
    "enabled_dhcp": "Strežnik DHCP je omogočen",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "Uporabi AdGuardovo spletno storitev 'Starševski nadzor'",
    "use_adguard_parental_hint": "AdGuard Home bo preveril, če domena vsebuje  vsebine za odrasle. Uporablja enako, za zasebnost prijazen API, kot spletno storitev za varnost brskanja.",
    "enforce_safe_search": "Uporabi Varno iskanje",
-    "enforce_save_search_hint": "AdGuard Home bo vsilil varno iskanje v naslednjih iskalnikih: Google, YouTube, Bing, DuckDuckGo, Yandex, Pixabay.",
    "no_servers_specified": "Ni določenih strežnikov",
    "general_settings": "Splošne nastavitve",
    "dns_settings": "Nastavitve DNS",
--- a/client/src/__locales/sr-cs.json
+++ b/client/src/__locales/sr-cs.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Koristite paralelne upite da biste ubrzali rešavanje tako što ćete istovremeno ispitati sve uzvodne servere.",
    "parallel_requests": "Paralelni zahtevi",
    "load_balancing": "Load-balancing",
-    "load_balancing_desc": "Koristi jedan upstream server. AdGuard Home koristi najnoviji nasumični algoritam da izabere server tako da se najbrži server češće koristi.",
    "bootstrap_dns": "Bootstrap DNS serveri",
    "bootstrap_dns_desc": "IP adrese DNS servera koje se koriste za rešavanje IP adresa DoH/DoT razrešivača koje navodite kao uzvodne. Komentari nisu dozvoljeni.",
    "fallback_dns_title": "Odstupajući DNS serveri",
    "fallback_dns_desc": "Lista povratnih DNS servera koji se koriste kada se uzvodni DNS serveri ne odaziva. Sintaksa je ista kao u glavnom uzvodnom polju iznad.",
    "fallback_dns_placeholder": "Unesite jedan povratni DNS server po liniji",
    "local_ptr_title": "Private reverse DNS serveri",
-    "local_ptr_desc": "DNS serveri koje AdGuard Home koristi za lokalne PTR upite. Ovi serveri se koriste za rešavanje imena domaćina klijenata sa privatnim IP adresama, na primer \"192.168.12.34\", koristeći obrnuti DNS. Ako nije podešen, AdGuard Home koristi adrese podrazumevanih DNS razrešivača vašeg OS-a osim adresa samog AdGuard Home-a.",
    "local_ptr_default_resolver": "Podrazumevano, AdGuard Home koristi sledeće obrnute DNS razrešivače: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home ne može da odredi pogodne privatne obrnute DNS razrešivače za ovaj sistem.",
    "local_ptr_placeholder": "Unesite jednu IP adresu servera po redu",
    "resolve_clients_title": "Uključi obrnuto razrešavanje klijentskih IP adresa",
    "resolve_clients_desc": "Obrnuto razrešite IP adrese klijenata u njihova imena domaćina slanjem PTR upita odgovarajućim razrešivačima (privatni DNS serveri za lokalne klijente, uzvodni serveri za klijente sa javnim IP adresama).",
    "use_private_ptr_resolvers_title": "Koristi privatne obrnute razrešivače",
-    "use_private_ptr_resolvers_desc": "Izvršavanje obrnutih DNS izgleda za lokalno servirane adrese pomoću ovih uzvodnih servera. Ako je onemogućen, AdGuard Home odgovara sa NXDOMAIN na sve takve PTR zahteve osim klijenata poznatih iz DHCP- a, /etc/hosts itd.",
    "check_dhcp_servers": "Proveri DHCP servere",
    "save_config": "Sačuvaj konfiguraciju",
    "enabled_dhcp": "DHCP server uključen",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "Koristi AdGuard-ovu uslugu roditeljske kontrole",
    "use_adguard_parental_hint": "AdGuard Home će proveriti da li domen sadrži sadržaj za odrasle. Koristi se isti privatni prijateljski API kao i kod usluge bezbednog pregledanja.",
    "enforce_safe_search": "Nametni sigurno pretraživanje",
-    "enforce_save_search_hint": "AdGuard Home može nametnuti sigurno pretraživanje u sledećim pretraživačima: Google, Youtube, Bing, DuckDuckGo i Yandex.",
    "no_servers_specified": "Serveri nisu određeni",
    "general_settings": "Opšte postavke",
    "dns_settings": "DNS postavke",
@@ -675,7 +671,6 @@
    "use_saved_key": "Koristi prethodno sačuvan ključ",
    "parental_control": "Roditeljska kontrola",
    "safe_browsing": "Sigurno pregledanje",
-    "served_from_cache": "{{value}} <i>(posluženo iz predmemorije)</i>",
    "form_error_password_length": "Lozinka mora imati od {{min}} do {{max}} znakova",
    "anonymizer_notification": "<0>Nota:</0> IP prepoznavanje je omogućeno. Možete ga onemogućiti u opštim <1>postavkama</1>.",
    "confirm_dns_cache_clear": "Želite li zaista da obrišite DNS keš?",
--- a/client/src/__locales/sv.json
+++ b/client/src/__locales/sv.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Använd parallella förfrågningar för att snabba upp dessa genom att fråga alla uppströmsservrar samtidigt.",
    "parallel_requests": "Parallella förfrågningar",
    "load_balancing": "Lastbalansering",
-    "load_balancing_desc": "Fråga en uppströmsserver åt gången. AdGuard Home använder sin viktade slumpmässiga algoritm för att välja server så att den snabbaste servern används oftare.",
    "bootstrap_dns": "Bootstrap-DNS-servrar",
    "bootstrap_dns_desc": "IP-adresser för DNS-servrar som används för att lösa IP-adresser för de DoH/DoT-resolvers som du anger som uppströms. Kommentarer är inte tillåtna.",
    "fallback_dns_title": "Reserv DNS-servrar",
    "fallback_dns_desc": "Lista över reserv-DNS-servrar som används när uppströms DNS-servrar inte svarar. Syntaxen är densamma som i huvuduppströmsfältet ovan.",
    "fallback_dns_placeholder": "Ange en reserv-DNS-server per rad",
    "local_ptr_title": "Privata omvända DNS-servrar",
-    "local_ptr_desc": "DNS servrarna som AdGuard Home använder för lokala PTR frågor. Dessa servrar används för att lösa värdnamnen på klienter med privata IP-adresser, till exempel \"192.168.12.34\", genom omvänd DNS. Om inga servrar angetts använder AdGuard Home adresserna till standard DNS servrar för ditt operativsystem förutom adresserna till AdGuard Home själv.",
    "local_ptr_default_resolver": "Som standard använder AdGuard Home följande omvända DNS upplösare: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home kunde inte fastställa lämpliga privata omvända DNS upplösare för detta system.",
    "local_ptr_placeholder": "Ange en IP-adress per rad",
    "resolve_clients_title": "Aktivera omvänd upplösning av klienters IP-adresser",
    "resolve_clients_desc": "Lös upp klienternas värdnamn med omvänt uppslag av klienternas IP-adresser genom att skicka PTR-frågor till motsvarande upplösare (privata DNS-servrar för lokala klienter, uppströmsservrar för klienter med offentliga IP-adresser).",
    "use_private_ptr_resolvers_title": "Använd privata omvända DNS upplösare",
-    "use_private_ptr_resolvers_desc": "Utför omvända DNS-sökningar för lokalt betjänade adresser med dessa uppströmsservrar. Om det är inaktiverat svarar AdGuard Home med NXDOMAIN på alla sådana PTR-förfrågningar förutom klienter kända från DHCP, /etc/hosts, och så vidare.",
    "check_dhcp_servers": "Letar efter DHCP-servrar",
    "save_config": "Spara konfiguration",
    "enabled_dhcp": "DHCP-server aktiverad",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "Använda AdGuards webbservice för föräldrakontroll",
    "use_adguard_parental_hint": "AdGuard Home kommer att kontrollera domäner för innehåll av vuxenmaterial . Samma integritetsvänliga metod för  API-lookup som tillämpas i webbservicens surfsäkerhet används.",
    "enforce_safe_search": "Använd SafeSearch",
-    "enforce_save_search_hint": "AdGuard Home kommer tvinga säker surf på följande sökmotorer: Google, Youtube, Bing, DuckDuckGo, Yandex, Pixabay.",
    "no_servers_specified": "Inga servrar angivna",
    "general_settings": "Allmänna inställningar",
    "dns_settings": "DNS-inställningar",
@@ -674,7 +670,6 @@
    "use_saved_key": "Använd den tidigare sparade nyckeln",
    "parental_control": "Föräldrakontroll",
    "safe_browsing": "Säker surfning",
-    "served_from_cache": "{{value}} <i>(levereras från cache)</i>",
    "form_error_password_length": "Lösenordet måste vara {{min}} till {{max}} tecken långt",
    "anonymizer_notification": "<0>Observera:</0> IP-anonymisering är aktiverad. Du kan inaktivera den i <1>Allmänna inställningar</1>.",
    "confirm_dns_cache_clear": "Är du säker på att du vill rensa DNS-cache?",
--- a/client/src/__locales/th.json
+++ b/client/src/__locales/th.json
@@ -1,7 +1,6 @@
 {
    "client_settings": "การตั้งค่าไคลเอนต์",
    "bootstrap_dns": "Bootstrap เซิร์ฟเวอร์ DNS",
-    "bootstrap_dns_desc": "เซิร์ฟเวอร์ Bootstrap DNS ใช้เพื่อแก้ไขที่อยู่ IP ของตัวแก้ไข DoH / DoT ที่คุณระบุว่าเป็น upstreams",
    "check_dhcp_servers": "ตรวจสอบ DHCP servers",
    "enabled_dhcp": "เปิดการใช้งาน DHCP server แล้ว",
    "disabled_dhcp": "ปิดการใช้งาน DHCP server แล้ว",
@@ -13,13 +12,6 @@
    "dhcp_leases": "สัญญาเช่า DHCP",
    "dhcp_static_leases": "DHCP แบบกำหนด",
    "dhcp_leases_not_found": "ไม่พบสัญญาเช่า DHCP",
-    "form_error_required": "ช่องที่ต้องกรอก",
-    "form_error_ip4_format": "รูปแบบ IPv4 ไม่ถูกต้อง",
-    "form_error_ip6_format": "รูปแบบ IPv6 ไม่ถูกต้อง",
-    "form_error_ip_format": "รูปแบบ IP ไม่ถูกต้อง",
-    "form_error_mac_format": "รูปแบบ MAC ไม่ถูกต้อง",
-    "form_error_client_id_format": "รูปแบบ ID ลูกค้าไม่ถูกต้อง",
-    "form_error_positive": "ต้องมากกว่า 0",
    "dhcp_form_gateway_input": "IP ของเกตเวย์",
    "dhcp_form_subnet_input": "ซับเน็ตมาสก์",
    "dhcp_form_range_title": "ช่วงของที่อยู่ IP",
@@ -46,7 +38,6 @@
    "settings": "การตั้งค่า",
    "filters": "ตัวกรอง",
    "query_log": "บันทึกการสืบค้น",
-    "nothing_found": "ไม่พบอะไร",
    "faq": "คำถามที่พบบ่อย",
    "version": "รุ่น",
    "address": "ที่อยู่",
@@ -55,7 +46,6 @@
    "copyright": "ลิขสิทธิ์",
    "homepage": "หน้าหลัก",
    "report_an_issue": "รายงานปัญหา",
-    "privacy_policy": "นโยบายความเป็นส่วนตัว",
    "enable_protection": "เปิดใช้งานการป้องกัน",
    "enabled_protection": "เปิดใช้งานการป้องกันแล้ว",
    "disable_protection": "ปิดใช้งานการป้องกัน",
@@ -66,7 +56,6 @@
    "stats_malware_phishing": "ปิดกั้นมัลแวร์/ฟิชชิ่ง แล้ว",
    "stats_adult": "ปิดกั้นเว็บไซต์สำหรับผู้ใหญ่แล้ว",
    "stats_query_domain": "โดเมนที่เข้าบ่อยสุด",
-    "for_last_24_hours": "ในช่วง 24 ชั่วโมงที่ผ่านมา",
    "for_last_days": "สำหรับ {{count}} วันสุดท้าย",
    "for_last_days_plural": "สำหรับ {{count}} วันล่าสุด",
    "no_domains_found": "ไม่พบโดเมน",
@@ -81,10 +70,8 @@
    "block_domain_use_filters_and_hosts": "ปิดกั้นโดเมนโดยใช้ตัวกรองและไฟล์โฮสต์",
    "filters_block_toggle_hint": "คุณสามารถตั้งค่ากฎการปิดกั้นในการตั้งค่า<a>ตัวกรอง</a>",
    "use_adguard_browsing_sec": "ใช้บริการเว็บการรักษาความปลอดภัยการเรียกดู AdGuard",
-    "use_adguard_browsing_sec_hint": "AdGuard Home จะตรวจสอบว่าโดเมนอยู่ในรายการที่ไม่อนุญาตโดยเว็บเซอร์วิสความปลอดภัยการสืบค้นหรือไม่ จะใช้ API การค้นหาที่เป็นมิตรกับข้อมูลส่วนบุคคลเพื่อทำการตรวจสอบ: มีการส่งคำนำหน้าสั้น ๆ ของชื่อโดเมน SHA256 แฮชไปยังเซิร์ฟเวอร์",
    "use_adguard_parental": "ใช้บริการเว็บการควบคุมโดยผู้ปกครองของ AdGuard",
    "use_adguard_parental_hint": "AdGuard Home จะตรวจสอบว่าโดเมนมีเนื้อหาสำหรับผู้ใหญ่หรือไม่ มันใช้ API ความเป็นส่วนตัวเช่นเดียวกับบริการเว็บการรักษาความปลอดภัยการท่องเว็บ",
-    "enforce_safe_search": "บังคับใช้การค้นหาที่ปลอดภัย",
    "no_servers_specified": "ไม่ได้ระบุเซิร์ฟเวอร์",
    "general_settings": "การตั้งค่าทั่วไป",
    "dns_settings": "การตั้งค่า DNS",
@@ -97,12 +84,6 @@
    "apply_btn": "นำไปใช้",
    "disabled_filtering_toast": "ปิดใช้งานการกรอง",
    "enabled_filtering_toast": "เปิดใช้งานการกรอง",
-    "disabled_safe_browsing_toast": "ปิดใช้งานการเรียกดูอย่างปลอดภัย",
-    "enabled_safe_browsing_toast": "เปิดการใช้งาน safebrowsing",
-    "disabled_parental_toast": "ปิดใช้งานการควบคุมโดยผู้ปกครอง",
-    "enabled_parental_toast": "เปิดการใช้งานเข้าเว็บไม่พึงประสงค์",
-    "disabled_safe_search_toast": "ปิดใช้งานการค้นหาที่ปลอดภัย",
-    "enabled_save_search_toast": "เปิดใช้งานการค้นหาที่ปลอดภัย",
    "enabled_table_header": "เปิดใช้งาน",
    "name_table_header": "ชื่อ",
    "rules_count_table_header": "กฎการนับ",
@@ -117,18 +98,6 @@
    "custom_filter_rules": "กฎการกรองที่กำหนดเอง",
    "custom_filter_rules_hint": "ป้อนหนึ่งกฎในหนึ่งบรรทัด คุณสามารถใช้กฎปิดกั้นโฆษณาหรือโฮสต์ไฟล์ไวยากรณ์",
    "examples_title": "ตัวอย่าง",
-    "example_meaning_filter_block": "ปิดกั้นการเข้าถึงโดเมน example.org และโดเมนย่อยทั้งหมด",
-    "example_meaning_filter_whitelist": "เลิกปิดกั้นการเข้าถึงโดเมน example.org และโดเมนย่อยทั้งหมด",
-    "example_meaning_host_block": "ตอนนี้ AdGuard Home จะส่งคืนที่อยู่ 127.0.0.1 สำหรับโดเมน example.org (แต่ไม่ใช่โดเมนย่อย)",
-    "example_comment": "! นี่ความคิดเห็น",
-    "example_comment_meaning": "เพียงความคิดเห็น",
-    "example_comment_hash": "# นอกจากนี้ยังมีความคิดเห็น",
-    "example_regex_meaning": "ปิดกั้นการเข้าถึงโดเมนที่ตรงกับนิพจน์ทั่วไปที่ระบุ",
-    "example_upstream_regular": "DNS ปกติ (มากกว่า UDP)",
-    "example_upstream_dot": "encrypted <0>DNS-over-TLS</0> แล้ว",
-    "example_upstream_doh": "เข้ารหัส <0>DNS-over-HTTPS</0> แล้ว",
-    "example_upstream_sdns": "คุณสามรถใช้ <0>DNS Stamps</0> กับ <1>DNSCrypt</1> หรือ <2>DNS-over-HTTPS</2> ตัวแก้ปัญหา",
-    "example_upstream_tcp": "dNS ปกติ (ผ่าน TCP)",
    "dns_test_ok_toast": "เซิร์ฟเวอร์ DNS ที่ระบุทำงานอย่างถูกต้อง",
    "dns_test_not_ok_toast": "เซิร์ฟเวอร์ \"{{key}}\": ไม่สามารถใช้งานได้ โปรดตรวจสอบว่าคุณเขียนถูกต้อง",
    "unblock": "เลิกปิดกั้น",
@@ -148,7 +117,6 @@
    "loading_table_status": "กำลังโหลด...",
    "page_table_footer_text": "หน้า",
    "rows_table_footer_text": "ตาราง",
-    "updated_custom_filtering_toast": "อัปเดตกฎการกรองที่กำหนดเอง",
    "rule_removed_from_custom_filtering_toast": "ลบกฎออกจากกฎการกรองที่กำหนดเองแล้ว {{rule}}",
    "rule_added_to_custom_filtering_toast": "เพิ่มกฎในกฎการกรองที่กำหนดเองแล้ว {{rule}}",
    "query_log_response_status": "สถานะ: {{value}}",
@@ -156,12 +124,10 @@
    "query_log_confirm_clear": "คุณแน่ใจหรือไม่ว่าต้องการลบบันทึกการใช้งานทั้งหมด?",
    "query_log_cleared": "บันทึกการใช้งานได้รับการล้างเรียบร้อยแล้ว",
    "query_log_clear": "ล้างบันทึกการสืบค้น",
-    "query_log_retention": "แบบสอบถามบันทึกการเก็บรักษา",
    "query_log_enable": "เปิดใช้งานบันทึก",
    "query_log_configuration": "บันทึกการกำหนดค่า",
    "query_log_disabled": "บันทึกแบบสอบถามถูกปิดใช้งานและสามารถกำหนดค่าใน <0>การตั้งค่า</0>",
    "query_log_strict_search": "ใช้เครื่องหมายคำพูดคู่เพื่อการค้นหาที่จำกัด",
-    "query_log_retention_confirm": "คุณแน่ใจหรือไม่ว่าต้องการเปลี่ยนการเก็บข้อมูลบันทึกแบบสอบถาม? หากคุณลดค่าช่วงเวลา ข้อมูลบางอย่างจะหายไป",
    "dns_config": "การกำหนดค่าเซิร์ฟเวอร์ DNS",
    "blocking_mode": "โหมดการปิดกั้น",
    "default": "ค่าเริ่มต้น",
@@ -176,8 +142,6 @@
    "dns_over_quic": "DNS-over-QUIC",
    "form_enter_rate_limit": "ป้อนขีดจำกัดอัตรา",
    "rate_limit": "จำกัดอัตรา",
-    "edns_enable": "เปิดใช้งานซับเน็ตไคลเอ็นต์ EDNS",
-    "edns_cs_desc": "หากเปิดใช้งาน AdGuard Home จะส่งซับเน็ตของไคลเอนต์ไปยังเซิร์ฟเวอร์ DNS",
    "blocking_ipv4_desc": "ที่อยู่ IP ที่จะส่งคืนสำหรับคำขอที่ถูกปิดกั้น",
    "blocking_ipv6_desc": "ที่อยู่ IP ที่จะส่งคืนสำหรับคำขอ AAAA ที่ถูกปิดกั้น",
    "blocking_mode_nxdomain": "NXDOMAIN: ตอบสนองด้วยรหัส NXDOMAIN",
@@ -198,7 +162,6 @@
    "install_settings_dns_desc": "คุณจะต้องกำหนดค่าอุปกรณ์หรือเราเตอร์ของคุณเพื่อใช้เซิร์ฟเวอร์ DNS ตามที่อยู่ต่อไปนี้:",
    "install_settings_all_interfaces": "อินเทอร์เฟซทั้งหมด",
    "install_auth_title": "การตรวจสอบสิทธิ์",
-    "install_auth_desc": "ขอแนะนำอย่างยิ่งให้กำหนดค่าการตรวจสอบรหัสผ่านให้กับส่วนต่อประสานเว็บผู้ดูแลระบบ AdGuard Home ของคุณ แม้ว่ามันจะสามารถเข้าถึงได้เฉพาะในเครือข่ายท้องถิ่นของคุณก็ยังคงเป็นสิ่งสำคัญที่จะปกป้องมันจากการเข้าถึงที่ไม่จำกัด",
    "install_auth_username": "ชื่อผู้ใช้",
    "install_auth_password": "รหัสผ่าน",
    "install_auth_confirm": "ยืนยันรหัสผ่าน",
@@ -208,37 +171,26 @@
    "install_devices_title": "กำหนดค่าอุปกรณ์ของคุณ",
    "install_devices_desc": "ในการเริ่มใช้งาน AdGuard Home คุณต้องกำหนดค่าอุปกรณ์ของคุณเพื่อใช้งาน",
    "install_submit_title": "ยินดีด้วย!",
-    "install_submit_desc": "ขั้นตอนการตั้งค่าเสร็จสิ้นและคุณพร้อมที่จะเริ่มใช้งาน AdGuard Home",
    "install_devices_router": "เราเตอร์",
-    "install_devices_router_desc": "การตั้งค่านี้จะครอบคลุมอุปกรณ์ทั้งหมดที่เชื่อมต่อกับเราเตอร์ที่บ้านของคุณโดยอัตโนมัติและคุณไม่จำเป็นต้องกำหนดค่าแต่ละอุปกรณ์ด้วยตนเอง",
    "install_devices_address": "เซิร์ฟเวอร์ DNS ของ AdGuard Home กำลังรับฟังตามที่อยู่ต่อไปนี้",
    "install_devices_router_list_2": "ค้นหาการตั้งค่า DHCP/DNS ค้นหาตัวอักษร DNS ที่อยู่ถัดจากช่องที่อนุญาตให้มีตัวเลขสองหรือสามชุดโดยแต่ละกลุ่มแบ่งออกเป็นสี่กลุ่มหนึ่งถึงสามหลัก",
    "install_devices_router_list_3": "ป้อนที่อยู่เซิร์ฟเวอร์ AdGuard Home ของคุณที่นั่น",
    "install_devices_windows_list_1": "เปิด  Control Panel โดยใช้ Start menu หรือ Windows search",
    "install_devices_windows_list_2": "ไปที่หมวด  Network and Internet แล้วเลือก Network and Sharing Center",
-    "install_devices_windows_list_3": "ทางด้านซ้ายจะมีคำว่า  Change adapter settings ให้กดเข้าไป",
-    "install_devices_windows_list_4": "เลือกการเชื่อมต่อที่ใช้งานอยู่ คลิกขวาแล้วเลือก Properties",
-    "install_devices_windows_list_5": "ค้นหา Internet Protocol Version 4 (TCP/IP)  แล้วคลิก  Properties  อีกครั้ง",
-    "install_devices_windows_list_6": "ค้นหา DNS server addresses  ให้ทำการกรอกหมายเลข AdGuard Home ลงไปในช่อง",
-    "install_devices_macos_list_1": "คลิกโลโก้แอปเปิ้ลแล้วกด System Preferences",
-    "install_devices_macos_list_2": "คลิก  Network",
    "install_devices_macos_list_3": "เลือกการเชื่อมต่อแล้วคลิก Advanced",
    "install_devices_macos_list_4": "ค้นหาแท็บ DNS แล้วกรอกหมาเลย AdGuard Home",
    "install_devices_android_list_1": "เข้าหน้าเมนู(บางรุ่นจะมีตรงแท็บการแจ้งเตือน) เลือกการตั้งค่า",
    "install_devices_android_list_2": "เลือกเมนู Wi-Fi แล้วค้นหา Wi-Fi ที่จะเชื่อมต่อ (ไม่สารถตั้งค่ากับเน็ตมือถือได้)",
    "install_devices_android_list_3": "แตะชื่อWi-Fi ที่จะเชื่อมต่อค้างไว้(บางรุ่นให้เลื่อนจอลงไปล่างสุด) เลือกการตั้งค่าเพิ่มเติม",
    "install_devices_android_list_4": "ในอุปกรณ์บางอย่างคุณอาจต้องทำเครื่องหมายในช่องสำหรับขั้นสูงเพื่อดูการตั้งค่าเพิ่มเติม หากต้องการปรับการตั้งค่า Android DNS ของคุณคุณจะต้องเปลี่ยนการตั้งค่า IP จาก DHCP เป็นแบบคงที่",
-    "install_devices_android_list_5": "เปลี่ยนการตั้งค่า DNS ที่ 1 และค่า DNS 2 ถึงที่อยู่เซิร์ฟเวอร์ AdGuard Home ของคุณ",
    "install_devices_ios_list_1": "เลือกการตั้งค่า",
    "install_devices_ios_list_2": "เลือก Wi-Fi ด้านซ้าย (ไม่สามรถใช้งานได้กับดาต้ามือถือ)",
-    "install_devices_ios_list_3": "เลือกชื่อที่จะเชื่อมต่อ",
    "install_devices_ios_list_4": "กรอก DNS AdGuard Home Server ลงไปในช่อง",
    "get_started": "เริ่มต้นการใช้งาน",
    "next": "ถัดไป",
    "open_dashboard": "เปิดหน้าควบคุม",
    "install_saved": "บันทึกเรียบร้อยแล้ว",
    "encryption_title": "การเข้ารหัส",
-    "encryption_desc": "การดข้ารหัส (HTTPS/TLS) รองรับทั้ง DNS และหน้าเว็บแอดมิน",
    "encryption_server": "ชื่อเซิร์ฟเวอร์",
    "encryption_server_enter": "ป้อนชื่อโดเมน",
    "encryption_redirect": "ไปเส้นทาง HTTPS อัตโนมัติ",
@@ -256,10 +208,6 @@
    "encryption_key_input": "คัดลอก/วาง PEM-encoded private key ของคุณตรงนี้",
    "encryption_enable": "เปิดการเข้ารหัส (HTTPS, DNS-over-HTTPS, และ DNS-over-TLS)",
    "encryption_enable_desc": "หากเปิดใช้งานการเข้ารหัสอินเทอร์เฟซผู้ดูแลระบบของ AdGuard Home จะทำงานผ่าน HTTPS และเซิร์ฟเวอร์ DNS จะรับฟังคำร้องขอผ่านทาง DNS-over-HTTPS และ DNS-over-TLS",
-    "encryption_chain_valid": "ใบรับรองมีความน่าเชื่อถือ",
-    "encryption_chain_invalid": "ใบรับรองไม่มีความน่าเชื่อถือแต่สามรถใช้ได้",
-    "encryption_key_valid": "นี่เป็นคีย์ส่วนตัว {{type}} ที่ถูกต้อง",
-    "encryption_key_invalid": "นี่เป็นคีย์ส่วนตัว {{type}} ที่ไม่ถูกต้อง",
    "encryption_subject": "เรื่อง:",
    "encryption_issuer": "ผู้ออกใบรับรอง:",
    "encryption_hostnames": "ชื่อโฮส",
@@ -267,21 +215,16 @@
    "encryption_warning": "คำเตือน",
    "topline_expiring_certificate": "ใบรับรอง SSL ของคุณกำลังจะหมดอายุ กรุณาอัปเดท <0>การตั้งค่าเข้ารหัส</0>.",
    "topline_expired_certificate": "ใบรับรอง SSL ของคุณหมดอายุแล้ว กรุณาอัปเดท <0>การตั้งค่าเข้ารหัส</0>.",
-    "form_error_port_unsafe": "เป็นพอร์ทที่ไม่ปลอดภัย",
-    "form_error_password": "รหัสผ่านไม่ตรงกัน",
    "reset_settings": "รีเซ็ตการตั้งค่า",
    "update_announcement": "AdGuard Home {{version}} พร้อมแล้ว <0>กดตรงนี้</0> สำหรับข้อมูลเพิ่มเติม",
    "dns_addresses": "ที่อยู่ DNS",
    "dns_start": "เซิร์ฟเวอร์ DNS เริ่มทำงาน",
-    "dns_status_error": "เกิดข้อผิดพลาดในการตรวจสอบสถานะเซิร์ฟเวอร์ DNS",
    "down": "ดับ",
    "fix": "ซ่อม",
    "dns_providers": "นี่คือรายการ <0>ของผู้ให้บริการ DNS ที่เป็นที่รู้จัก</0> ให้เลือก",
    "update_now": "อัปเดตตอนนี้",
    "update_failed": "อัปเดทล้มเหลว กรุณา <a> ทำตามขั้นตอน </a> เพื่ออัพเดทด้วยตนเอง",
    "processing_update": "รอซักครู่ AdGuard Home กำลังอัปเดท",
-    "clients_title": "เครื่องลูกข่าย",
-    "clients_desc": "ตั้งค่าอุปกรณ์เพื่อเชื่อมต่อ AdGuard Home",
    "settings_global": "ทั่วโลก",
    "settings_custom": "กำหนดเอง",
    "table_client": "เครื่องลูกข่าย",
@@ -303,14 +246,9 @@
    "client_updated": "อัปเดตเครื่อง \"{{key}}\" สำเร็จแล้ว",
    "clients_not_found": "ไม่มีเครื่องลูกข่าย",
    "client_confirm_delete": "คุณแน่ใจนะว่าจะลบเครื่อง \"{{key}}\"?",
-    "auto_clients_title": "เครื่อง (runtime)",
-    "auto_clients_desc": "ข้อมูลเกี่ยวกับไคลเอนต์ที่ใช้ AdGuard Home แต่ไม่ได้เก็บไว้ในการกำหนดค่า",
    "access_title": "เข้าถึงการตั้งค่า",
-    "access_desc": "ที่นี่คุณสามารถกำหนดค่ากฎการเข้าถึงสำหรับเซิร์ฟเวอร์ AdGuard Home DNS",
    "access_allowed_title": "ลูกค้าที่ได้รับอนุญาต",
-    "access_allowed_desc": "รายการ CIDR หรือที่อยู่ IP หากกำหนดค่า AdGuard Home จะยอมรับคำขอจากที่อยู่ IP เหล่านี้เท่านั้น",
    "access_disallowed_title": "ลูกค้าไม่ได้รับอนุญาต",
-    "access_disallowed_desc": "รายการ CIDR หรือที่อยู่ IP หากกำหนดค่าไว้ AdGuard Home จะส่งคำขอจากที่อยู่ IP เหล่านี้",
    "access_blocked_title": "โดเมนที่ถูกปิดกั้น",
    "check_updates_now": "ตรวจสอบการปรับปรุง",
    "setup_dns_privacy_other_title": "การใช้งานอื่น ๆ",
@@ -319,8 +257,6 @@
    "rewrite_add": "เพิ่ม DNS rewrite",
    "form_domain": "ป้อนชื่อโดเมน",
    "form_answer": "ป้อนชื่อโดเมนหรือ IP",
-    "form_error_domain_format": "รูปแบบ Domain ไม่ถูกต้อง",
-    "form_error_answer_format": "รูปแบบคำตอบไม่ถูกต้อง",
    "configure": "กำหนดค่า",
    "main_settings": "ตั้งค่าหลัก",
    "block_services": "ปิดกั้นบริการเฉพาะ",
@@ -349,8 +285,6 @@
    "filter_updated": "อัปเดตตัวกรองสำเร็จแล้ว",
    "statistics_configuration": "การกำหนดค่าสถิติ",
    "statistics_retention": "การเก็บรักษาสถิติ",
-    "statistics_retention_desc": "หากคุณลดค่าช่วงเวลาข้อมูลบางอย่างจะหายไป",
-    "statistics_clear": "ล้างสถิติ",
    "statistics_clear_confirm": "คุณแน่ใจหรือไม่ว่าต้องการล้างสถิติ?",
    "statistics_retention_confirm": "คุณแน่ใจหรือไม่ว่าต้องการเปลี่ยนการเก็บรักษาสถิติ? หากคุณลดค่าช่วงเวลา ข้อมูลบางอย่างจะหายไป",
    "statistics_cleared": "สถิติได้ถูกล้างเรียบร้อยแล้ว",
@@ -358,7 +292,6 @@
    "interval_hours_plural": "{{count}} ชั่วโมง",
    "filters_configuration": "การกำหนดค่าตัวกรอง",
    "filters_enable": "เปิดใช้งานตัวกรอง",
-    "filters_interval": "ตัวกรองช่วงเวลาการอัปเดต",
    "disabled": "ปิดใช้งาน",
    "username_label": "ชื่อผู้ใช้",
    "username_placeholder": "ป้อนชื่อผู้ใช้",
@@ -373,33 +306,21 @@
    "netname": "ชื่อเครือข่าย",
    "network": "เครือข่าย",
    "descr": "คำอธิบาย",
-    "whois": "Whois",
    "filtering_rules_learn_more": "<0>เรียนรู้เพิ่มเติม</0> เกี่ยวกับการสร้างรายการปิดกั้นโฮสต์ของคุณเอง",
    "blocked_by_response": "ปิดกั้นโดย CNAME หรือ IP ในการตอบกลับ",
    "try_again": "ลองอีกครั้ง",
    "domain_desc": "ป้อนชื่อโดเมนหรือไวด์การ์ดที่คุณต้องการเขียนใหม่",
    "example_rewrite_domain": "เขียนคำตอบซ้ำสำหรับชื่อโดเมนนี้เท่านั้น",
    "example_rewrite_wildcard": "เขียนคำตอบใหม่ทั้งหมดสำหรับ <0>example.org</0> โดเมนย่อย",
-    "disable_ipv6": "ปิดใช้งาน IPv6",
-    "disable_ipv6_desc": "หากเปิดใช้งานคุณสมบัตินี้การสืบค้น DNS ทั้งหมดสำหรับที่อยู่ IPv6 (ประเภท AAAA) จะถูกทิ้ง",
    "autofix_warning_text": "หากคุณคลิก \"แก้ไข\" AdGuardHome จะกำหนดค่าระบบของคุณเพื่อใช้เซิร์ฟเวอร์ AdGuardHome",
    "autofix_warning_list": "มันจะทำงานเหล่านี้: <0>ปิดการใช้งานระบบ DNSStubListener</0> <0>ตั้งที่อยู่เซิร์ฟเวอร์ DNS เป็น 127.0.0.1</0> <0>แทนที่เป้าหมายลิงก์สัญลักษณ์ของ /etc/resolv.conf เป็น /run/systemd/resolve/resolv.conf</0> <0>หยุด DNSStubListener (โหลดบริการแก้ไขระบบซ้ำ)</0>",
    "autofix_warning_result": "ดังนั้น AdGuardHome จะประมวลผลคำขอ DNS ทั้งหมดจากระบบของคุณตามค่าเริ่มต้น",
    "tags_title": "แท็ก",
-    "tags_desc": "คุณสามารถเลือกแท็กที่สอดคล้องกับลูกค้า แท็กสามารถรวมอยู่ในกฎการกรองและอนุญาตให้คุณใช้งานได้อย่างถูกต้องมากขึ้น <0>เรียนรู้เพิ่มเติม</0>",
    "form_select_tags": "เลือกแท็กเครื่อง",
    "check_title": "ตรวจสอบการกรอง",
-    "check_desc": "ตรวจสอบว่าชื่อโฮสต์ถูกกรอง",
    "form_enter_host": "ป้อนชื่อโฮสต์",
-    "show_blocked_responses": "ปิดกั้นแล้ว",
-    "show_whitelisted_responses": "รายการที่อนุญาต",
-    "show_processed_responses": "ประมวลผลแล้ว",
    "blocked_adult_websites": "ถูกปิดกั้นโดยการควบคุมของผู้ปกครอง",
-    "safe_search": "ค้นหาอย่างปลอดภัย",
-    "blocklist": "บัญชีดำ",
-    "allowed": "รายการที่อนุญาต",
    "filter_category_other": "อื่น ๆ",
-    "parental_control": "ควบคุมโดยผู้ปกครอง",
    "sunday_short": "อาทิตย์",
    "monday_short": "จันทร์",
    "tuesday_short": "อังคาร",
--- a/client/src/__locales/uk.json
+++ b/client/src/__locales/uk.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Використовувати паралельні запити, щоб пришвидшити вирішення одночасною чергою всіх оригінальних серверів.",
    "parallel_requests": "Паралельні запити",
    "load_balancing": "Балансування навантаження",
-    "load_balancing_desc": "Запитувати один сервер за раз. AdGuard Home використовуватиме зважений випадковий алгоритм для вибору сервера, щоб найшвидший сервер використовувався частіше.",
    "bootstrap_dns": "Bootstrap DNS-сервери",
    "bootstrap_dns_desc": "IP-адреси DNS-серверів, які використовуються для визначення IP-адрес DoH/DoT-розпізнавачів, які ви вказуєте як висхідні. Коментарі заборонені.",
    "fallback_dns_title": "Резервні DNS-сервери",
    "fallback_dns_desc": "Список резервних DNS-серверів, які використовуються, коли upstream DNS-сервери не відповідають. Синтаксис такий самий, як і в полі upstream сервера вище.",
    "fallback_dns_placeholder": "Вводьте один резервний DNS-сервер на рядок",
    "local_ptr_title": "Приватні сервери для зворотного DNS",
-    "local_ptr_desc": "DNS-сервери, які AdGuard Home використовує для локальних PTR-запитів. Ці сервери використовуються для вирішення PTR-запитів для адрес у приватних мережах, наприклад, «192.168.12.34». Якщо список порожній, AdGuard Home буде усталено використовувати системний DNS-сервер.",
    "local_ptr_default_resolver": "Стандартно AdGuard Home користується такими зворотними DNS-вирішувачами: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home не зміг визначити приватні зворотні DNS-вирішувачі, які підійшли б для цієї системи.",
    "local_ptr_placeholder": "Вводьте одну адресу на рядок",
    "resolve_clients_title": "Увімкнути зворотне вирішення IP-адрес клієнтів",
    "resolve_clients_desc": "Визначати доменні імена клієнтів за допомогою PTR-запитів до відповідних серверів — приватних DNS-серверів для локальних клієнтів та upstream-серверів для клієнтів з публічними IP-адресами.",
    "use_private_ptr_resolvers_title": "Використовувати приватні зворотні DNS-резолвери",
-    "use_private_ptr_resolvers_desc": "Надсилати зворотні DNS-запити до вказаних серверів для клієнтів, що обслуговуються локально. Якщо вимкнено, AdGuard Home буде відповідати NXDOMAIN на всі такі PTR-запити, окрім запитів про клієнтів, що уже відомі завдяки DHCP, /etc/hosts тощо.",
    "check_dhcp_servers": "Перевірити DHCP-сервери",
    "save_config": "Зберегти конфігурацію",
    "enabled_dhcp": "DHCP-сервер увімкнено",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "Використовувати вебслужбу «Батьківський контроль» AdGuard",
    "use_adguard_parental_hint": "AdGuard Home перевірить, чи містить домен матеріали для дорослих. Буде використано той же безпечний API, що й для «Безпеки перегляду» AdGuard.",
    "enforce_safe_search": "Використовувати Безпечний пошук",
-    "enforce_save_search_hint": "AdGuard Home може примусово застосовувати безпечний пошук в таких пошукових системах: Google, YouTube, Bing, DuckDuckGo, Yandex, Pixabay.",
    "no_servers_specified": "Сервери не вказано",
    "general_settings": "Загальні налаштування",
    "dns_settings": "Налаштування DNS",
--- a/client/src/__locales/vi.json
+++ b/client/src/__locales/vi.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "Sử dụng truy vấn song song để tăng tốc độ giải quyết bằng cách truy vấn đồng thời tất cả các máy chủ ngược tuyến",
    "parallel_requests": "Yêu cầu song song",
    "load_balancing": "Cân bằng tải",
-    "load_balancing_desc": "Truy vấn một máy chủ thượng nguồn tại một thời điểm. AdGuard Home sử dụng thuật toán ngẫu nhiên có trọng số để chọn máy chủ có số lần tìm kiếm không thành công thấp nhất và thời gian tìm kiếm trung bình thấp nhất.",
    "bootstrap_dns": "Máy chủ DNS Bootstrap",
    "bootstrap_dns_desc": "Địa chỉ IP của máy chủ DNS được sử dụng để phân giải địa chỉ IP của trình phân giải DoH/DoT mà bạn chỉ định làm thượng nguồn. Bình luận không được phép.",
    "fallback_dns_title": "Máy chủ DNS dự phòng",
    "fallback_dns_desc": "Danh sách máy chủ DNS dự phòng được sử dụng khi máy chủ DNS ngược tuyến không phản hồi. Cú pháp tương tự như trong trường ngược dòng chính ở trên.",
    "fallback_dns_placeholder": "Nhập một máy chủ DNS dự phòng trên mỗi dòng",
    "local_ptr_title": "Máy chủ DNS riêng tư",
-    "local_ptr_desc": "Máy chủ DNS được AdGuard Home sử dụng cho các yêu cầu PTR, SOA và NS riêng tư. Một yêu cầu được coi là riêng tư nếu nó yêu cầu một miền ARPA chứa một mạng con trong phạm vi IP riêng tư (chẳng hạn như \"192.168.12.34\") và đến từ một máy khách có địa chỉ IP riêng tư. Nếu không được thiết lập, các trình phân giải DNS mặc định của hệ điều hành của bạn sẽ được sử dụng, ngoại trừ các địa chỉ IP của AdGuard Home.",
    "local_ptr_default_resolver": "Theo mặc định, AdGuard Home sử dụng các hệ thống phân giải tên miền ngược sau: {{ip}}.",
    "local_ptr_no_default_resolver": "AdGuard Home không thể xác định hệ thống phân giải tên miền ngược riêng phù hợp cho hệ thống này.",
    "local_ptr_placeholder": "Nhập một địa chỉ IP trên mỗi dòng",
    "resolve_clients_title": "Kích hoạt cho phép phân giải ngược về địa chỉ IP của máy khách",
    "resolve_clients_desc": "Nếu được bật, AdGuard Home sẽ cố gắng phân giải ngược lại địa chỉ IP của khách hàng thành tên máy chủ của họ bằng cách gửi các truy vấn PTR tới trình phân giải tương ứng (máy chủ DNS riêng cho máy khách cục bộ, máy chủ ngược dòng cho máy khách có địa chỉ IP công cộng).",
    "use_private_ptr_resolvers_title": "Sử dụng trình rDNS riêng tư",
-    "use_private_ptr_resolvers_desc": "Giải quyết các yêu cầu PTR, SOA và NS cho các miền ARPA chứa địa chỉ IP riêng thông qua máy chủ thượng nguồn riêng, DHCP, /etc/hosts, v. v. Nếu bị vô hiệu hóa, AdGuard Home sẽ phản hồi tất cả các yêu cầu đó bằng NXDOMAIN.",
    "check_dhcp_servers": "Kiểm tra máy chủ DHCP",
    "save_config": "Lưu thiết lập",
    "enabled_dhcp": "Máy chủ DHCP đã kích hoạt",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "Sử dụng dịch vụ quản lý của phụ huynh AdGuard",
    "use_adguard_parental_hint": "AdGuard Home sẽ kiểm tra nếu tên miền chứa từ khoá người lớn. Tính năng sử dụng API thân thiện với quyền riêng tư tương tự với dịch vụ bảo vệ duyệt web",
    "enforce_safe_search": "Bắt buộc tìm kiếm an toàn",
-    "enforce_save_search_hint": "AdGuard Home sẽ thực thi tìm kiếm an toàn trong các công cụ tìm kiếm sau: Google, YouTube, Bing, DuckDuckGo, Ecosia, Yandex, Pixabay.",
    "no_servers_specified": "Không có máy chủ nào được liệt kê",
    "general_settings": "Cài đặt chung",
    "dns_settings": "Cài đặt DNS",
@@ -425,9 +421,6 @@
    "encryption_hostnames": "Tên máy chủ",
    "encryption_reset": "Bạn có chắc chắn muốn đặt lại cài đặt mã hóa?",
    "encryption_warning": "Cảnh báo",
-    "encryption_plain_dns_enable": "Kích hoạt DNS đơn giản",
-    "encryption_plain_dns_desc": "DNS đơn giản được bật theo mặc định. Bạn có thể vô hiệu hóa nó để buộc tất cả các thiết bị sử dụng DNS được mã hóa. Để thực hiện việc này, bạn phải kích hoạt ít nhất một giao thức DNS được mã hóa",
-    "encryption_plain_dns_error": "Để tắt DNS đơn giản, hãy bật ít nhất một giao thức DNS được mã hóa",
    "topline_expiring_certificate": "Chứng chỉ SSL của bạn sắp hết hạn. Cập nhật <0>Cài đặt mã hóa</0>.",
    "topline_expired_certificate": "Chứng chỉ SSL của bạn đã hết hạn. Cập nhật <0>Cài đặt mã hóa</0>.",
    "form_error_port_range": "Nhập giá trị cổng trong phạm vi 80-65535",
@@ -678,7 +671,6 @@
    "use_saved_key": "Sử dụng khóa đã lưu trước đó",
    "parental_control": "Quản lý của phụ huynh",
    "safe_browsing": "Duyệt web an toàn",
-    "served_from_cache_label": "Được phục vụ từ bộ nhớ đệm",
    "form_error_password_length": "Mật khẩu phải dài từ {{min}} đến {{max}} ký tự",
    "anonymizer_notification": "<0> Lưu ý:</0> Tính năng ẩn danh IP được bật. Bạn có thể tắt nó trong <1> Cài đặt chung</1>.",
    "confirm_dns_cache_clear": "Bạn có chắc chắn muốn xóa bộ đệm ẩn DNS không?",
--- a/client/src/__locales/zh-hk.json
+++ b/client/src/__locales/zh-hk.json
@@ -6,21 +6,18 @@
    "upstream_parallel": "使用平行查詢，同時查詢所有上游伺服器來加速解析結果",
    "parallel_requests": "平行處理",
    "load_balancing": "負載平衡",
-    "load_balancing_desc": "一次只查詢一個伺服器。AdGuard Home 會使用加權隨機取樣來選擇使用的查詢結果，以確保速度最快的伺服器能被充分運用。",
    "bootstrap_dns": "引導（Boostrap） DNS 伺服器",
    "bootstrap_dns_desc": "Bootstrap DNS 伺服器用於解析您所設定的上游 DoH/DoT 解析器的 IP 地址",
    "fallback_dns_title": "備用 DNS 伺服器",
    "fallback_dns_desc": "備用 DNS 伺服器列表：於主要 DNS 伺服器沒有回應時使用。語法與主要 DNS 伺服器設定欄位相同。",
    "fallback_dns_placeholder": "每行輸入一個備用 DNS 伺服器",
    "local_ptr_title": "私人 DNS 伺服器",
-    "local_ptr_desc": "AdGuard Home 用於區域 PTR 查詢的 DNS 伺服器。這些伺服器將用於解析具有私人 IP 位址的用戶端的主機名稱，例如  \"192.168.12.34\"，使用 rDNS。如果沒有設定，AdGuard Home 將自動使用您的系統預設 DNS 解析。",
    "local_ptr_default_resolver": "AdGuard Home 預設使用以下作為 DNS 反解器：{{ip}}",
    "local_ptr_no_default_resolver": "AdGuard Home 無法為此系統確定適合私有反解析器。",
    "local_ptr_placeholder": "每行輸入一個伺服器位址",
    "resolve_clients_title": "啟用用戶端的 IP 位址的反向解析",
    "resolve_clients_desc": "透過相應的伺服器傳送 PTR 查詢（本機用戶端使用私人 DNS 伺服器，公共 IP 使用上游伺服器），將客戶端的 IP 反解為主機名稱。",
    "use_private_ptr_resolvers_title": "使用私人 DNS 反解器",
-    "use_private_ptr_resolvers_desc": "使用這些上游為本機提供反解 DNS 查詢。如果禁用 AdGuard Home 將會對相關 PTR 請求回應 NXDOMAIN，但 DHCP、/etc/hosts 等已知的用戶端除外。",
    "check_dhcp_servers": "檢查 DHCP 伺服器",
    "save_config": "儲存設定",
    "enabled_dhcp": "DHCP 伺服器已啟動",
@@ -154,7 +151,6 @@
    "use_adguard_parental": "使用 AdGuard 家長監護功能",
    "use_adguard_parental_hint": "AdGuard Home 將比對查詢網域是否含有成人內容。它使用與 AdGuard 瀏覽安全一樣的尊重個人隱私的 API 來進行檢查。",
    "enforce_safe_search": "強制使用安全搜尋",
-    "enforce_save_search_hint": "AdGuard Home 可在下列搜尋引擎使用強制安全搜尋：Google、YouTube、Bing、DuckDuckGo, Yandex 和 Pixabay。",
    "no_servers_specified": "沒有指定的伺服器",
    "general_settings": "一般設定",
    "dns_settings": "DNS 設定",
--- a/client/src/helpers/filters/filters.ts
+++ b/client/src/helpers/filters/filters.ts
@@ -256,12 +256,6 @@ export default {
            "homepage": "https://github.com/hagezi/dns-blocklists",
            "source": "https://adguardteam.github.io/HostlistsRegistry/assets/filter_49.txt"
        },
-        "hagezi_xiaomi_tracking_blocklist": {
-            "name": "HaGeZi's Xiaomi Tracker Blocklist",
-            "categoryId": "other",
-            "homepage": "https://github.com/hagezi/dns-blocklists",
-            "source": "https://adguardteam.github.io/HostlistsRegistry/assets/filter_60.txt"
-        },
        "no_google": {
            "name": "No Google",
            "categoryId": "other",
--- a/client/src/helpers/trackers/trackers.json
+++ b/client/src/helpers/trackers/trackers.json
--- a/go.mod
+++ b/go.mod
@@ -1,12 +1,11 @@
 module github.com/AdguardTeam/AdGuardHome

-go 1.23.2
+go 1.22.5

 require (
-	// TODO(a.garipov):  Update when v0.73.3 is released.
-	github.com/AdguardTeam/dnsproxy v0.73.3-0.20241004151328-c7c7b977a2a3
-	github.com/AdguardTeam/golibs v0.30.0
-	github.com/AdguardTeam/urlfilter v0.20.0
+	github.com/AdguardTeam/dnsproxy v0.72.2
+	github.com/AdguardTeam/golibs v0.25.1
+	github.com/AdguardTeam/urlfilter v0.19.0
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/ameshkov/dnscrypt/v2 v2.3.0
 	github.com/bluele/gcache v0.0.2
@@ -19,7 +18,7 @@ require (
 	github.com/google/gopacket v1.1.19
 	github.com/google/renameio/v2 v2.0.0
 	github.com/google/uuid v1.6.0
-	github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475
+	github.com/insomniacslk/dhcp v0.0.0-20240419123447-f1cffa2c0c49
 	github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86
 	github.com/kardianos/service v1.2.2
 	github.com/mdlayher/ethernet v0.0.0-20220221185849-529eae5b6118
@@ -28,15 +27,15 @@ require (
 	// TODO(a.garipov): This package is deprecated; find a new one or use our
 	// own code for that.  Perhaps, use gopacket.
 	github.com/mdlayher/raw v0.1.0
-	github.com/miekg/dns v1.1.62
-	github.com/quic-go/quic-go v0.48.1
+	github.com/miekg/dns v1.1.61
+	github.com/quic-go/quic-go v0.44.0
 	github.com/stretchr/testify v1.9.0
 	github.com/ti-mo/netfilter v0.5.2
-	go.etcd.io/bbolt v1.3.11
-	golang.org/x/crypto v0.28.0
-	golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c
-	golang.org/x/net v0.30.0
-	golang.org/x/sys v0.26.0
+	go.etcd.io/bbolt v1.3.10
+	golang.org/x/crypto v0.25.0
+	golang.org/x/exp v0.0.0-20240707233637-46b078467d37
+	golang.org/x/net v0.27.0
+	golang.org/x/sys v0.22.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1
 	howett.net/plist v1.0.1
@@ -49,19 +48,19 @@ require (
 	github.com/beefsack/go-rate v0.0.0-20220214233405-116f4ca011a0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/google/pprof v0.0.0-20241029010322-833c56d90c8e // indirect
+	github.com/google/pprof v0.0.0-20240521024322-9665fa269a30 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
-	github.com/onsi/ginkgo/v2 v2.20.2 // indirect
+	github.com/onsi/ginkgo/v2 v2.17.3 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/quic-go/qpack v0.5.1 // indirect
+	github.com/quic-go/qpack v0.4.0 // indirect
 	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
-	go.uber.org/mock v0.5.0 // indirect
-	golang.org/x/mod v0.21.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/text v0.19.0 // indirect
-	golang.org/x/tools v0.26.0 // indirect
-	gonum.org/v1/gonum v0.15.1 // indirect
+	go.uber.org/mock v0.4.0 // indirect
+	golang.org/x/mod v0.19.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/tools v0.23.0 // indirect
+	gonum.org/v1/gonum v0.15.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -1,9 +1,9 @@
-github.com/AdguardTeam/dnsproxy v0.73.3-0.20241004151328-c7c7b977a2a3 h1:IGXwBjdKDzUm007QzZyxSllMnkbdXe7K79x7JWcBW/E=
-github.com/AdguardTeam/dnsproxy v0.73.3-0.20241004151328-c7c7b977a2a3/go.mod h1:356iHROxo+SOdBVifp1MXEh6qHyydtzGCcsQMfx+ZVs=
-github.com/AdguardTeam/golibs v0.30.0 h1:3pTdW1B9GZgqARrA5BvmYlAaEG1zAHI/ReikCDxrhiE=
-github.com/AdguardTeam/golibs v0.30.0/go.mod h1:vjw1OVZG6BYyoqGRY88U4LCJLOMfhBFhU0UJBdaSAuQ=
-github.com/AdguardTeam/urlfilter v0.20.0 h1:X32qiuVCVd8WDYCEsbdZKfXMzwdVqrdulamtUi4rmzs=
-github.com/AdguardTeam/urlfilter v0.20.0/go.mod h1:gjrywLTxfJh6JOkwi9SU+frhP7kVVEZ5exFGkR99qpk=
+github.com/AdguardTeam/dnsproxy v0.72.2 h1:0uItzXnUIuC9r+ZvPbNquGaAHvdWnWLbhSDdxsZk5og=
+github.com/AdguardTeam/dnsproxy v0.72.2/go.mod h1:PA1UiTtTHMbXPv9NjHat+zrsgK8S7p/RJ+j/3tNqtUE=
+github.com/AdguardTeam/golibs v0.25.1 h1:po5dBbFCoZAySsbsMN/ZRB0WTLYDA1d8BxPgvriu/EA=
+github.com/AdguardTeam/golibs v0.25.1/go.mod h1:HaTyS2wCbxFudjht9N/+/Qf1b5cMad2BAYSwe7DPCXI=
+github.com/AdguardTeam/urlfilter v0.19.0 h1:q7eH13+yNETlpD/VD3u5rLQOripcUdEktqZFy+KiQLk=
+github.com/AdguardTeam/urlfilter v0.19.0/go.mod h1:+N54ZvxqXYLnXuvpaUhK2exDQW+djZBRSb6F6j0rkBY=
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
 github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da h1:KjTM2ks9d14ZYCvmHS9iAKVt9AyzRSqNU1qabPih5BY=
@@ -29,8 +29,8 @@ github.com/dimfeld/httptreemux/v5 v5.5.0 h1:p8jkiMrCuZ0CmhwYLcbNbl7DDo21fozhKHQ2
 github.com/dimfeld/httptreemux/v5 v5.5.0/go.mod h1:QeEylH57C0v3VO0tkKraVz9oD3Uu93CKPnTLbsidvSw=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ping/ping v1.1.0 h1:3MCGhVX4fyEUuhsfwPrsEdQw6xspHkv5zHsiSoDFZYw=
@@ -44,8 +44,8 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
-github.com/google/pprof v0.0.0-20241029010322-833c56d90c8e h1:v7R0PZoC2p1KWQmv1+GqCXQe59Ab1TkDF8Y9Lg2W6m4=
-github.com/google/pprof v0.0.0-20241029010322-833c56d90c8e/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20240521024322-9665fa269a30 h1:r6YdmbD41tGHeCWDyHF691LWtL7D1iSTyJaKejTWwVU=
+github.com/google/pprof v0.0.0-20240521024322-9665fa269a30/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
 github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
 github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -53,8 +53,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714 h1:/jC7qQFrv8CrSJVmaolDVOxTfS9kc36uB6H40kdbQq8=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714/go.mod h1:2Goc3h8EklBH5mspfHFxBnEoURQCGzQQH1ga9Myjvis=
-github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475 h1:hxST5pwMBEOWmxpkX20w9oZG+hXdhKmAIPQ3NGGAxas=
-github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475/go.mod h1:KclMyHxX06VrVr0DJmeFSUb1ankt7xTfoOA35pCkoic=
+github.com/insomniacslk/dhcp v0.0.0-20240419123447-f1cffa2c0c49 h1:/OuvSMGT9+xnyZ+7MZQ1zdngaCCAdPoSw8B/uurZ7pg=
+github.com/insomniacslk/dhcp v0.0.0-20240419123447-f1cffa2c0c49/go.mod h1:KclMyHxX06VrVr0DJmeFSUb1ankt7xTfoOA35pCkoic=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 h1:elKwZS1OcdQ0WwEDBeqxKwb7WB62QX8bvZ/FJnVXIfk=
@@ -78,14 +78,14 @@ github.com/mdlayher/raw v0.1.0/go.mod h1:yXnxvs6c0XoF/aK52/H5PjsVHmWBCFfZUfoh/Y5
 github.com/mdlayher/socket v0.2.1/go.mod h1:QLlNPkFR88mRUNQIzRBMfXxwKal8H7u1h3bL1CV+f0E=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
-github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
-github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
+github.com/miekg/dns v1.1.61 h1:nLxbwF3XxhwVSm8g9Dghm9MHPaUZuqhPiGL+675ZmEs=
+github.com/miekg/dns v1.1.61/go.mod h1:mnAarhS3nWaW+NVP2wTkYVIZyHNJ098SJZUki3eykwQ=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
-github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
-github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
-github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
+github.com/onsi/ginkgo/v2 v2.17.3 h1:oJcvKpIb7/8uLpDDtnQuf18xVnwKp8DTD7DQ6gTd/MU=
+github.com/onsi/ginkgo/v2 v2.17.3/go.mod h1:nP2DPOQoNsQmsVyv5rDA8JkXQoCs6goXIvr/PRJ1eCc=
+github.com/onsi/gomega v1.33.0 h1:snPCflnZrpMsy94p4lXVEkHo12lmPnc3vY5XBbreexE=
+github.com/onsi/gomega v1.33.0/go.mod h1:+925n5YtiFsLzzafLUHzVMBpvvRAzrydIBiSIxjX3wY=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
@@ -97,10 +97,10 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
-github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
-github.com/quic-go/quic-go v0.48.1 h1:y/8xmfWI9qmGTc+lBr4jKRUWLGSlSigv847ULJ4hYXA=
-github.com/quic-go/quic-go v0.48.1/go.mod h1:yBgs3rWBOADpga7F+jJsb6Ybg1LSYiQvwWlLX+/6HMs=
+github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=
+github.com/quic-go/qpack v0.4.0/go.mod h1:UZVnYIfi5GRk+zI9UMaCPsmZ2xKJP7XBUvVyT1Knj9A=
+github.com/quic-go/quic-go v0.44.0 h1:So5wOr7jyO4vzL2sd8/pD9Kesciv91zSk8BoFngItQ0=
+github.com/quic-go/quic-go v0.44.0/go.mod h1:z4cx/9Ny9UtGITIPzmPTXh1ULfOyWh4qGQlpnPcWmek=
 github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
 github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
 github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
@@ -122,32 +122,32 @@ github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8
 github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701/go.mod h1:P3a5rG4X7tI17Nn3aOIAYr5HbIMukwXG0urG0WuL8OA=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.etcd.io/bbolt v1.3.11 h1:yGEzV1wPz2yVCLsD8ZAiGHhHVlczyC9d1rP43/VCRJ0=
-go.etcd.io/bbolt v1.3.11/go.mod h1:dksAq7YMXoljX0xu6VF5DMZGbhYYoLUalEiSySYAS4I=
-go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
-go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+go.etcd.io/bbolt v1.3.10 h1:+BqfJTcCzTItrop8mq/lbzL8wSGtj94UO/3U31shqG0=
+go.etcd.io/bbolt v1.3.10/go.mod h1:bK3UQLPJZly7IlNmV7uVHJDxfe5aK9Ll93e/74Y9oEQ=
+go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
+go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
-golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c h1:7dEasQXItcW1xKJ2+gg5VOiBnqWrJc+rq0DPKyvvdbY=
-golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c/go.mod h1:NQtJDoLvd6faHhE7m4T/1IY708gDefGGjR/iUW8yQQ8=
+golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
+golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
+golang.org/x/exp v0.0.0-20240707233637-46b078467d37 h1:uLDX+AfeFCct3a2C7uIWBKMJIR3CJMhcgfrUAqjRK6w=
+golang.org/x/exp v0.0.0-20240707233637-46b078467d37/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
+golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
-golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
-golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
+golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys=
+golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190322080309-f49334f85ddc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -158,25 +158,25 @@ golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.1-0.20230131160137-e7d7f63158de/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
-golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
+golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
-golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg=
+golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.15.1 h1:FNy7N6OUZVUaWG9pTiD+jlhdQ3lMP+/LcTpJ6+a8sQ0=
-gonum.org/v1/gonum v0.15.1/go.mod h1:eZTZuRFrzu5pcyjN5wJhcIhnUdNijYxX1T2IcrOGY0o=
-google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
-google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gonum.org/v1/gonum v0.15.0 h1:2lYxjRbTYyxkJxlhC+LvJIx3SsANPdRybu1tGj9/OrQ=
+gonum.org/v1/gonum v0.15.0/go.mod h1:xzZVBJBtS+Mz4q0Yl2LJTk+OxOg4jiXZ7qBoM0uISGo=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
--- a/internal/aghalg/ringbuffer.go
+++ b/internal/aghalg/ringbuffer.go
@@ -0,0 +1,94 @@
+package aghalg
+
+// RingBuffer is the implementation of ring buffer data structure.
+type RingBuffer[T any] struct {
+	buf  []T
+	cur  uint
+	full bool
+}
+
+// NewRingBuffer initializes the new instance of ring buffer.  size must be
+// greater or equal to zero.
+func NewRingBuffer[T any](size uint) (rb *RingBuffer[T]) {
+	return &RingBuffer[T]{
+		buf: make([]T, size),
+	}
+}
+
+// Append appends an element to the buffer.
+func (rb *RingBuffer[T]) Append(e T) {
+	if len(rb.buf) == 0 {
+		return
+	}
+
+	rb.buf[rb.cur] = e
+	rb.cur = (rb.cur + 1) % uint(cap(rb.buf))
+	if rb.cur == 0 {
+		rb.full = true
+	}
+}
+
+// Range calls cb for each element of the buffer.  If cb returns false it stops.
+func (rb *RingBuffer[T]) Range(cb func(T) (cont bool)) {
+	before, after := rb.splitCur()
+
+	for _, e := range before {
+		if !cb(e) {
+			return
+		}
+	}
+
+	for _, e := range after {
+		if !cb(e) {
+			return
+		}
+	}
+}
+
+// ReverseRange calls cb for each element of the buffer in reverse order.  If
+// cb returns false it stops.
+func (rb *RingBuffer[T]) ReverseRange(cb func(T) (cont bool)) {
+	before, after := rb.splitCur()
+
+	for i := len(after) - 1; i >= 0; i-- {
+		if !cb(after[i]) {
+			return
+		}
+	}
+
+	for i := len(before) - 1; i >= 0; i-- {
+		if !cb(before[i]) {
+			return
+		}
+	}
+}
+
+// splitCur splits the buffer in two, before and after current position in
+// chronological order.  If buffer is not full, after is nil.
+func (rb *RingBuffer[T]) splitCur() (before, after []T) {
+	if len(rb.buf) == 0 {
+		return nil, nil
+	}
+
+	cur := rb.cur
+	if !rb.full {
+		return rb.buf[:cur], nil
+	}
+
+	return rb.buf[cur:], rb.buf[:cur]
+}
+
+// Len returns a length of the buffer.
+func (rb *RingBuffer[T]) Len() (l uint) {
+	if !rb.full {
+		return rb.cur
+	}
+
+	return uint(cap(rb.buf))
+}
+
+// Clear clears the buffer.
+func (rb *RingBuffer[T]) Clear() {
+	rb.full = false
+	rb.cur = 0
+}
--- a/internal/aghalg/ringbuffer_test.go
+++ b/internal/aghalg/ringbuffer_test.go
@@ -0,0 +1,169 @@
+package aghalg_test
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/aghalg"
+	"github.com/stretchr/testify/assert"
+)
+
+// elements is a helper function that returns n elements of the buffer.
+func elements(b *aghalg.RingBuffer[int], n uint, reverse bool) (es []int) {
+	fn := b.Range
+	if reverse {
+		fn = b.ReverseRange
+	}
+
+	var i uint
+	fn(func(e int) (cont bool) {
+		if i >= n {
+			return false
+		}
+
+		es = append(es, e)
+		i++
+
+		return true
+	})
+
+	return es
+}
+
+func TestNewRingBuffer(t *testing.T) {
+	t.Run("success_and_clear", func(t *testing.T) {
+		b := aghalg.NewRingBuffer[int](5)
+		for i := range 10 {
+			b.Append(i)
+		}
+		assert.Equal(t, []int{5, 6, 7, 8, 9}, elements(b, b.Len(), false))
+
+		b.Clear()
+		assert.Zero(t, b.Len())
+	})
+
+	t.Run("zero", func(t *testing.T) {
+		b := aghalg.NewRingBuffer[int](0)
+		for i := range 10 {
+			b.Append(i)
+			bufLen := b.Len()
+			assert.EqualValues(t, 0, bufLen)
+			assert.Empty(t, elements(b, bufLen, false))
+			assert.Empty(t, elements(b, bufLen, true))
+		}
+	})
+
+	t.Run("single", func(t *testing.T) {
+		b := aghalg.NewRingBuffer[int](1)
+		for i := range 10 {
+			b.Append(i)
+			bufLen := b.Len()
+			assert.EqualValues(t, 1, bufLen)
+			assert.Equal(t, []int{i}, elements(b, bufLen, false))
+			assert.Equal(t, []int{i}, elements(b, bufLen, true))
+		}
+	})
+}
+
+func TestRingBuffer_Range(t *testing.T) {
+	const size = 5
+
+	b := aghalg.NewRingBuffer[int](size)
+
+	testCases := []struct {
+		name   string
+		want   []int
+		count  int
+		length uint
+	}{{
+		name:   "three",
+		count:  3,
+		length: 3,
+		want:   []int{0, 1, 2},
+	}, {
+		name:   "ten",
+		count:  10,
+		length: size,
+		want:   []int{5, 6, 7, 8, 9},
+	}, {
+		name:   "hundred",
+		count:  100,
+		length: size,
+		want:   []int{95, 96, 97, 98, 99},
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			for i := range tc.count {
+				b.Append(i)
+			}
+
+			bufLen := b.Len()
+			assert.Equal(t, tc.length, bufLen)
+
+			want := tc.want
+			assert.Equal(t, want, elements(b, bufLen, false))
+			assert.Equal(t, want[:len(want)-1], elements(b, bufLen-1, false))
+			assert.Equal(t, want[:len(want)/2], elements(b, bufLen/2, false))
+
+			want = want[:cap(want)]
+			slices.Reverse(want)
+
+			assert.Equal(t, want, elements(b, bufLen, true))
+			assert.Equal(t, want[:len(want)-1], elements(b, bufLen-1, true))
+			assert.Equal(t, want[:len(want)/2], elements(b, bufLen/2, true))
+		})
+	}
+}
+
+func TestRingBuffer_Range_increment(t *testing.T) {
+	const size = 5
+
+	b := aghalg.NewRingBuffer[int](size)
+
+	testCases := []struct {
+		name string
+		want []int
+	}{{
+		name: "one",
+		want: []int{0},
+	}, {
+		name: "two",
+		want: []int{0, 1},
+	}, {
+		name: "three",
+		want: []int{0, 1, 2},
+	}, {
+		name: "four",
+		want: []int{0, 1, 2, 3},
+	}, {
+		name: "five",
+		want: []int{0, 1, 2, 3, 4},
+	}, {
+		name: "six",
+		want: []int{1, 2, 3, 4, 5},
+	}, {
+		name: "seven",
+		want: []int{2, 3, 4, 5, 6},
+	}, {
+		name: "eight",
+		want: []int{3, 4, 5, 6, 7},
+	}, {
+		name: "nine",
+		want: []int{4, 5, 6, 7, 8},
+	}, {
+		name: "ten",
+		want: []int{5, 6, 7, 8, 9},
+	}}
+
+	for i, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			b.Append(i)
+			bufLen := b.Len()
+			assert.Equal(t, tc.want, elements(b, bufLen, false))
+
+			slices.Reverse(tc.want)
+			assert.Equal(t, tc.want, elements(b, bufLen, true))
+		})
+	}
+}
--- a/internal/aghhttp/aghhttp.go
+++ b/internal/aghhttp/aghhttp.go
@@ -2,16 +2,13 @@
 package aghhttp

 import (
-	"context"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/http"

 	"github.com/AdguardTeam/AdGuardHome/internal/version"
 	"github.com/AdguardTeam/golibs/httphdr"
 	"github.com/AdguardTeam/golibs/log"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 )

 // HTTP scheme constants.
@@ -34,39 +31,12 @@ func OK(w http.ResponseWriter) {
 }

 // Error writes formatted message to w and also logs it.
-//
-// TODO(s.chzhen):  Remove it.
 func Error(r *http.Request, w http.ResponseWriter, code int, format string, args ...any) {
 	text := fmt.Sprintf(format, args...)
 	log.Error("%s %s %s: %s", r.Method, r.Host, r.URL, text)
 	http.Error(w, text, code)
 }

-// ErrorAndLog writes formatted message to w and also logs it with the specified
-// logging level.
-func ErrorAndLog(
-	ctx context.Context,
-	l *slog.Logger,
-	r *http.Request,
-	w http.ResponseWriter,
-	code int,
-	format string,
-	args ...any,
-) {
-	text := fmt.Sprintf(format, args...)
-	l.ErrorContext(
-		ctx,
-		"http error",
-		"host", r.Host,
-		"method", r.Method,
-		"raddr", r.RemoteAddr,
-		"request_uri", r.RequestURI,
-		slogutil.KeyError, text,
-	)
-
-	http.Error(w, text, code)
-}
-
 // UserAgent returns the ID of the service as a User-Agent string.  It can also
 // be used as the value of the Server HTTP header.
 func UserAgent() (ua string) {
--- a/internal/aghos/os.go
+++ b/internal/aghos/os.go
@@ -7,7 +7,6 @@ import (
 	"bufio"
 	"fmt"
 	"io"
-	"io/fs"
 	"os"
 	"os/exec"
 	"path"
@@ -20,12 +19,6 @@ import (
 	"github.com/AdguardTeam/golibs/log"
 )

-// Default file and directory permissions.
-const (
-	DefaultPermDir  fs.FileMode = 0o700
-	DefaultPermFile fs.FileMode = 0o600
-)
-
 // Unsupported is a helper that returns a wrapped [errors.ErrUnsupported].
 func Unsupported(op string) (err error) {
 	return fmt.Errorf("%s: not supported on %s: %w", op, runtime.GOOS, errors.ErrUnsupported)
--- a/internal/aghos/permission.go
+++ b/internal/aghos/permission.go
@@ -1,50 +0,0 @@
-package aghos
-
-import (
-	"io/fs"
-	"os"
-)
-
-// TODO(e.burkov):  Add platform-independent tests.
-
-// Chmod is an extension for [os.Chmod] that properly handles Windows access
-// rights.
-func Chmod(name string, perm fs.FileMode) (err error) {
-	return chmod(name, perm)
-}
-
-// Mkdir is an extension for [os.Mkdir] that properly handles Windows access
-// rights.
-func Mkdir(name string, perm fs.FileMode) (err error) {
-	return mkdir(name, perm)
-}
-
-// MkdirAll is an extension for [os.MkdirAll] that properly handles Windows
-// access rights.
-func MkdirAll(path string, perm fs.FileMode) (err error) {
-	return mkdirAll(path, perm)
-}
-
-// WriteFile is an extension for [os.WriteFile] that properly handles Windows
-// access rights.
-func WriteFile(filename string, data []byte, perm fs.FileMode) (err error) {
-	return writeFile(filename, data, perm)
-}
-
-// OpenFile is an extension for [os.OpenFile] that properly handles Windows
-// access rights.
-func OpenFile(name string, flag int, perm fs.FileMode) (file *os.File, err error) {
-	return openFile(name, flag, perm)
-}
-
-// Stat is an extension for [os.Stat] that properly handles Windows access
-// rights.
-//
-// Note that on Windows the "other" permission bits combines the access rights
-// of any trustee that is neither the owner nor the owning group for the file.
-//
-// TODO(e.burkov):  Inspect the behavior for the World (everyone) well-known
-// SID and, perhaps, use it.
-func Stat(name string) (fi fs.FileInfo, err error) {
-	return stat(name)
-}
--- a/internal/aghos/permission_unix.go
+++ b/internal/aghos/permission_unix.go
@@ -1,42 +0,0 @@
-//go:build unix
-
-package aghos
-
-import (
-	"io/fs"
-	"os"
-
-	"github.com/google/renameio/v2/maybe"
-)
-
-// chmod is a Unix implementation of [Chmod].
-func chmod(name string, perm fs.FileMode) (err error) {
-	return os.Chmod(name, perm)
-}
-
-// mkdir is a Unix implementation of [Mkdir].
-func mkdir(name string, perm fs.FileMode) (err error) {
-	return os.Mkdir(name, perm)
-}
-
-// mkdirAll is a Unix implementation of [MkdirAll].
-func mkdirAll(path string, perm fs.FileMode) (err error) {
-	return os.MkdirAll(path, perm)
-}
-
-// writeFile is a Unix implementation of [WriteFile].
-func writeFile(filename string, data []byte, perm fs.FileMode) (err error) {
-	return maybe.WriteFile(filename, data, perm)
-}
-
-// openFile is a Unix implementation of [OpenFile].
-func openFile(name string, flag int, perm fs.FileMode) (file *os.File, err error) {
-	// #nosec G304 -- This function simply wraps the [os.OpenFile] function, so
-	// the security concerns should be addressed to the [OpenFile] calls.
-	return os.OpenFile(name, flag, perm)
-}
-
-// stat is a Unix implementation of [Stat].
-func stat(name string) (fi os.FileInfo, err error) {
-	return os.Stat(name)
-}
--- a/internal/aghos/permission_windows.go
+++ b/internal/aghos/permission_windows.go
@@ -1,392 +0,0 @@
-//go:build windows
-
-package aghos
-
-import (
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"unsafe"
-
-	"github.com/AdguardTeam/golibs/errors"
-	"golang.org/x/sys/windows"
-)
-
-// fileInfo is a Windows implementation of [fs.FileInfo], that contains the
-// filemode converted from the security descriptor.
-type fileInfo struct {
-	// fs.FileInfo is embedded to provide the default implementations and data
-	// successfully retrieved by [os.Stat].
-	fs.FileInfo
-
-	// mode is the file mode converted from the security descriptor.
-	mode fs.FileMode
-}
-
-// type check
-var _ fs.FileInfo = (*fileInfo)(nil)
-
-// Mode implements [fs.FileInfo.Mode] for [*fileInfo].
-func (fi *fileInfo) Mode() (mode fs.FileMode) { return fi.mode }
-
-// stat is a Windows implementation of [Stat].
-func stat(name string) (fi os.FileInfo, err error) {
-	absName, err := filepath.Abs(name)
-	if err != nil {
-		return nil, fmt.Errorf("computing absolute path: %w", err)
-	}
-
-	fi, err = os.Stat(absName)
-	if err != nil {
-		// Don't wrap the error, since it's informative enough as is.
-		return nil, err
-	}
-
-	dacl, owner, group, err := retrieveDACL(absName)
-	if err != nil {
-		// Don't wrap the error, since it's informative enough as is.
-		return nil, err
-	}
-
-	var ownerMask, groupMask, otherMask windows.ACCESS_MASK
-	for i := range uint32(dacl.AceCount) {
-		var ace *windows.ACCESS_ALLOWED_ACE
-		err = windows.GetAce(dacl, i, &ace)
-		if err != nil {
-			return nil, fmt.Errorf("getting access control entry at index %d: %w", i, err)
-		}
-
-		entrySid := (*windows.SID)(unsafe.Pointer(&ace.SidStart))
-		switch {
-		case entrySid.Equals(owner):
-			ownerMask |= ace.Mask
-		case entrySid.Equals(group):
-			groupMask |= ace.Mask
-		default:
-			otherMask |= ace.Mask
-		}
-	}
-
-	mode := fi.Mode()
-	perm := masksToPerm(ownerMask, groupMask, otherMask, mode.IsDir())
-
-	return &fileInfo{
-		FileInfo: fi,
-		// Use the file mode from the security descriptor, but use the
-		// calculated permission bits.
-		mode: perm | mode&^fs.FileMode(0o777),
-	}, nil
-}
-
-// retrieveDACL retrieves the discretionary access control list, owner, and
-// group from the security descriptor of the file with the specified absolute
-// name.
-func retrieveDACL(absName string) (dacl *windows.ACL, owner, group *windows.SID, err error) {
-	// desiredSecInfo defines the parts of a security descriptor to retrieve.
-	const desiredSecInfo windows.SECURITY_INFORMATION = windows.OWNER_SECURITY_INFORMATION |
-		windows.GROUP_SECURITY_INFORMATION |
-		windows.DACL_SECURITY_INFORMATION |
-		windows.PROTECTED_DACL_SECURITY_INFORMATION |
-		windows.UNPROTECTED_DACL_SECURITY_INFORMATION
-
-	sd, err := windows.GetNamedSecurityInfo(absName, windows.SE_FILE_OBJECT, desiredSecInfo)
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("getting security descriptor: %w", err)
-	}
-
-	dacl, _, err = sd.DACL()
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("getting discretionary access control list: %w", err)
-	}
-
-	owner, _, err = sd.Owner()
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("getting owner sid: %w", err)
-	}
-
-	group, _, err = sd.Group()
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("getting group sid: %w", err)
-	}
-
-	return dacl, owner, group, nil
-}
-
-// chmod is a Windows implementation of [Chmod].
-func chmod(name string, perm fs.FileMode) (err error) {
-	fi, err := os.Stat(name)
-	if err != nil {
-		return fmt.Errorf("getting file info: %w", err)
-	}
-
-	entries := make([]windows.EXPLICIT_ACCESS, 0, 3)
-	creatorMask, groupMask, worldMask := permToMasks(perm, fi.IsDir())
-
-	sidMasks := []struct {
-		Key   windows.WELL_KNOWN_SID_TYPE
-		Value windows.ACCESS_MASK
-	}{{
-		Key:   windows.WinCreatorOwnerSid,
-		Value: creatorMask,
-	}, {
-		Key:   windows.WinCreatorGroupSid,
-		Value: groupMask,
-	}, {
-		Key:   windows.WinWorldSid,
-		Value: worldMask,
-	}}
-
-	var errs []error
-	for _, sidMask := range sidMasks {
-		if sidMask.Value == 0 {
-			continue
-		}
-
-		var trustee windows.TRUSTEE
-		trustee, err = newWellKnownTrustee(sidMask.Key)
-		if err != nil {
-			errs = append(errs, err)
-
-			continue
-		}
-
-		entries = append(entries, windows.EXPLICIT_ACCESS{
-			AccessPermissions: sidMask.Value,
-			AccessMode:        windows.GRANT_ACCESS,
-			Inheritance:       windows.NO_INHERITANCE,
-			Trustee:           trustee,
-		})
-	}
-
-	if err = errors.Join(errs...); err != nil {
-		return fmt.Errorf("creating access control entries: %w", err)
-	}
-
-	acl, err := windows.ACLFromEntries(entries, nil)
-	if err != nil {
-		return fmt.Errorf("creating access control list: %w", err)
-	}
-
-	// secInfo defines the parts of a security descriptor to set.
-	const secInfo windows.SECURITY_INFORMATION = windows.DACL_SECURITY_INFORMATION |
-		windows.PROTECTED_DACL_SECURITY_INFORMATION
-
-	err = windows.SetNamedSecurityInfo(name, windows.SE_FILE_OBJECT, secInfo, nil, nil, acl, nil)
-	if err != nil {
-		return fmt.Errorf("setting security descriptor: %w", err)
-	}
-
-	return nil
-}
-
-// mkdir is a Windows implementation of [Mkdir].
-//
-// TODO(e.burkov):  Consider using [windows.CreateDirectory] instead of
-// [os.Mkdir] to reduce the number of syscalls.
-func mkdir(name string, perm os.FileMode) (err error) {
-	name, err = filepath.Abs(name)
-	if err != nil {
-		return fmt.Errorf("computing absolute path: %w", err)
-	}
-
-	err = os.Mkdir(name, perm)
-	if err != nil {
-		return fmt.Errorf("creating directory: %w", err)
-	}
-
-	defer func() {
-		if err != nil {
-			err = errors.WithDeferred(err, os.Remove(name))
-		}
-	}()
-
-	return chmod(name, perm)
-}
-
-// mkdirAll is a Windows implementation of [MkdirAll].
-func mkdirAll(path string, perm os.FileMode) (err error) {
-	parent, _ := filepath.Split(path)
-
-	if parent != "" {
-		err = os.MkdirAll(parent, perm)
-		if err != nil && !errors.Is(err, os.ErrExist) {
-			return fmt.Errorf("creating parent directories: %w", err)
-		}
-	}
-
-	err = mkdir(path, perm)
-	if errors.Is(err, os.ErrExist) {
-		return nil
-	}
-
-	return err
-}
-
-// writeFile is a Windows implementation of [WriteFile].
-func writeFile(filename string, data []byte, perm os.FileMode) (err error) {
-	file, err := openFile(filename, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, perm)
-	if err != nil {
-		return fmt.Errorf("opening file: %w", err)
-	}
-	defer func() { err = errors.WithDeferred(err, file.Close()) }()
-
-	_, err = file.Write(data)
-	if err != nil {
-		return fmt.Errorf("writing data: %w", err)
-	}
-
-	return nil
-}
-
-// openFile is a Windows implementation of [OpenFile].
-func openFile(name string, flag int, perm os.FileMode) (file *os.File, err error) {
-	// Only change permissions if the file not yet exists, but should be
-	// created.
-	if flag&os.O_CREATE == 0 {
-		return os.OpenFile(name, flag, perm)
-	}
-
-	_, err = stat(name)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			defer func() { err = errors.WithDeferred(err, chmod(name, perm)) }()
-		} else {
-			return nil, fmt.Errorf("getting file info: %w", err)
-		}
-	}
-
-	return os.OpenFile(name, flag, perm)
-}
-
-// newWellKnownTrustee returns a trustee for a well-known SID.
-func newWellKnownTrustee(stype windows.WELL_KNOWN_SID_TYPE) (t windows.TRUSTEE, err error) {
-	sid, err := windows.CreateWellKnownSid(stype)
-	if err != nil {
-		return windows.TRUSTEE{}, fmt.Errorf("creating sid for type %d: %w", stype, err)
-	}
-
-	return windows.TRUSTEE{
-		TrusteeForm:  windows.TRUSTEE_IS_SID,
-		TrusteeValue: windows.TrusteeValueFromSID(sid),
-	}, nil
-}
-
-// UNIX file mode permission bits.
-const (
-	permRead    = 0b100
-	permWrite   = 0b010
-	permExecute = 0b001
-)
-
-// Windows access masks for appropriate UNIX file mode permission bits and
-// file types.
-const (
-	fileReadRights windows.ACCESS_MASK = windows.READ_CONTROL |
-		windows.FILE_READ_DATA |
-		windows.FILE_READ_ATTRIBUTES |
-		windows.FILE_READ_EA |
-		windows.SYNCHRONIZE |
-		windows.ACCESS_SYSTEM_SECURITY
-
-	fileWriteRights windows.ACCESS_MASK = windows.WRITE_DAC |
-		windows.WRITE_OWNER |
-		windows.FILE_WRITE_DATA |
-		windows.FILE_WRITE_ATTRIBUTES |
-		windows.FILE_WRITE_EA |
-		windows.DELETE |
-		windows.FILE_APPEND_DATA |
-		windows.SYNCHRONIZE |
-		windows.ACCESS_SYSTEM_SECURITY
-
-	fileExecuteRights windows.ACCESS_MASK = windows.FILE_EXECUTE
-
-	dirReadRights windows.ACCESS_MASK = windows.READ_CONTROL |
-		windows.FILE_LIST_DIRECTORY |
-		windows.FILE_READ_EA |
-		windows.FILE_READ_ATTRIBUTES<<1 |
-		windows.SYNCHRONIZE |
-		windows.ACCESS_SYSTEM_SECURITY
-
-	dirWriteRights windows.ACCESS_MASK = windows.WRITE_DAC |
-		windows.WRITE_OWNER |
-		windows.DELETE |
-		windows.FILE_WRITE_DATA |
-		windows.FILE_APPEND_DATA |
-		windows.FILE_WRITE_EA |
-		windows.FILE_WRITE_ATTRIBUTES<<1 |
-		windows.SYNCHRONIZE |
-		windows.ACCESS_SYSTEM_SECURITY
-
-	dirExecuteRights windows.ACCESS_MASK = windows.FILE_TRAVERSE
-)
-
-// permToMasks converts a UNIX file mode permissions to the corresponding
-// Windows access masks.  The [isDir] argument is used to set specific access
-// bits for directories.
-func permToMasks(fm os.FileMode, isDir bool) (owner, group, world windows.ACCESS_MASK) {
-	mask := fm.Perm()
-
-	owner = permToMask(byte((mask>>6)&0b111), isDir)
-	group = permToMask(byte((mask>>3)&0b111), isDir)
-	world = permToMask(byte(mask&0b111), isDir)
-
-	return owner, group, world
-}
-
-// permToMask converts a UNIX file mode permission bits within p byte to the
-// corresponding Windows access mask.  The [isDir] argument is used to set
-// specific access bits for directories.
-func permToMask(p byte, isDir bool) (mask windows.ACCESS_MASK) {
-	readRights, writeRights, executeRights := fileReadRights, fileWriteRights, fileExecuteRights
-	if isDir {
-		readRights, writeRights, executeRights = dirReadRights, dirWriteRights, dirExecuteRights
-	}
-
-	if p&permRead != 0 {
-		mask |= readRights
-	}
-	if p&permWrite != 0 {
-		mask |= writeRights
-	}
-	if p&permExecute != 0 {
-		mask |= executeRights
-	}
-
-	return mask
-}
-
-// masksToPerm converts Windows access masks to the corresponding UNIX file
-// mode permission bits.
-func masksToPerm(u, g, o windows.ACCESS_MASK, isDir bool) (perm fs.FileMode) {
-	perm |= fs.FileMode(maskToPerm(u, isDir)) << 6
-	perm |= fs.FileMode(maskToPerm(g, isDir)) << 3
-	perm |= fs.FileMode(maskToPerm(o, isDir))
-
-	return perm
-}
-
-// maskToPerm converts a Windows access mask to the corresponding UNIX file
-// mode permission bits.
-func maskToPerm(mask windows.ACCESS_MASK, isDir bool) (perm byte) {
-	readMask, writeMask, executeMask := fileReadRights, fileWriteRights, fileExecuteRights
-	if isDir {
-		readMask, writeMask, executeMask = dirReadRights, dirWriteRights, dirExecuteRights
-	}
-
-	// Remove common bits to avoid false positive detection of unset rights.
-	readMask ^= windows.SYNCHRONIZE | windows.ACCESS_SYSTEM_SECURITY
-	writeMask ^= windows.SYNCHRONIZE | windows.ACCESS_SYSTEM_SECURITY
-
-	if mask&readMask != 0 {
-		perm |= permRead
-	}
-	if mask&writeMask != 0 {
-		perm |= permWrite
-	}
-	if mask&executeMask != 0 {
-		perm |= permExecute
-	}
-
-	return perm
-}
--- a/internal/aghos/permission_windows_internal_test.go
+++ b/internal/aghos/permission_windows_internal_test.go
@@ -1,135 +0,0 @@
-//go:build windows
-
-package aghos
-
-import (
-	"io/fs"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"golang.org/x/sys/windows"
-)
-
-func TestPermToMasks(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name      string
-		perm      fs.FileMode
-		wantUser  windows.ACCESS_MASK
-		wantGroup windows.ACCESS_MASK
-		wantOther windows.ACCESS_MASK
-		isDir     bool
-	}{{
-		name:      "all",
-		perm:      0b111_111_111,
-		wantUser:  fileReadRights | fileWriteRights | fileExecuteRights,
-		wantGroup: fileReadRights | fileWriteRights | fileExecuteRights,
-		wantOther: fileReadRights | fileWriteRights | fileExecuteRights,
-		isDir:     false,
-	}, {
-		name:      "user_write",
-		perm:      0b010_000_000,
-		wantUser:  fileWriteRights,
-		wantGroup: 0,
-		wantOther: 0,
-		isDir:     false,
-	}, {
-		name:      "group_read",
-		perm:      0b000_100_000,
-		wantUser:  0,
-		wantGroup: fileReadRights,
-		wantOther: 0,
-		isDir:     false,
-	}, {
-		name:      "all_dir",
-		perm:      0b111_111_111,
-		wantUser:  dirReadRights | dirWriteRights | dirExecuteRights,
-		wantGroup: dirReadRights | dirWriteRights | dirExecuteRights,
-		wantOther: dirReadRights | dirWriteRights | dirExecuteRights,
-		isDir:     true,
-	}, {
-		name:      "user_write_dir",
-		perm:      0b010_000_000,
-		wantUser:  dirWriteRights,
-		wantGroup: 0,
-		wantOther: 0,
-		isDir:     true,
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			user, group, other := permToMasks(tc.perm, tc.isDir)
-			assert.Equal(t, tc.wantUser, user)
-			assert.Equal(t, tc.wantGroup, group)
-			assert.Equal(t, tc.wantOther, other)
-		})
-	}
-}
-
-func TestMasksToPerm(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name     string
-		user     windows.ACCESS_MASK
-		group    windows.ACCESS_MASK
-		other    windows.ACCESS_MASK
-		wantPerm fs.FileMode
-		isDir    bool
-	}{{
-		name:     "all",
-		user:     fileReadRights | fileWriteRights | fileExecuteRights,
-		group:    fileReadRights | fileWriteRights | fileExecuteRights,
-		other:    fileReadRights | fileWriteRights | fileExecuteRights,
-		wantPerm: 0b111_111_111,
-		isDir:    false,
-	}, {
-		name:     "user_write",
-		user:     fileWriteRights,
-		group:    0,
-		other:    0,
-		wantPerm: 0b010_000_000,
-		isDir:    false,
-	}, {
-		name:     "group_read",
-		user:     0,
-		group:    fileReadRights,
-		other:    0,
-		wantPerm: 0b000_100_000,
-		isDir:    false,
-	}, {
-		name:     "no_access",
-		user:     0,
-		group:    0,
-		other:    0,
-		wantPerm: 0,
-		isDir:    false,
-	}, {
-		name:     "all_dir",
-		user:     dirReadRights | dirWriteRights | dirExecuteRights,
-		group:    dirReadRights | dirWriteRights | dirExecuteRights,
-		other:    dirReadRights | dirWriteRights | dirExecuteRights,
-		wantPerm: 0b111_111_111,
-		isDir:    true,
-	}, {
-		name:     "user_write_dir",
-		user:     dirWriteRights,
-		group:    0,
-		other:    0,
-		wantPerm: 0b010_000_000,
-		isDir:    true,
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			// Don't call [fs.FileMode.Perm] since the result is expected to
-			// contain only the permission bits.
-			assert.Equal(t, tc.wantPerm, masksToPerm(tc.user, tc.group, tc.other, tc.isDir))
-		})
-	}
-}
--- a/internal/aghrenameio/renameio_windows.go
+++ b/internal/aghrenameio/renameio_windows.go
@@ -8,7 +8,6 @@ import (
 	"os"
 	"path/filepath"

-	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/golibs/errors"
 )

@@ -63,7 +62,7 @@ func newPendingFile(filePath string, mode fs.FileMode) (f PendingFile, err error
 		return nil, fmt.Errorf("opening pending file: %w", err)
 	}

-	err = aghos.Chmod(file.Name(), mode)
+	err = file.Chmod(mode)
 	if err != nil {
 		return nil, fmt.Errorf("preparing pending file: %w", err)
 	}
--- a/internal/aghtest/interface.go
+++ b/internal/aghtest/interface.go
@@ -89,14 +89,14 @@ func (s *ServiceWithConfig[ConfigType]) Config() (c ConfigType) {
 // AddressProcessor is a fake [client.AddressProcessor] implementation for
 // tests.
 type AddressProcessor struct {
-	OnProcess func(ctx context.Context, ip netip.Addr)
+	OnProcess func(ip netip.Addr)
 	OnClose   func() (err error)
 }

 // Process implements the [client.AddressProcessor] interface for
 // *AddressProcessor.
-func (p *AddressProcessor) Process(ctx context.Context, ip netip.Addr) {
-	p.OnProcess(ctx, ip)
+func (p *AddressProcessor) Process(ip netip.Addr) {
+	p.OnProcess(ip)
 }

 // Close implements the [client.AddressProcessor] interface for
@@ -107,18 +107,13 @@ func (p *AddressProcessor) Close() (err error) {

 // AddressUpdater is a fake [client.AddressUpdater] implementation for tests.
 type AddressUpdater struct {
-	OnUpdateAddress func(ctx context.Context, ip netip.Addr, host string, info *whois.Info)
+	OnUpdateAddress func(ip netip.Addr, host string, info *whois.Info)
 }

 // UpdateAddress implements the [client.AddressUpdater] interface for
 // *AddressUpdater.
-func (p *AddressUpdater) UpdateAddress(
-	ctx context.Context,
-	ip netip.Addr,
-	host string,
-	info *whois.Info,
-) {
-	p.OnUpdateAddress(ctx, ip, host, info)
+func (p *AddressUpdater) UpdateAddress(ip netip.Addr, host string, info *whois.Info) {
+	p.OnUpdateAddress(ip, host, info)
 }

 // Package dnsforward
--- a/internal/arpdb/arpdb.go
+++ b/internal/arpdb/arpdb.go
@@ -5,7 +5,6 @@ import (
 	"bufio"
 	"bytes"
 	"fmt"
-	"log/slog"
 	"net"
 	"net/netip"
 	"slices"
@@ -13,7 +12,7 @@ import (

 	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/AdguardTeam/golibs/osutil"
 )
@@ -39,8 +38,8 @@ type Interface interface {
 }

 // New returns the [Interface] properly initialized for the OS.
-func New(logger *slog.Logger) (arp Interface) {
-	return newARPDB(logger)
+func New() (arp Interface) {
+	return newARPDB()
 }

 // Empty is the [Interface] implementation that does nothing.
@@ -70,30 +69,6 @@ type Neighbor struct {
 	MAC net.HardwareAddr
 }

-// newNeighbor returns the new initialized [Neighbor] by parsing string
-// representations of IP and MAC addresses.
-func newNeighbor(host, ipStr, macStr string) (n *Neighbor, err error) {
-	defer func() { err = errors.Annotate(err, "getting arp neighbor: %w") }()
-
-	ip, err := netip.ParseAddr(ipStr)
-	if err != nil {
-		// Don't wrap the error, as it will get annotated.
-		return nil, err
-	}
-
-	mac, err := net.ParseMAC(macStr)
-	if err != nil {
-		// Don't wrap the error, as it will get annotated.
-		return nil, err
-	}
-
-	return &Neighbor{
-		Name: host,
-		IP:   ip,
-		MAC:  mac,
-	}, nil
-}
-
 // Clone returns the deep copy of n.
 func (n Neighbor) Clone() (clone Neighbor) {
 	return Neighbor{
@@ -105,10 +80,10 @@ func (n Neighbor) Clone() (clone Neighbor) {

 // validatedHostname returns h if it's a valid hostname, or an empty string
 // otherwise, logging the validation error.
-func validatedHostname(logger *slog.Logger, h string) (host string) {
+func validatedHostname(h string) (host string) {
 	err := netutil.ValidateHostname(h)
 	if err != nil {
-		logger.Debug("parsing host of arp output", slogutil.KeyError, err)
+		log.Debug("arpdb: parsing arp output: host: %s", err)

 		return ""
 	}
@@ -157,18 +132,15 @@ func (ns *neighs) reset(with []Neighbor) {
 // parseNeighsFunc parses the text from sc as if it'd be an output of some
 // ARP-related command.  lenHint is a hint for the size of the allocated slice
 // of Neighbors.
-//
-// TODO(s.chzhen):  Return []*Neighbor instead.
-type parseNeighsFunc func(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighbor)
+type parseNeighsFunc func(sc *bufio.Scanner, lenHint int) (ns []Neighbor)

 // cmdARPDB is the implementation of the [Interface] that uses command line to
 // retrieve data.
 type cmdARPDB struct {
-	logger *slog.Logger
-	parse  parseNeighsFunc
-	ns     *neighs
-	cmd    string
-	args   []string
+	parse parseNeighsFunc
+	ns    *neighs
+	cmd   string
+	args  []string
 }

 // type check
@@ -186,7 +158,7 @@ func (arp *cmdARPDB) Refresh() (err error) {
 	}

 	sc := bufio.NewScanner(bytes.NewReader(out))
-	ns := arp.parse(arp.logger, sc, arp.ns.len())
+	ns := arp.parse(sc, arp.ns.len())
 	if err = sc.Err(); err != nil {
 		// TODO(e.burkov):  This error seems unreachable.  Investigate.
 		return fmt.Errorf("scanning the output: %w", err)
--- a/internal/arpdb/arpdb_bsd.go
+++ b/internal/arpdb/arpdb_bsd.go
@@ -4,17 +4,17 @@ package arpdb

 import (
 	"bufio"
-	"log/slog"
+	"net"
+	"net/netip"
 	"strings"
 	"sync"

-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 )

-func newARPDB(logger *slog.Logger) (arp *cmdARPDB) {
+func newARPDB() (arp *cmdARPDB) {
 	return &cmdARPDB{
-		logger: logger,
-		parse:  parseArpA,
+		parse: parseArpA,
 		ns: &neighs{
 			mu: &sync.RWMutex{},
 			ns: make([]Neighbor, 0),
@@ -33,7 +33,7 @@ func newARPDB(logger *slog.Logger) (arp *cmdARPDB) {
 // The expected input format:
 //
 //	host.name (192.168.0.1) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]
-func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
+func parseArpA(sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
 	ns = make([]Neighbor, 0, lenHint)
 	for sc.Scan() {
 		ln := sc.Text()
@@ -48,15 +48,26 @@ func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighb
 			continue
 		}

-		host := validatedHostname(logger, fields[0])
-		n, err := newNeighbor(host, ipStr[1:len(ipStr)-1], fields[3])
+		ip, err := netip.ParseAddr(ipStr[1 : len(ipStr)-1])
 		if err != nil {
-			logger.Debug("parsing arp output", "line", ln, slogutil.KeyError, err)
+			log.Debug("arpdb: parsing arp output: ip: %s", err)

 			continue
 		}

-		ns = append(ns, *n)
+		hwStr := fields[3]
+		mac, err := net.ParseMAC(hwStr)
+		if err != nil {
+			log.Debug("arpdb: parsing arp output: mac: %s", err)
+
+			continue
+		}
+
+		ns = append(ns, Neighbor{
+			IP:   ip,
+			MAC:  mac,
+			Name: validatedHostname(fields[0]),
+		})
 	}

 	return ns
--- a/internal/arpdb/arpdb_internal_test.go
+++ b/internal/arpdb/arpdb_internal_test.go
@@ -11,7 +11,6 @@ import (
 	"testing"

 	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -62,7 +61,7 @@ func (s mapShell) RunCmd(cmd string, args ...string) (code int, out []byte, err

 func Test_New(t *testing.T) {
 	var a Interface
-	require.NotPanics(t, func() { a = New(slogutil.NewDiscardLogger()) })
+	require.NotPanics(t, func() { a = New() })

 	assert.NotNil(t, a)
 }
@@ -202,9 +201,8 @@ func Test_NewARPDBs(t *testing.T) {

 func TestCmdARPDB_arpa(t *testing.T) {
 	a := &cmdARPDB{
-		logger: slogutil.NewDiscardLogger(),
-		cmd:    "cmd",
-		parse:  parseArpA,
+		cmd:   "cmd",
+		parse: parseArpA,
 		ns: &neighs{
 			mu: &sync.RWMutex{},
 			ns: make([]Neighbor, 0),
--- a/internal/arpdb/arpdb_linux.go
+++ b/internal/arpdb/arpdb_linux.go
@@ -6,18 +6,17 @@ import (
 	"bufio"
 	"fmt"
 	"io/fs"
-	"log/slog"
 	"net"
 	"net/netip"
 	"strings"
 	"sync"

 	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/stringutil"
 )

-func newARPDB(logger *slog.Logger) (arp *arpdbs) {
+func newARPDB() (arp *arpdbs) {
 	// Use the common storage among the implementations.
 	ns := &neighs{
 		mu: &sync.RWMutex{},
@@ -40,10 +39,9 @@ func newARPDB(logger *slog.Logger) (arp *arpdbs) {
 		},
 		// Then, try "arp -a -n".
 		&cmdARPDB{
-			logger: logger,
-			parse:  parseF,
-			ns:     ns,
-			cmd:    "arp",
+			parse: parseF,
+			ns:    ns,
+			cmd:   "arp",
 			// Use -n flag to avoid resolving the hostnames of the neighbors.
 			// By default ARP attempts to resolve the hostnames via DNS.  See
 			// man 8 arp.
@@ -53,11 +51,10 @@ func newARPDB(logger *slog.Logger) (arp *arpdbs) {
 		},
 		// Finally, try "ip neigh".
 		&cmdARPDB{
-			logger: logger,
-			parse:  parseIPNeigh,
-			ns:     ns,
-			cmd:    "ip",
-			args:   []string{"neigh"},
+			parse: parseIPNeigh,
+			ns:    ns,
+			cmd:   "ip",
+			args:  []string{"neigh"},
 		},
 	)
 }
@@ -134,7 +131,7 @@ func (arp *fsysARPDB) Neighbors() (ns []Neighbor) {
 //
 //	IP address     HW type  Flags  HW address         Mask  Device
 //	192.168.11.98  0x1      0x2    5a:92:df:a9:7e:28  *     wan
-func parseArpAWrt(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
+func parseArpAWrt(sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
 	if !sc.Scan() {
 		// Skip the header.
 		return
@@ -149,14 +146,25 @@ func parseArpAWrt(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Nei
 			continue
 		}

-		n, err := newNeighbor("", fields[0], fields[3])
+		ip, err := netip.ParseAddr(fields[0])
 		if err != nil {
-			logger.Debug("parsing arp output", "line", ln, slogutil.KeyError, err)
+			log.Debug("arpdb: parsing arp output: ip: %s", err)

 			continue
 		}

-		ns = append(ns, *n)
+		hwStr := fields[3]
+		mac, err := net.ParseMAC(hwStr)
+		if err != nil {
+			log.Debug("arpdb: parsing arp output: mac: %s", err)
+
+			continue
+		}
+
+		ns = append(ns, Neighbor{
+			IP:  ip,
+			MAC: mac,
+		})
 	}

 	return ns
@@ -166,7 +174,7 @@ func parseArpAWrt(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Nei
 // expected input format:
 //
 //	hostname (192.168.1.1) at ab:cd:ef:ab:cd:ef [ether] on enp0s3
-func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
+func parseArpA(sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
 	ns = make([]Neighbor, 0, lenHint)
 	for sc.Scan() {
 		ln := sc.Text()
@@ -181,15 +189,26 @@ func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighb
 			continue
 		}

-		host := validatedHostname(logger, fields[0])
-		n, err := newNeighbor(host, ipStr[1:len(ipStr)-1], fields[3])
+		ip, err := netip.ParseAddr(ipStr[1 : len(ipStr)-1])
 		if err != nil {
-			logger.Debug("parsing arp output", "line", ln, slogutil.KeyError, err)
+			log.Debug("arpdb: parsing arp output: ip: %s", err)

 			continue
 		}

-		ns = append(ns, *n)
+		hwStr := fields[3]
+		mac, err := net.ParseMAC(hwStr)
+		if err != nil {
+			log.Debug("arpdb: parsing arp output: mac: %s", err)
+
+			continue
+		}
+
+		ns = append(ns, Neighbor{
+			IP:   ip,
+			MAC:  mac,
+			Name: validatedHostname(fields[0]),
+		})
 	}

 	return ns
@@ -199,7 +218,7 @@ func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighb
 // expected input format:
 //
 //	192.168.1.1 dev enp0s3 lladdr ab:cd:ef:ab:cd:ef REACHABLE
-func parseIPNeigh(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
+func parseIPNeigh(sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
 	ns = make([]Neighbor, 0, lenHint)
 	for sc.Scan() {
 		ln := sc.Text()
@@ -209,14 +228,27 @@ func parseIPNeigh(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Nei
 			continue
 		}

-		n, err := newNeighbor("", fields[0], fields[4])
+		n := Neighbor{}
+
+		ip, err := netip.ParseAddr(fields[0])
 		if err != nil {
-			logger.Debug("parsing arp output", "line", ln, slogutil.KeyError, err)
+			log.Debug("arpdb: parsing arp output: ip: %s", err)

 			continue
+		} else {
+			n.IP = ip
 		}

-		ns = append(ns, *n)
+		mac, err := net.ParseMAC(fields[4])
+		if err != nil {
+			log.Debug("arpdb: parsing arp output: mac: %s", err)
+
+			continue
+		} else {
+			n.MAC = mac
+		}
+
+		ns = append(ns, n)
 	}

 	return ns
--- a/internal/arpdb/arpdb_linux_internal_test.go
+++ b/internal/arpdb/arpdb_linux_internal_test.go
@@ -9,7 +9,6 @@ import (
 	"testing"
 	"testing/fstest"

-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -70,10 +69,9 @@ func TestCmdARPDB_linux(t *testing.T) {

 	t.Run("wrt", func(t *testing.T) {
 		a := &cmdARPDB{
-			logger: slogutil.NewDiscardLogger(),
-			parse:  parseArpAWrt,
-			cmd:    "arp",
-			args:   []string{"-a"},
+			parse: parseArpAWrt,
+			cmd:   "arp",
+			args:  []string{"-a"},
 			ns: &neighs{
 				mu: &sync.RWMutex{},
 				ns: make([]Neighbor, 0),
@@ -88,10 +86,9 @@ func TestCmdARPDB_linux(t *testing.T) {

 	t.Run("ip_neigh", func(t *testing.T) {
 		a := &cmdARPDB{
-			logger: slogutil.NewDiscardLogger(),
-			parse:  parseIPNeigh,
-			cmd:    "ip",
-			args:   []string{"neigh"},
+			parse: parseIPNeigh,
+			cmd:   "ip",
+			args:  []string{"neigh"},
 			ns: &neighs{
 				mu: &sync.RWMutex{},
 				ns: make([]Neighbor, 0),
--- a/internal/arpdb/arpdb_openbsd.go
+++ b/internal/arpdb/arpdb_openbsd.go
@@ -4,17 +4,17 @@ package arpdb

 import (
 	"bufio"
-	"log/slog"
+	"net"
+	"net/netip"
 	"strings"
 	"sync"

-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 )

-func newARPDB(logger *slog.Logger) (arp *cmdARPDB) {
+func newARPDB() (arp *cmdARPDB) {
 	return &cmdARPDB{
-		logger: logger,
-		parse:  parseArpA,
+		parse: parseArpA,
 		ns: &neighs{
 			mu: &sync.RWMutex{},
 			ns: make([]Neighbor, 0),
@@ -34,7 +34,7 @@ func newARPDB(logger *slog.Logger) (arp *cmdARPDB) {
 //
 //	Host        Ethernet Address  Netif Expire    Flags
 //	192.168.1.1 ab:cd:ef:ab:cd:ef   em0 19m59s
-func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
+func parseArpA(sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
 	// Skip the header.
 	if !sc.Scan() {
 		return nil
@@ -49,14 +49,27 @@ func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighb
 			continue
 		}

-		n, err := newNeighbor("", fields[0], fields[1])
+		n := Neighbor{}
+
+		ip, err := netip.ParseAddr(fields[0])
 		if err != nil {
-			logger.Debug("parsing arp output", "line", ln, slogutil.KeyError, err)
+			log.Debug("arpdb: parsing arp output: ip: %s", err)

 			continue
+		} else {
+			n.IP = ip
 		}

-		ns = append(ns, *n)
+		mac, err := net.ParseMAC(fields[1])
+		if err != nil {
+			log.Debug("arpdb: parsing arp output: mac: %s", err)
+
+			continue
+		} else {
+			n.MAC = mac
+		}
+
+		ns = append(ns, n)
 	}

 	return ns
--- a/internal/arpdb/arpdb_windows.go
+++ b/internal/arpdb/arpdb_windows.go
@@ -4,17 +4,17 @@ package arpdb

 import (
 	"bufio"
-	"log/slog"
+	"net"
+	"net/netip"
 	"strings"
 	"sync"

-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 )

-func newARPDB(logger *slog.Logger) (arp *cmdARPDB) {
+func newARPDB() (arp *cmdARPDB) {
 	return &cmdARPDB{
-		logger: logger,
-		parse:  parseArpA,
+		parse: parseArpA,
 		ns: &neighs{
 			mu: &sync.RWMutex{},
 			ns: make([]Neighbor, 0),
@@ -31,7 +31,7 @@ func newARPDB(logger *slog.Logger) (arp *cmdARPDB) {
 //	  Internet Address      Physical Address      Type
 //	  192.168.56.1          0a-00-27-00-00-00     dynamic
 //	  192.168.56.255        ff-ff-ff-ff-ff-ff     static
-func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
+func parseArpA(sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
 	ns = make([]Neighbor, 0, lenHint)
 	for sc.Scan() {
 		ln := sc.Text()
@@ -44,14 +44,24 @@ func parseArpA(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighb
 			continue
 		}

-		n, err := newNeighbor("", fields[0], fields[1])
+		ip, err := netip.ParseAddr(fields[0])
 		if err != nil {
-			logger.Debug("parsing arp output", "line", ln, slogutil.KeyError, err)
+			log.Debug("arpdb: parsing arp output: ip: %s", err)

 			continue
 		}

-		ns = append(ns, *n)
+		mac, err := net.ParseMAC(fields[1])
+		if err != nil {
+			log.Debug("arpdb: parsing arp output: mac: %s", err)
+
+			continue
+		}
+
+		ns = append(ns, Neighbor{
+			IP:  ip,
+			MAC: mac,
+		})
 	}

 	return ns
--- a/internal/client/addrproc.go
+++ b/internal/client/addrproc.go
@@ -2,7 +2,6 @@ package client

 import (
 	"context"
-	"log/slog"
 	"net/netip"
 	"sync"
 	"time"
@@ -11,7 +10,7 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/rdns"
 	"github.com/AdguardTeam/AdGuardHome/internal/whois"
 	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/netutil"
 )

@@ -21,7 +20,7 @@ const ErrClosed errors.Error = "use of closed address processor"

 // AddressProcessor is the interface for types that can process clients.
 type AddressProcessor interface {
-	Process(ctx context.Context, ip netip.Addr)
+	Process(ip netip.Addr)
 	Close() (err error)
 }

@@ -32,17 +31,13 @@ type EmptyAddrProc struct{}
 var _ AddressProcessor = EmptyAddrProc{}

 // Process implements the [AddressProcessor] interface for EmptyAddrProc.
-func (EmptyAddrProc) Process(_ context.Context, _ netip.Addr) {}
+func (EmptyAddrProc) Process(_ netip.Addr) {}

 // Close implements the [AddressProcessor] interface for EmptyAddrProc.
 func (EmptyAddrProc) Close() (_ error) { return nil }

 // DefaultAddrProcConfig is the configuration structure for address processors.
 type DefaultAddrProcConfig struct {
-	// BaseLogger is used to create loggers with custom prefixes for sources of
-	// information about runtime clients.  It must not be nil.
-	BaseLogger *slog.Logger
-
 	// DialContext is used to create TCP connections to WHOIS servers.
 	// DialContext must not be nil if [DefaultAddrProcConfig.UseWHOIS] is true.
 	DialContext aghnet.DialContextFunc
@@ -89,15 +84,12 @@ type DefaultAddrProcConfig struct {
 type AddressUpdater interface {
 	// UpdateAddress updates information about an IP address, setting host (if
 	// not empty) and WHOIS information (if not nil).
-	UpdateAddress(ctx context.Context, ip netip.Addr, host string, info *whois.Info)
+	UpdateAddress(ip netip.Addr, host string, info *whois.Info)
 }

 // DefaultAddrProc processes incoming client addresses with rDNS and WHOIS, if
 // configured, and updates that information in a client storage.
 type DefaultAddrProc struct {
-	// logger is used to log the operation of address processor.
-	logger *slog.Logger
-
 	// clientIPsMu serializes closure of clientIPs and access to isClosed.
 	clientIPsMu *sync.Mutex

@@ -144,7 +136,6 @@ const (
 // not be nil.
 func NewDefaultAddrProc(c *DefaultAddrProcConfig) (p *DefaultAddrProc) {
 	p = &DefaultAddrProc{
-		logger:         c.BaseLogger.With(slogutil.KeyPrefix, "addrproc"),
 		clientIPsMu:    &sync.Mutex{},
 		clientIPs:      make(chan netip.Addr, defaultQueueSize),
 		rdns:           &rdns.Empty{},
@@ -156,7 +147,6 @@ func NewDefaultAddrProc(c *DefaultAddrProcConfig) (p *DefaultAddrProc) {

 	if c.UseRDNS {
 		p.rdns = rdns.New(&rdns.Config{
-			Logger:    c.BaseLogger.With(slogutil.KeyPrefix, "rdns"),
 			Exchanger: c.Exchanger,
 			CacheSize: defaultCacheSize,
 			CacheTTL:  defaultIPTTL,
@@ -164,16 +154,13 @@ func NewDefaultAddrProc(c *DefaultAddrProcConfig) (p *DefaultAddrProc) {
 	}

 	if c.UseWHOIS {
-		p.whois = newWHOIS(c.BaseLogger.With(slogutil.KeyPrefix, "whois"), c.DialContext)
+		p.whois = newWHOIS(c.DialContext)
 	}

-	// TODO(s.chzhen):  Pass context.
-	ctx := context.TODO()
-
-	go p.process(ctx, c.CatchPanics)
+	go p.process(c.CatchPanics)

 	for _, ip := range c.InitialAddresses {
-		p.Process(ctx, ip)
+		p.Process(ip)
 	}

 	return p
@@ -181,7 +168,7 @@ func NewDefaultAddrProc(c *DefaultAddrProcConfig) (p *DefaultAddrProc) {

 // newWHOIS returns a whois.Interface instance using the given function for
 // dialing.
-func newWHOIS(logger *slog.Logger, dialFunc aghnet.DialContextFunc) (w whois.Interface) {
+func newWHOIS(dialFunc aghnet.DialContextFunc) (w whois.Interface) {
 	// TODO(s.chzhen):  Consider making configurable.
 	const (
 		// defaultTimeout is the timeout for WHOIS requests.
@@ -199,7 +186,6 @@ func newWHOIS(logger *slog.Logger, dialFunc aghnet.DialContextFunc) (w whois.Int
 	)

 	return whois.New(&whois.Config{
-		Logger:          logger,
 		DialContext:     dialFunc,
 		ServerAddr:      whois.DefaultServer,
 		Port:            whois.DefaultPort,
@@ -216,7 +202,7 @@ func newWHOIS(logger *slog.Logger, dialFunc aghnet.DialContextFunc) (w whois.Int
 var _ AddressProcessor = (*DefaultAddrProc)(nil)

 // Process implements the [AddressProcessor] interface for *DefaultAddrProc.
-func (p *DefaultAddrProc) Process(ctx context.Context, ip netip.Addr) {
+func (p *DefaultAddrProc) Process(ip netip.Addr) {
 	p.clientIPsMu.Lock()
 	defer p.clientIPsMu.Unlock()

@@ -228,42 +214,36 @@ func (p *DefaultAddrProc) Process(ctx context.Context, ip netip.Addr) {
 	case p.clientIPs <- ip:
 		// Go on.
 	default:
-		p.logger.DebugContext(ctx, "ip channel is full", "len", len(p.clientIPs))
+		log.Debug("clients: ip channel is full; len: %d", len(p.clientIPs))
 	}
 }

 // process processes the incoming client IP-address information.  It is intended
 // to be used as a goroutine.  Once clientIPs is closed, process exits.
-func (p *DefaultAddrProc) process(ctx context.Context, catchPanics bool) {
+func (p *DefaultAddrProc) process(catchPanics bool) {
 	if catchPanics {
-		defer slogutil.RecoverAndLog(ctx, p.logger)
+		defer log.OnPanic("addrProcessor.process")
 	}

-	p.logger.InfoContext(ctx, "processing addresses")
+	log.Info("clients: processing addresses")

 	for ip := range p.clientIPs {
-		host := p.processRDNS(ctx, ip)
-		info := p.processWHOIS(ctx, ip)
+		host := p.processRDNS(ip)
+		info := p.processWHOIS(ip)

-		p.addrUpdater.UpdateAddress(ctx, ip, host, info)
+		p.addrUpdater.UpdateAddress(ip, host, info)
 	}

-	p.logger.InfoContext(ctx, "finished processing addresses")
+	log.Info("clients: finished processing addresses")
 }

 // processRDNS resolves the clients' IP addresses using reverse DNS.  host is
 // empty if there were errors or if the information hasn't changed.
-func (p *DefaultAddrProc) processRDNS(ctx context.Context, ip netip.Addr) (host string) {
+func (p *DefaultAddrProc) processRDNS(ip netip.Addr) (host string) {
 	start := time.Now()
-	p.logger.DebugContext(ctx, "processing rdns", "ip", ip)
+	log.Debug("clients: processing %s with rdns", ip)
 	defer func() {
-		p.logger.DebugContext(
-			ctx,
-			"finished processing rdns",
-			"ip", ip,
-			"host", host,
-			"elapsed", time.Since(start),
-		)
+		log.Debug("clients: finished processing %s with rdns in %s", ip, time.Since(start))
 	}()

 	ok := p.shouldResolve(ip)
@@ -271,7 +251,7 @@ func (p *DefaultAddrProc) processRDNS(ctx context.Context, ip netip.Addr) (host
 		return
 	}

-	host, changed := p.rdns.Process(ctx, ip)
+	host, changed := p.rdns.Process(ip)
 	if !changed {
 		host = ""
 	}
@@ -288,22 +268,16 @@ func (p *DefaultAddrProc) shouldResolve(ip netip.Addr) (ok bool) {
 // processWHOIS looks up the information about clients' IP addresses in the
 // WHOIS databases.  info is nil if there were errors or if the information
 // hasn't changed.
-func (p *DefaultAddrProc) processWHOIS(ctx context.Context, ip netip.Addr) (info *whois.Info) {
+func (p *DefaultAddrProc) processWHOIS(ip netip.Addr) (info *whois.Info) {
 	start := time.Now()
-	p.logger.DebugContext(ctx, "processing whois", "ip", ip)
+	log.Debug("clients: processing %s with whois", ip)
 	defer func() {
-		p.logger.DebugContext(
-			ctx,
-			"finished processing whois",
-			"ip", ip,
-			"whois", info,
-			"elapsed", time.Since(start),
-		)
+		log.Debug("clients: finished processing %s with whois in %s", ip, time.Since(start))
 	}()

 	// TODO(s.chzhen):  Move the timeout logic from WHOIS configuration to the
 	// context.
-	info, changed := p.whois.Process(ctx, ip)
+	info, changed := p.whois.Process(context.Background(), ip)
 	if !changed {
 		info = nil
 	}
--- a/internal/client/addrproc_test.go
+++ b/internal/client/addrproc_test.go
@@ -13,7 +13,6 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/client"
 	"github.com/AdguardTeam/AdGuardHome/internal/whois"
 	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/AdguardTeam/golibs/testutil/fakenet"
@@ -26,8 +25,7 @@ func TestEmptyAddrProc(t *testing.T) {
 	p := client.EmptyAddrProc{}

 	assert.NotPanics(t, func() {
-		ctx := testutil.ContextWithTimeout(t, testTimeout)
-		p.Process(ctx, testIP)
+		p.Process(testIP)
 	})

 	assert.NotPanics(t, func() {
@@ -101,7 +99,6 @@ func TestDefaultAddrProc_Process_rDNS(t *testing.T) {
 			updInfoCh := make(chan *whois.Info, 1)

 			p := client.NewDefaultAddrProc(&client.DefaultAddrProcConfig{
-				BaseLogger: slogutil.NewDiscardLogger(),
 				DialContext: func(_ context.Context, _, _ string) (conn net.Conn, err error) {
 					panic("not implemented")
 				},
@@ -121,8 +118,7 @@ func TestDefaultAddrProc_Process_rDNS(t *testing.T) {
 			})
 			testutil.CleanupAndRequireSuccess(t, p.Close)

-			ctx := testutil.ContextWithTimeout(t, testTimeout)
-			p.Process(ctx, tc.ip)
+			p.Process(tc.ip)

 			if !tc.wantUpd {
 				return
@@ -148,8 +144,8 @@ func newOnUpdateAddress(
 	ips chan<- netip.Addr,
 	hosts chan<- string,
 	infos chan<- *whois.Info,
-) (f func(ctx context.Context, ip netip.Addr, host string, info *whois.Info)) {
-	return func(ctx context.Context, ip netip.Addr, host string, info *whois.Info) {
+) (f func(ip netip.Addr, host string, info *whois.Info)) {
+	return func(ip netip.Addr, host string, info *whois.Info) {
 		if !want && (host != "" || info != nil) {
 			panic(fmt.Errorf("got unexpected update for %v with %q and %v", ip, host, info))
 		}
@@ -212,7 +208,6 @@ func TestDefaultAddrProc_Process_WHOIS(t *testing.T) {
 			updInfoCh := make(chan *whois.Info, 1)

 			p := client.NewDefaultAddrProc(&client.DefaultAddrProcConfig{
-				BaseLogger: slogutil.NewDiscardLogger(),
 				DialContext: func(_ context.Context, _, _ string) (conn net.Conn, err error) {
 					return whoisConn, nil
 				},
@@ -232,8 +227,7 @@ func TestDefaultAddrProc_Process_WHOIS(t *testing.T) {
 			})
 			testutil.CleanupAndRequireSuccess(t, p.Close)

-			ctx := testutil.ContextWithTimeout(t, testTimeout)
-			p.Process(ctx, testIP)
+			p.Process(testIP)

 			if !tc.wantUpd {
 				return
@@ -254,9 +248,7 @@ func TestDefaultAddrProc_Process_WHOIS(t *testing.T) {
 func TestDefaultAddrProc_Close(t *testing.T) {
 	t.Parallel()

-	p := client.NewDefaultAddrProc(&client.DefaultAddrProcConfig{
-		BaseLogger: slogutil.NewDiscardLogger(),
-	})
+	p := client.NewDefaultAddrProc(&client.DefaultAddrProcConfig{})

 	err := p.Close()
 	assert.NoError(t, err)
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -8,7 +8,6 @@ import (
 	"encoding"
 	"fmt"
 	"net/netip"
-	"slices"

 	"github.com/AdguardTeam/AdGuardHome/internal/whois"
 )
@@ -119,9 +118,8 @@ func (r *Runtime) Info() (cs Source, host string) {
 	return cs, info[0]
 }

-// setInfo sets a host as a client information from the cs.
-func (r *Runtime) setInfo(cs Source, hosts []string) {
-	// TODO(s.chzhen):  Use contract where hosts must contain non-empty host.
+// SetInfo sets a host as a client information from the cs.
+func (r *Runtime) SetInfo(cs Source, hosts []string) {
 	if len(hosts) == 1 && hosts[0] == "" {
 		hosts = []string{}
 	}
@@ -138,13 +136,13 @@ func (r *Runtime) setInfo(cs Source, hosts []string) {
 	}
 }

-// WHOIS returns a copy of WHOIS client information.
+// WHOIS returns a WHOIS client information.
 func (r *Runtime) WHOIS() (info *whois.Info) {
-	return r.whois.Clone()
+	return r.whois
 }

-// setWHOIS sets a WHOIS client information.  info must be non-nil.
-func (r *Runtime) setWHOIS(info *whois.Info) {
+// SetWHOIS sets a WHOIS client information.  info must be non-nil.
+func (r *Runtime) SetWHOIS(info *whois.Info) {
 	r.whois = info
 }

@@ -177,15 +175,3 @@ func (r *Runtime) isEmpty() (ok bool) {
 func (r *Runtime) Addr() (ip netip.Addr) {
 	return r.ip
 }
-
-// clone returns a deep copy of the runtime client.
-func (r *Runtime) clone() (c *Runtime) {
-	return &Runtime{
-		ip:        r.ip,
-		whois:     r.whois.Clone(),
-		arp:       slices.Clone(r.arp),
-		rdns:      slices.Clone(r.rdns),
-		dhcp:      slices.Clone(r.dhcp),
-		hostsFile: slices.Clone(r.hostsFile),
-	}
-}
--- a/internal/client/persistent.go
+++ b/internal/client/persistent.go
@@ -1,20 +1,21 @@
 package client

 import (
-	"context"
 	"encoding"
 	"fmt"
-	"log/slog"
 	"net"
 	"net/netip"
 	"slices"
 	"strings"
+	"time"

 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
+	"github.com/AdguardTeam/AdGuardHome/internal/filtering/safesearch"
 	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/dnsproxy/upstream"
+	"github.com/AdguardTeam/golibs/container"
 	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/google/uuid"
 )
@@ -135,8 +136,7 @@ type Persistent struct {
 }

 // validate returns an error if persistent client information contains errors.
-// allTags must be sorted.
-func (c *Persistent) validate(ctx context.Context, l *slog.Logger, allTags []string) (err error) {
+func (c *Persistent) validate(allTags *container.MapSet[string]) (err error) {
 	switch {
 	case c.Name == "":
 		return errors.Error("empty name")
@@ -153,12 +153,11 @@ func (c *Persistent) validate(ctx context.Context, l *slog.Logger, allTags []str

 	err = conf.Close()
 	if err != nil {
-		l.ErrorContext(ctx, "client: closing upstream config", slogutil.KeyError, err)
+		log.Error("client: closing upstream config: %s", err)
 	}

 	for _, t := range c.Tags {
-		_, ok := slices.BinarySearch(allTags, t)
-		if !ok {
+		if !allTags.Has(t) {
 			return fmt.Errorf("invalid tag: %q", t)
 		}
 	}
@@ -323,3 +322,20 @@ func (c *Persistent) CloseUpstreams() (err error) {

 	return nil
 }
+
+// SetSafeSearch initializes and sets the safe search filter for this client.
+func (c *Persistent) SetSafeSearch(
+	conf filtering.SafeSearchConfig,
+	cacheSize uint,
+	cacheTTL time.Duration,
+) (err error) {
+	ss, err := safesearch.NewDefault(conf, fmt.Sprintf("client %q", c.Name), cacheSize, cacheTTL)
+	if err != nil {
+		// Don't wrap the error, because it's informative enough as is.
+		return err
+	}
+
+	c.SafeSearch = ss
+
+	return nil
+}
--- a/internal/client/persistent_internal_test.go
+++ b/internal/client/persistent_internal_test.go
@@ -1,8 +1,11 @@
 package client

 import (
+	"net/netip"
 	"testing"

+	"github.com/AdguardTeam/golibs/container"
+	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -122,3 +125,69 @@ func TestPersistent_EqualIDs(t *testing.T) {
 		})
 	}
 }
+
+func TestPersistent_Validate(t *testing.T) {
+	const (
+		allowedTag    = "allowed_tag"
+		notAllowedTag = "not_allowed_tag"
+	)
+
+	allowedTags := container.NewMapSet(allowedTag)
+
+	testCases := []struct {
+		name       string
+		cli        *Persistent
+		wantErrMsg string
+	}{{
+		name: "success",
+		cli: &Persistent{
+			Name: "basic",
+			IPs: []netip.Addr{
+				netip.MustParseAddr("1.2.3.4"),
+			},
+			UID: MustNewUID(),
+		},
+		wantErrMsg: "",
+	}, {
+		name: "empty_name",
+		cli: &Persistent{
+			Name: "",
+		},
+		wantErrMsg: "empty name",
+	}, {
+		name: "no_id",
+		cli: &Persistent{
+			Name: "no_id",
+		},
+		wantErrMsg: "id required",
+	}, {
+		name: "no_uid",
+		cli: &Persistent{
+			Name: "no_uid",
+			IPs: []netip.Addr{
+				netip.MustParseAddr("1.2.3.4"),
+			},
+		},
+		wantErrMsg: "uid required",
+	}, {
+		name: "not_allowed_tag",
+		cli: &Persistent{
+			Name: "basic",
+			IPs: []netip.Addr{
+				netip.MustParseAddr("1.2.3.4"),
+			},
+			UID: MustNewUID(),
+			Tags: []string{
+				notAllowedTag,
+			},
+		},
+		wantErrMsg: `invalid tag: "` + notAllowedTag + `"`,
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.cli.validate(allowedTags)
+			testutil.AssertErrorMsg(t, tc.wantErrMsg, err)
+		})
+	}
+}
--- a/internal/client/runtimeindex.go
+++ b/internal/client/runtimeindex.go
@@ -2,34 +2,39 @@ package client

 import "net/netip"

-// runtimeIndex stores information about runtime clients.
-type runtimeIndex struct {
+// RuntimeIndex stores information about runtime clients.
+type RuntimeIndex struct {
 	// index maps IP address to runtime client.
 	index map[netip.Addr]*Runtime
 }

-// newRuntimeIndex returns initialized runtime index.
-func newRuntimeIndex() (ri *runtimeIndex) {
-	return &runtimeIndex{
+// NewRuntimeIndex returns initialized runtime index.
+func NewRuntimeIndex() (ri *RuntimeIndex) {
+	return &RuntimeIndex{
 		index: map[netip.Addr]*Runtime{},
 	}
 }

-// client returns the saved runtime client by ip.  If no such client exists,
+// Client returns the saved runtime client by ip.  If no such client exists,
 // returns nil.
-func (ri *runtimeIndex) client(ip netip.Addr) (rc *Runtime) {
+func (ri *RuntimeIndex) Client(ip netip.Addr) (rc *Runtime) {
 	return ri.index[ip]
 }

-// add saves the runtime client in the index.  IP address of a client must be
+// Add saves the runtime client in the index.  IP address of a client must be
 // unique.  See [Runtime.Client].  rc must not be nil.
-func (ri *runtimeIndex) add(rc *Runtime) {
+func (ri *RuntimeIndex) Add(rc *Runtime) {
 	ip := rc.Addr()
 	ri.index[ip] = rc
 }

-// rangeClients calls f for each runtime client in an undefined order.
-func (ri *runtimeIndex) rangeClients(f func(rc *Runtime) (cont bool)) {
+// Size returns the number of the runtime clients.
+func (ri *RuntimeIndex) Size() (n int) {
+	return len(ri.index)
+}
+
+// Range calls f for each runtime client in an undefined order.
+func (ri *RuntimeIndex) Range(f func(rc *Runtime) (cont bool)) {
 	for _, rc := range ri.index {
 		if !f(rc) {
 			return
@@ -37,31 +42,17 @@ func (ri *runtimeIndex) rangeClients(f func(rc *Runtime) (cont bool)) {
 	}
 }

-// setInfo sets the client information from cs for runtime client stored by ip.
-// If no such client exists, it creates one.
-func (ri *runtimeIndex) setInfo(ip netip.Addr, cs Source, hosts []string) (rc *Runtime) {
-	rc = ri.index[ip]
-	if rc == nil {
-		rc = NewRuntime(ip)
-		ri.add(rc)
-	}
-
-	rc.setInfo(cs, hosts)
-
-	return rc
+// Delete removes the runtime client by ip.
+func (ri *RuntimeIndex) Delete(ip netip.Addr) {
+	delete(ri.index, ip)
 }

-// clearSource removes information from the specified source from all clients.
-func (ri *runtimeIndex) clearSource(src Source) {
-	for _, rc := range ri.index {
-		rc.unset(src)
-	}
-}
-
-// removeEmpty removes empty runtime clients and returns the number of removed
-// clients.
-func (ri *runtimeIndex) removeEmpty() (n int) {
+// DeleteBySource removes all runtime clients that have information only from
+// the specified source and returns the number of removed clients.
+func (ri *RuntimeIndex) DeleteBySource(src Source) (n int) {
 	for ip, rc := range ri.index {
+		rc.unset(src)
+
 		if rc.isEmpty() {
 			delete(ri.index, ip)
 			n++
--- a/internal/client/runtimeindex_test.go
+++ b/internal/client/runtimeindex_test.go
@@ -0,0 +1,85 @@
+package client_test
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/client"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRuntimeIndex(t *testing.T) {
+	const cliSrc = client.SourceARP
+
+	var (
+		ip1 = netip.MustParseAddr("1.1.1.1")
+		ip2 = netip.MustParseAddr("2.2.2.2")
+		ip3 = netip.MustParseAddr("3.3.3.3")
+	)
+
+	ri := client.NewRuntimeIndex()
+	currentSize := 0
+
+	testCases := []struct {
+		ip    netip.Addr
+		name  string
+		hosts []string
+		src   client.Source
+	}{{
+		src:   cliSrc,
+		ip:    ip1,
+		name:  "1",
+		hosts: []string{"host1"},
+	}, {
+		src:   cliSrc,
+		ip:    ip2,
+		name:  "2",
+		hosts: []string{"host2"},
+	}, {
+		src:   cliSrc,
+		ip:    ip3,
+		name:  "3",
+		hosts: []string{"host3"},
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			rc := client.NewRuntime(tc.ip)
+			rc.SetInfo(tc.src, tc.hosts)
+
+			ri.Add(rc)
+			currentSize++
+
+			got := ri.Client(tc.ip)
+			assert.Equal(t, rc, got)
+		})
+	}
+
+	t.Run("size", func(t *testing.T) {
+		assert.Equal(t, currentSize, ri.Size())
+	})
+
+	t.Run("range", func(t *testing.T) {
+		s := 0
+
+		ri.Range(func(rc *client.Runtime) (cont bool) {
+			s++
+
+			return true
+		})
+
+		assert.Equal(t, currentSize, s)
+	})
+
+	t.Run("delete", func(t *testing.T) {
+		ri.Delete(ip1)
+		currentSize--
+
+		assert.Equal(t, currentSize, ri.Size())
+	})
+
+	t.Run("delete_by_src", func(t *testing.T) {
+		assert.Equal(t, currentSize, ri.DeleteBySource(cliSrc))
+		assert.Equal(t, 0, ri.Size())
+	})
+}
--- a/internal/client/storage.go
+++ b/internal/client/storage.go
@@ -1,122 +1,28 @@
 package client

 import (
-	"context"
 	"fmt"
-	"log/slog"
 	"net"
 	"net/netip"
-	"slices"
 	"sync"
-	"time"

-	"github.com/AdguardTeam/AdGuardHome/internal/arpdb"
-	"github.com/AdguardTeam/AdGuardHome/internal/dhcpsvc"
-	"github.com/AdguardTeam/AdGuardHome/internal/whois"
+	"github.com/AdguardTeam/golibs/container"
 	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/hostsfile"
 	"github.com/AdguardTeam/golibs/log"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 )

-// allowedTags is the list of available client tags.
-var allowedTags = []string{
-	"device_audio",
-	"device_camera",
-	"device_gameconsole",
-	"device_laptop",
-	"device_nas", // Network-attached Storage
-	"device_other",
-	"device_pc",
-	"device_phone",
-	"device_printer",
-	"device_securityalarm",
-	"device_tablet",
-	"device_tv",
-
-	"os_android",
-	"os_ios",
-	"os_linux",
-	"os_macos",
-	"os_other",
-	"os_windows",
-
-	"user_admin",
-	"user_child",
-	"user_regular",
-}
-
-// DHCP is an interface for accessing DHCP lease data the [Storage] needs.
-type DHCP interface {
-	// Leases returns all the DHCP leases.
-	Leases() (leases []*dhcpsvc.Lease)
-
-	// HostByIP returns the hostname of the DHCP client with the given IP
-	// address.  host will be empty if there is no such client, due to an
-	// assumption that a DHCP client must always have a hostname.
-	HostByIP(ip netip.Addr) (host string)
-
-	// MACByIP returns the MAC address for the given IP address leased.  It
-	// returns nil if there is no such client, due to an assumption that a DHCP
-	// client must always have a MAC address.
-	MACByIP(ip netip.Addr) (mac net.HardwareAddr)
-}
-
-// EmptyDHCP is the empty [DHCP] implementation that does nothing.
-type EmptyDHCP struct{}
-
-// type check
-var _ DHCP = EmptyDHCP{}
-
-// Leases implements the [DHCP] interface for emptyDHCP.
-func (EmptyDHCP) Leases() (leases []*dhcpsvc.Lease) { return nil }
-
-// HostByIP implements the [DHCP] interface for emptyDHCP.
-func (EmptyDHCP) HostByIP(_ netip.Addr) (host string) { return "" }
-
-// MACByIP implements the [DHCP] interface for emptyDHCP.
-func (EmptyDHCP) MACByIP(_ netip.Addr) (mac net.HardwareAddr) { return nil }
-
-// HostsContainer is an interface for receiving updates to the system hosts
-// file.
-type HostsContainer interface {
-	Upd() (updates <-chan *hostsfile.DefaultStorage)
-}
-
-// StorageConfig is the client storage configuration structure.
-type StorageConfig struct {
-	// Logger is used for logging the operation of the client storage.  It must
-	// not be nil.
-	Logger *slog.Logger
-
-	// DHCP is used to match IPs against MACs of persistent clients and update
-	// [SourceDHCP] runtime client information.  It must not be nil.
-	DHCP DHCP
-
-	// EtcHosts is used to update [SourceHostsFile] runtime client information.
-	EtcHosts HostsContainer
-
-	// ARPDB is used to update [SourceARP] runtime client information.
-	ARPDB arpdb.Interface
-
-	// InitialClients is a list of persistent clients parsed from the
-	// configuration file.  Each client must not be nil.
-	InitialClients []*Persistent
-
-	// ARPClientsUpdatePeriod defines how often [SourceARP] runtime client
-	// information is updated.
-	ARPClientsUpdatePeriod time.Duration
-
-	// RuntimeSourceDHCP specifies whether to update [SourceDHCP] information
-	// of runtime clients.
-	RuntimeSourceDHCP bool
+// Config is the client storage configuration structure.
+//
+// TODO(s.chzhen):  Expand.
+type Config struct {
+	// AllowedTags is a list of all allowed client tags.
+	AllowedTags []string
 }

 // Storage contains information about persistent and runtime clients.
 type Storage struct {
-	// logger is used for logging the operation of the client storage.  It must
-	// not be nil.
-	logger *slog.Logger
+	// allowedTags is a set of all allowed tags.
+	allowedTags *container.MapSet[string]

 	// mu protects indexes of persistent and runtime clients.
 	mu *sync.Mutex
@@ -125,277 +31,28 @@ type Storage struct {
 	index *index

 	// runtimeIndex contains information about runtime clients.
-	runtimeIndex *runtimeIndex
-
-	// dhcp is used to update [SourceDHCP] runtime client information.
-	dhcp DHCP
-
-	// etcHosts is used to update [SourceHostsFile] runtime client information.
-	etcHosts HostsContainer
-
-	// arpDB is used to update [SourceARP] runtime client information.
-	arpDB arpdb.Interface
-
-	// done is the shutdown signaling channel.
-	done chan struct{}
-
-	// allowedTags is a sorted list of all allowed tags.  It must not be
-	// modified after initialization.
 	//
-	// TODO(s.chzhen):  Use custom type.
-	allowedTags []string
-
-	// arpClientsUpdatePeriod defines how often [SourceARP] runtime client
-	// information is updated.  It must be greater than zero.
-	arpClientsUpdatePeriod time.Duration
-
-	// runtimeSourceDHCP specifies whether to update [SourceDHCP] information
-	// of runtime clients.
-	runtimeSourceDHCP bool
+	// TODO(s.chzhen):  Use it.
+	runtimeIndex *RuntimeIndex
 }

 // NewStorage returns initialized client storage.  conf must not be nil.
-func NewStorage(ctx context.Context, conf *StorageConfig) (s *Storage, err error) {
-	tags := slices.Clone(allowedTags)
-	slices.Sort(tags)
+func NewStorage(conf *Config) (s *Storage) {
+	allowedTags := container.NewMapSet(conf.AllowedTags...)

-	s = &Storage{
-		logger:                 conf.Logger,
-		mu:                     &sync.Mutex{},
-		index:                  newIndex(),
-		runtimeIndex:           newRuntimeIndex(),
-		dhcp:                   conf.DHCP,
-		etcHosts:               conf.EtcHosts,
-		arpDB:                  conf.ARPDB,
-		done:                   make(chan struct{}),
-		allowedTags:            tags,
-		arpClientsUpdatePeriod: conf.ARPClientsUpdatePeriod,
-		runtimeSourceDHCP:      conf.RuntimeSourceDHCP,
+	return &Storage{
+		allowedTags:  allowedTags,
+		mu:           &sync.Mutex{},
+		index:        newIndex(),
+		runtimeIndex: NewRuntimeIndex(),
 	}
-
-	for i, p := range conf.InitialClients {
-		err = s.Add(ctx, p)
-		if err != nil {
-			return nil, fmt.Errorf("adding client %q at index %d: %w", p.Name, i, err)
-		}
-	}
-
-	s.ReloadARP(ctx)
-
-	return s, nil
-}
-
-// Start starts the goroutines for updating the runtime client information.
-//
-// TODO(s.chzhen):  Pass context.
-func (s *Storage) Start(ctx context.Context) (err error) {
-	go s.periodicARPUpdate(ctx)
-	go s.handleHostsUpdates(ctx)
-
-	return nil
-}
-
-// Shutdown gracefully stops the client storage.
-//
-// TODO(s.chzhen):  Pass context.
-func (s *Storage) Shutdown(_ context.Context) (err error) {
-	close(s.done)
-
-	return s.closeUpstreams()
-}
-
-// periodicARPUpdate periodically reloads runtime clients from ARP.  It is
-// intended to be used as a goroutine.
-func (s *Storage) periodicARPUpdate(ctx context.Context) {
-	defer slogutil.RecoverAndLog(ctx, s.logger)
-
-	t := time.NewTicker(s.arpClientsUpdatePeriod)
-
-	for {
-		select {
-		case <-t.C:
-			s.ReloadARP(ctx)
-		case <-s.done:
-			return
-		}
-	}
-}
-
-// ReloadARP reloads runtime clients from ARP, if configured.
-func (s *Storage) ReloadARP(ctx context.Context) {
-	if s.arpDB != nil {
-		s.addFromSystemARP(ctx)
-	}
-}
-
-// addFromSystemARP adds the IP-hostname pairings from the output of the arp -a
-// command.
-func (s *Storage) addFromSystemARP(ctx context.Context) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if err := s.arpDB.Refresh(); err != nil {
-		s.arpDB = arpdb.Empty{}
-		s.logger.ErrorContext(ctx, "refreshing arp container", slogutil.KeyError, err)
-
-		return
-	}
-
-	ns := s.arpDB.Neighbors()
-	if len(ns) == 0 {
-		s.logger.DebugContext(ctx, "refreshing arp container: the update is empty")
-
-		return
-	}
-
-	src := SourceARP
-	s.runtimeIndex.clearSource(src)
-
-	for _, n := range ns {
-		s.runtimeIndex.setInfo(n.IP, src, []string{n.Name})
-	}
-
-	removed := s.runtimeIndex.removeEmpty()
-
-	s.logger.DebugContext(
-		ctx,
-		"updating client aliases from arp neighborhood",
-		"added", len(ns),
-		"removed", removed,
-	)
-}
-
-// handleHostsUpdates receives the updates from the hosts container and adds
-// them to the clients storage.  It is intended to be used as a goroutine.
-func (s *Storage) handleHostsUpdates(ctx context.Context) {
-	if s.etcHosts == nil {
-		return
-	}
-
-	defer slogutil.RecoverAndLog(ctx, s.logger)
-
-	for {
-		select {
-		case upd, ok := <-s.etcHosts.Upd():
-			if !ok {
-				return
-			}
-
-			s.addFromHostsFile(ctx, upd)
-		case <-s.done:
-			return
-		}
-	}
-}
-
-// addFromHostsFile fills the client-hostname pairing index from the system's
-// hosts files.
-func (s *Storage) addFromHostsFile(ctx context.Context, hosts *hostsfile.DefaultStorage) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	src := SourceHostsFile
-	s.runtimeIndex.clearSource(src)
-
-	added := 0
-	hosts.RangeNames(func(addr netip.Addr, names []string) (cont bool) {
-		// Only the first name of the first record is considered a canonical
-		// hostname for the IP address.
-		//
-		// TODO(e.burkov):  Consider using all the names from all the records.
-		s.runtimeIndex.setInfo(addr, src, []string{names[0]})
-		added++
-
-		return true
-	})
-
-	removed := s.runtimeIndex.removeEmpty()
-	s.logger.DebugContext(
-		ctx,
-		"updating client aliases from system hosts file",
-		"added", added,
-		"removed", removed,
-	)
-}
-
-// type check
-var _ AddressUpdater = (*Storage)(nil)
-
-// UpdateAddress implements the [AddressUpdater] interface for *Storage
-func (s *Storage) UpdateAddress(ctx context.Context, ip netip.Addr, host string, info *whois.Info) {
-	// Common fast path optimization.
-	if host == "" && info == nil {
-		return
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if host != "" {
-		s.runtimeIndex.setInfo(ip, SourceRDNS, []string{host})
-	}
-
-	if info != nil {
-		s.setWHOISInfo(ctx, ip, info)
-	}
-}
-
-// UpdateDHCP updates [SourceDHCP] runtime client information.
-func (s *Storage) UpdateDHCP(ctx context.Context) {
-	if s.dhcp == nil || !s.runtimeSourceDHCP {
-		return
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	src := SourceDHCP
-	s.runtimeIndex.clearSource(src)
-
-	added := 0
-	for _, l := range s.dhcp.Leases() {
-		s.runtimeIndex.setInfo(l.IP, src, []string{l.Hostname})
-		added++
-	}
-
-	removed := s.runtimeIndex.removeEmpty()
-	s.logger.DebugContext(
-		ctx,
-		"updating client aliases from dhcp",
-		"added", added,
-		"removed", removed,
-	)
-}
-
-// setWHOISInfo sets the WHOIS information for a runtime client.
-func (s *Storage) setWHOISInfo(ctx context.Context, ip netip.Addr, wi *whois.Info) {
-	_, ok := s.index.findByIP(ip)
-	if ok {
-		s.logger.DebugContext(
-			ctx,
-			"persistent client is already created, ignore whois info",
-			"ip", ip,
-		)
-
-		return
-	}
-
-	rc := s.runtimeIndex.client(ip)
-	if rc == nil {
-		rc = NewRuntime(ip)
-		s.runtimeIndex.add(rc)
-	}
-
-	rc.setWHOIS(wi)
-
-	s.logger.DebugContext(ctx, "set whois info for runtime client", "ip", ip, "whois", wi)
 }

 // Add stores persistent client information or returns an error.
-func (s *Storage) Add(ctx context.Context, p *Persistent) (err error) {
+func (s *Storage) Add(p *Persistent) (err error) {
 	defer func() { err = errors.Annotate(err, "adding client: %w") }()

-	err = p.validate(ctx, s.logger, s.allowedTags)
+	err = p.validate(s.allowedTags)
 	if err != nil {
 		// Don't wrap the error since there is already an annotation deferred.
 		return err
@@ -418,13 +75,7 @@ func (s *Storage) Add(ctx context.Context, p *Persistent) (err error) {

 	s.index.add(p)

-	s.logger.DebugContext(
-		ctx,
-		"client added",
-		"name", p.Name,
-		"ids", p.IDs(),
-		"clients_count", s.index.size(),
-	)
+	log.Debug("client storage: added %q: IDs: %q [%d]", p.Name, p.IDs(), s.index.size())

 	return nil
 }
@@ -444,9 +95,6 @@ func (s *Storage) FindByName(name string) (p *Persistent, ok bool) {

 // Find finds persistent client by string representation of the client ID, IP
 // address, or MAC.  And returns its shallow copy.
-//
-// TODO(s.chzhen):  Accept ClientIDData structure instead, which will contain
-// the parsed IP address, if any.
 func (s *Storage) Find(id string) (p *Persistent, ok bool) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -456,16 +104,6 @@ func (s *Storage) Find(id string) (p *Persistent, ok bool) {
 		return p.ShallowClone(), ok
 	}

-	ip, err := netip.ParseAddr(id)
-	if err != nil {
-		return nil, false
-	}
-
-	foundMAC := s.dhcp.MACByIP(ip)
-	if foundMAC != nil {
-		return s.FindByMAC(foundMAC)
-	}
-
 	return nil, false
 }

@@ -493,9 +131,11 @@ func (s *Storage) FindLoose(ip netip.Addr, id string) (p *Persistent, ok bool) {
 	return nil, false
 }

-// FindByMAC finds persistent client by MAC and returns its shallow copy.  s.mu
-// is expected to be locked.
+// FindByMAC finds persistent client by MAC and returns its shallow copy.
 func (s *Storage) FindByMAC(mac net.HardwareAddr) (p *Persistent, ok bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	p, ok = s.index.findByMAC(mac)
 	if ok {
 		return p.ShallowClone(), ok
@@ -526,10 +166,10 @@ func (s *Storage) RemoveByName(name string) (ok bool) {

 // Update finds the stored persistent client by its name and updates its
 // information from p.
-func (s *Storage) Update(ctx context.Context, name string, p *Persistent) (err error) {
+func (s *Storage) Update(name string, p *Persistent) (err error) {
 	defer func() { err = errors.Annotate(err, "updating client: %w") }()

-	err = p.validate(ctx, s.logger, s.allowedTags)
+	err = p.validate(s.allowedTags)
 	if err != nil {
 		// Don't wrap the error since there is already an annotation deferred.
 		return err
@@ -577,8 +217,8 @@ func (s *Storage) Size() (n int) {
 	return s.index.size()
 }

-// closeUpstreams closes upstream configurations of persistent clients.
-func (s *Storage) closeUpstreams() (err error) {
+// CloseUpstreams closes upstream configurations of persistent clients.
+func (s *Storage) CloseUpstreams() (err error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()

@@ -587,39 +227,63 @@ func (s *Storage) closeUpstreams() (err error) {

 // ClientRuntime returns a copy of the saved runtime client by ip.  If no such
 // client exists, returns nil.
+//
+// TODO(s.chzhen):  Use it.
 func (s *Storage) ClientRuntime(ip netip.Addr) (rc *Runtime) {
 	s.mu.Lock()
 	defer s.mu.Unlock()

-	rc = s.runtimeIndex.client(ip)
-	if rc != nil {
-		return rc.clone()
-	}
+	return s.runtimeIndex.Client(ip)
+}

-	if !s.runtimeSourceDHCP {
-		return nil
-	}
+// AddRuntime saves the runtime client information in the storage.  IP address
+// of a client must be unique.  rc must not be nil.
+//
+// TODO(s.chzhen):  Use it.
+func (s *Storage) AddRuntime(rc *Runtime) {
+	s.mu.Lock()
+	defer s.mu.Unlock()

-	host := s.dhcp.HostByIP(ip)
-	if host == "" {
-		return nil
-	}
+	s.runtimeIndex.Add(rc)
+}

-	rc = s.runtimeIndex.setInfo(ip, SourceDHCP, []string{host})
+// SizeRuntime returns the number of the runtime clients.
+//
+// TODO(s.chzhen):  Use it.
+func (s *Storage) SizeRuntime() (n int) {
+	s.mu.Lock()
+	defer s.mu.Unlock()

-	return rc.clone()
+	return s.runtimeIndex.Size()
 }

 // RangeRuntime calls f for each runtime client in an undefined order.
+//
+// TODO(s.chzhen):  Use it.
 func (s *Storage) RangeRuntime(f func(rc *Runtime) (cont bool)) {
 	s.mu.Lock()
 	defer s.mu.Unlock()

-	s.runtimeIndex.rangeClients(f)
+	s.runtimeIndex.Range(f)
 }

-// AllowedTags returns the list of available client tags.  tags must not be
-// modified.
-func (s *Storage) AllowedTags() (tags []string) {
-	return s.allowedTags
+// DeleteRuntime removes the runtime client by ip.
+//
+// TODO(s.chzhen):  Use it.
+func (s *Storage) DeleteRuntime(ip netip.Addr) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.runtimeIndex.Delete(ip)
+}
+
+// DeleteBySource removes all runtime clients that have information only from
+// the specified source and returns the number of removed clients.
+//
+// TODO(s.chzhen):  Use it.
+func (s *Storage) DeleteBySource(src Source) (n int) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.runtimeIndex.DeleteBySource(src)
 }
--- a/internal/client/storage_test.go
+++ b/internal/client/storage_test.go
@@ -3,549 +3,28 @@ package client_test
 import (
 	"net"
 	"net/netip"
-	"runtime"
-	"slices"
-	"sync"
 	"testing"
-	"time"

-	"github.com/AdguardTeam/AdGuardHome/internal/arpdb"
 	"github.com/AdguardTeam/AdGuardHome/internal/client"
-	"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
-	"github.com/AdguardTeam/AdGuardHome/internal/dhcpsvc"
-	"github.com/AdguardTeam/AdGuardHome/internal/whois"
-	"github.com/AdguardTeam/golibs/hostsfile"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

-// newTestStorage is a helper function that returns initialized storage.
-func newTestStorage(tb testing.TB) (s *client.Storage) {
-	tb.Helper()
-
-	ctx := testutil.ContextWithTimeout(tb, testTimeout)
-	s, err := client.NewStorage(ctx, &client.StorageConfig{
-		Logger: slogutil.NewDiscardLogger(),
-	})
-	require.NoError(tb, err)
-
-	return s
-}
-
-// testHostsContainer is a mock implementation of the [client.HostsContainer]
-// interface.
-type testHostsContainer struct {
-	onUpd func() (updates <-chan *hostsfile.DefaultStorage)
-}
-
-// type check
-var _ client.HostsContainer = (*testHostsContainer)(nil)
-
-// Upd implements the [client.HostsContainer] interface for *testHostsContainer.
-func (c *testHostsContainer) Upd() (updates <-chan *hostsfile.DefaultStorage) {
-	return c.onUpd()
-}
-
-// Interface stores and refreshes the network neighborhood reported by ARP
-// (Address Resolution Protocol).
-type Interface interface {
-	// Refresh updates the stored data.  It must be safe for concurrent use.
-	Refresh() (err error)
-
-	// Neighbors returnes the last set of data reported by ARP.  Both the method
-	// and it's result must be safe for concurrent use.
-	Neighbors() (ns []arpdb.Neighbor)
-}
-
-// testARPDB is a mock implementation of the [arpdb.Interface].
-type testARPDB struct {
-	onRefresh   func() (err error)
-	onNeighbors func() (ns []arpdb.Neighbor)
-}
-
-// type check
-var _ arpdb.Interface = (*testARPDB)(nil)
-
-// Refresh implements the [arpdb.Interface] interface for *testARP.
-func (c *testARPDB) Refresh() (err error) {
-	return c.onRefresh()
-}
-
-// Neighbors implements the [arpdb.Interface] interface for *testARP.
-func (c *testARPDB) Neighbors() (ns []arpdb.Neighbor) {
-	return c.onNeighbors()
-}
-
-// testDHCP is a mock implementation of the [client.DHCP].
-type testDHCP struct {
-	OnLeases func() (leases []*dhcpsvc.Lease)
-	OnHostBy func(ip netip.Addr) (host string)
-	OnMACBy  func(ip netip.Addr) (mac net.HardwareAddr)
-}
-
-// type check
-var _ client.DHCP = (*testDHCP)(nil)
-
-// Lease implements the [client.DHCP] interface for *testDHCP.
-func (t *testDHCP) Leases() (leases []*dhcpsvc.Lease) { return t.OnLeases() }
-
-// HostByIP implements the [client.DHCP] interface for *testDHCP.
-func (t *testDHCP) HostByIP(ip netip.Addr) (host string) { return t.OnHostBy(ip) }
-
-// MACByIP implements the [client.DHCP] interface for *testDHCP.
-func (t *testDHCP) MACByIP(ip netip.Addr) (mac net.HardwareAddr) { return t.OnMACBy(ip) }
-
-// compareRuntimeInfo is a helper function that returns true if the runtime
-// client has provided info.
-func compareRuntimeInfo(rc *client.Runtime, src client.Source, host string) (ok bool) {
-	s, h := rc.Info()
-	if s != src {
-		return false
-	} else if h != host {
-		return false
-	}
-
-	return true
-}
-
-func TestStorage_Add_hostsfile(t *testing.T) {
-	var (
-		cliIP1   = netip.MustParseAddr("1.1.1.1")
-		cliName1 = "client_one"
-
-		cliIP2   = netip.MustParseAddr("2.2.2.2")
-		cliName2 = "client_two"
-	)
-
-	hostCh := make(chan *hostsfile.DefaultStorage)
-	h := &testHostsContainer{
-		onUpd: func() (updates <-chan *hostsfile.DefaultStorage) { return hostCh },
-	}
-
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	storage, err := client.NewStorage(ctx, &client.StorageConfig{
-		Logger:                 slogutil.NewDiscardLogger(),
-		DHCP:                   client.EmptyDHCP{},
-		EtcHosts:               h,
-		ARPClientsUpdatePeriod: testTimeout / 10,
-	})
-	require.NoError(t, err)
-
-	err = storage.Start(testutil.ContextWithTimeout(t, testTimeout))
-	require.NoError(t, err)
-
-	testutil.CleanupAndRequireSuccess(t, func() (err error) {
-		return storage.Shutdown(testutil.ContextWithTimeout(t, testTimeout))
-	})
-
-	t.Run("add_hosts", func(t *testing.T) {
-		var s *hostsfile.DefaultStorage
-		s, err = hostsfile.NewDefaultStorage()
-		require.NoError(t, err)
-
-		s.Add(&hostsfile.Record{
-			Addr:  cliIP1,
-			Names: []string{cliName1},
-		})
-
-		testutil.RequireSend(t, hostCh, s, testTimeout)
-
-		require.Eventually(t, func() (ok bool) {
-			cli1 := storage.ClientRuntime(cliIP1)
-			if cli1 == nil {
-				return false
-			}
-
-			assert.True(t, compareRuntimeInfo(cli1, client.SourceHostsFile, cliName1))
-
-			return true
-		}, testTimeout, testTimeout/10)
-	})
-
-	t.Run("update_hosts", func(t *testing.T) {
-		var s *hostsfile.DefaultStorage
-		s, err = hostsfile.NewDefaultStorage()
-		require.NoError(t, err)
-
-		s.Add(&hostsfile.Record{
-			Addr:  cliIP2,
-			Names: []string{cliName2},
-		})
-
-		testutil.RequireSend(t, hostCh, s, testTimeout)
-
-		require.Eventually(t, func() (ok bool) {
-			cli2 := storage.ClientRuntime(cliIP2)
-			if cli2 == nil {
-				return false
-			}
-
-			assert.True(t, compareRuntimeInfo(cli2, client.SourceHostsFile, cliName2))
-
-			cli1 := storage.ClientRuntime(cliIP1)
-			require.Nil(t, cli1)
-
-			return true
-		}, testTimeout, testTimeout/10)
-	})
-}
-
-func TestStorage_Add_arp(t *testing.T) {
-	var (
-		mu        sync.Mutex
-		neighbors []arpdb.Neighbor
-
-		cliIP1   = netip.MustParseAddr("1.1.1.1")
-		cliName1 = "client_one"
-
-		cliIP2   = netip.MustParseAddr("2.2.2.2")
-		cliName2 = "client_two"
-	)
-
-	a := &testARPDB{
-		onRefresh: func() (err error) { return nil },
-		onNeighbors: func() (ns []arpdb.Neighbor) {
-			mu.Lock()
-			defer mu.Unlock()
-
-			return neighbors
-		},
-	}
-
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	storage, err := client.NewStorage(ctx, &client.StorageConfig{
-		Logger:                 slogutil.NewDiscardLogger(),
-		DHCP:                   client.EmptyDHCP{},
-		ARPDB:                  a,
-		ARPClientsUpdatePeriod: testTimeout / 10,
-	})
-	require.NoError(t, err)
-
-	err = storage.Start(testutil.ContextWithTimeout(t, testTimeout))
-	require.NoError(t, err)
-
-	testutil.CleanupAndRequireSuccess(t, func() (err error) {
-		return storage.Shutdown(testutil.ContextWithTimeout(t, testTimeout))
-	})
-
-	t.Run("add_hosts", func(t *testing.T) {
-		func() {
-			mu.Lock()
-			defer mu.Unlock()
-
-			neighbors = []arpdb.Neighbor{{
-				Name: cliName1,
-				IP:   cliIP1,
-			}}
-		}()
-
-		require.Eventually(t, func() (ok bool) {
-			cli1 := storage.ClientRuntime(cliIP1)
-			if cli1 == nil {
-				return false
-			}
-
-			assert.True(t, compareRuntimeInfo(cli1, client.SourceARP, cliName1))
-
-			return true
-		}, testTimeout, testTimeout/10)
-	})
-
-	t.Run("update_hosts", func(t *testing.T) {
-		func() {
-			mu.Lock()
-			defer mu.Unlock()
-
-			neighbors = []arpdb.Neighbor{{
-				Name: cliName2,
-				IP:   cliIP2,
-			}}
-		}()
-
-		require.Eventually(t, func() (ok bool) {
-			cli2 := storage.ClientRuntime(cliIP2)
-			if cli2 == nil {
-				return false
-			}
-
-			assert.True(t, compareRuntimeInfo(cli2, client.SourceARP, cliName2))
-
-			cli1 := storage.ClientRuntime(cliIP1)
-			require.Nil(t, cli1)
-
-			return true
-		}, testTimeout, testTimeout/10)
-	})
-}
-
-func TestStorage_Add_whois(t *testing.T) {
-	var (
-		cliIP1 = netip.MustParseAddr("1.1.1.1")
-
-		cliIP2   = netip.MustParseAddr("2.2.2.2")
-		cliName2 = "client_two"
-
-		cliIP3   = netip.MustParseAddr("3.3.3.3")
-		cliName3 = "client_three"
-	)
-
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	storage, err := client.NewStorage(ctx, &client.StorageConfig{
-		Logger: slogutil.NewDiscardLogger(),
-		DHCP:   client.EmptyDHCP{},
-	})
-	require.NoError(t, err)
-
-	whois := &whois.Info{
-		Country: "AU",
-		Orgname: "Example Org",
-	}
-
-	t.Run("new_client", func(t *testing.T) {
-		storage.UpdateAddress(ctx, cliIP1, "", whois)
-		cli1 := storage.ClientRuntime(cliIP1)
-		require.NotNil(t, cli1)
-
-		assert.Equal(t, whois, cli1.WHOIS())
-	})
-
-	t.Run("existing_runtime_client", func(t *testing.T) {
-		storage.UpdateAddress(ctx, cliIP2, cliName2, nil)
-		storage.UpdateAddress(ctx, cliIP2, "", whois)
-
-		cli2 := storage.ClientRuntime(cliIP2)
-		require.NotNil(t, cli2)
-
-		assert.True(t, compareRuntimeInfo(cli2, client.SourceRDNS, cliName2))
-
-		assert.Equal(t, whois, cli2.WHOIS())
-	})
-
-	t.Run("can't_set_persistent_client", func(t *testing.T) {
-		err = storage.Add(ctx, &client.Persistent{
-			Name: cliName3,
-			UID:  client.MustNewUID(),
-			IPs:  []netip.Addr{cliIP3},
-		})
-		require.NoError(t, err)
-
-		storage.UpdateAddress(ctx, cliIP3, "", whois)
-		rc := storage.ClientRuntime(cliIP3)
-		require.Nil(t, rc)
-	})
-}
-
-func TestClientsDHCP(t *testing.T) {
-	var (
-		cliIP1   = netip.MustParseAddr("1.1.1.1")
-		cliName1 = "one.dhcp"
-
-		cliIP2   = netip.MustParseAddr("2.2.2.2")
-		cliMAC2  = mustParseMAC("22:22:22:22:22:22")
-		cliName2 = "two.dhcp"
-
-		cliIP3   = netip.MustParseAddr("3.3.3.3")
-		cliMAC3  = mustParseMAC("33:33:33:33:33:33")
-		cliName3 = "three.dhcp"
-
-		prsCliIP   = netip.MustParseAddr("4.3.2.1")
-		prsCliMAC  = mustParseMAC("AA:AA:AA:AA:AA:AA")
-		prsCliName = "persistent.dhcp"
-	)
-
-	ipToHost := map[netip.Addr]string{
-		cliIP1: cliName1,
-	}
-	ipToMAC := map[netip.Addr]net.HardwareAddr{
-		prsCliIP: prsCliMAC,
-	}
-
-	leases := []*dhcpsvc.Lease{{
-		IP:       cliIP2,
-		Hostname: cliName2,
-		HWAddr:   cliMAC2,
-	}, {
-		IP:       cliIP3,
-		Hostname: cliName3,
-		HWAddr:   cliMAC3,
-	}}
-
-	d := &testDHCP{
-		OnLeases: func() (ls []*dhcpsvc.Lease) {
-			return leases
-		},
-		OnHostBy: func(ip netip.Addr) (host string) {
-			return ipToHost[ip]
-		},
-		OnMACBy: func(ip netip.Addr) (mac net.HardwareAddr) {
-			return ipToMAC[ip]
-		},
-	}
-
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	storage, err := client.NewStorage(ctx, &client.StorageConfig{
-		Logger:            slogutil.NewDiscardLogger(),
-		DHCP:              d,
-		RuntimeSourceDHCP: true,
-	})
-	require.NoError(t, err)
-
-	t.Run("find_runtime", func(t *testing.T) {
-		cli1 := storage.ClientRuntime(cliIP1)
-		require.NotNil(t, cli1)
-
-		assert.True(t, compareRuntimeInfo(cli1, client.SourceDHCP, cliName1))
-	})
-
-	t.Run("find_persistent", func(t *testing.T) {
-		err = storage.Add(ctx, &client.Persistent{
-			Name: prsCliName,
-			UID:  client.MustNewUID(),
-			MACs: []net.HardwareAddr{prsCliMAC},
-		})
-		require.NoError(t, err)
-
-		prsCli, ok := storage.Find(prsCliIP.String())
-		require.True(t, ok)
-
-		assert.Equal(t, prsCliName, prsCli.Name)
-	})
-
-	t.Run("leases", func(t *testing.T) {
-		delete(ipToHost, cliIP1)
-		storage.UpdateDHCP(ctx)
-
-		cli1 := storage.ClientRuntime(cliIP1)
-		require.Nil(t, cli1)
-
-		for i, l := range leases {
-			cli := storage.ClientRuntime(l.IP)
-			require.NotNil(t, cli)
-
-			src, host := cli.Info()
-			assert.Equal(t, client.SourceDHCP, src)
-			assert.Equal(t, leases[i].Hostname, host)
-		}
-	})
-
-	t.Run("range", func(t *testing.T) {
-		s := 0
-		storage.RangeRuntime(func(rc *client.Runtime) (cont bool) {
-			s++
-
-			return true
-		})
-
-		assert.Equal(t, len(leases), s)
-	})
-}
-
-func TestClientsAddExisting(t *testing.T) {
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-
-	t.Run("simple", func(t *testing.T) {
-		storage, err := client.NewStorage(ctx, &client.StorageConfig{
-			Logger: slogutil.NewDiscardLogger(),
-			DHCP:   client.EmptyDHCP{},
-		})
-		require.NoError(t, err)
-
-		ip := netip.MustParseAddr("1.1.1.1")
-
-		// Add a client.
-		err = storage.Add(ctx, &client.Persistent{
-			Name:    "client1",
-			UID:     client.MustNewUID(),
-			IPs:     []netip.Addr{ip, netip.MustParseAddr("1:2:3::4")},
-			Subnets: []netip.Prefix{netip.MustParsePrefix("2.2.2.0/24")},
-			MACs:    []net.HardwareAddr{{0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA}},
-		})
-		require.NoError(t, err)
-
-		// Now add an auto-client with the same IP.
-		storage.UpdateAddress(ctx, ip, "test", nil)
-		rc := storage.ClientRuntime(ip)
-		assert.True(t, compareRuntimeInfo(rc, client.SourceRDNS, "test"))
-	})
-
-	t.Run("complicated", func(t *testing.T) {
-		// TODO(a.garipov): Properly decouple the DHCP server from the client
-		// storage.
-		if runtime.GOOS == "windows" {
-			t.Skip("skipping dhcp test on windows")
-		}
-
-		// First, init a DHCP server with a single static lease.
-		config := &dhcpd.ServerConfig{
-			Enabled: true,
-			DataDir: t.TempDir(),
-			Conf4: dhcpd.V4ServerConf{
-				Enabled:    true,
-				GatewayIP:  netip.MustParseAddr("1.2.3.1"),
-				SubnetMask: netip.MustParseAddr("255.255.255.0"),
-				RangeStart: netip.MustParseAddr("1.2.3.2"),
-				RangeEnd:   netip.MustParseAddr("1.2.3.10"),
-			},
-		}
-
-		dhcpServer, err := dhcpd.Create(config)
-		require.NoError(t, err)
-
-		storage, err := client.NewStorage(ctx, &client.StorageConfig{
-			Logger: slogutil.NewDiscardLogger(),
-			DHCP:   dhcpServer,
-		})
-		require.NoError(t, err)
-
-		ip := netip.MustParseAddr("1.2.3.4")
-
-		err = dhcpServer.AddStaticLease(&dhcpsvc.Lease{
-			HWAddr:   net.HardwareAddr{0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA},
-			IP:       ip,
-			Hostname: "testhost",
-			Expiry:   time.Now().Add(time.Hour),
-		})
-		require.NoError(t, err)
-
-		// Add a new client with the same IP as for a client with MAC.
-		err = storage.Add(ctx, &client.Persistent{
-			Name: "client2",
-			UID:  client.MustNewUID(),
-			IPs:  []netip.Addr{ip},
-		})
-		require.NoError(t, err)
-
-		// Add a new client with the IP from the first client's IP range.
-		err = storage.Add(ctx, &client.Persistent{
-			Name: "client3",
-			UID:  client.MustNewUID(),
-			IPs:  []netip.Addr{netip.MustParseAddr("2.2.2.2")},
-		})
-		require.NoError(t, err)
-	})
-}
-
 // newStorage is a helper function that returns a client storage filled with
 // persistent clients from the m.  It also generates a UID for each client.
 func newStorage(tb testing.TB, m []*client.Persistent) (s *client.Storage) {
 	tb.Helper()

-	ctx := testutil.ContextWithTimeout(tb, testTimeout)
-	s, err := client.NewStorage(ctx, &client.StorageConfig{
-		Logger: slogutil.NewDiscardLogger(),
-		DHCP:   client.EmptyDHCP{},
+	s = client.NewStorage(&client.Config{
+		AllowedTags: nil,
 	})
-	require.NoError(tb, err)

 	for _, c := range m {
 		c.UID = client.MustNewUID()
-		require.NoError(tb, s.Add(ctx, c))
+		require.NoError(tb, s.Add(c))
 	}

-	require.Equal(tb, len(m), s.Size())
-
 	return s
 }

@@ -564,9 +43,6 @@ func TestStorage_Add(t *testing.T) {
 	const (
 		existingName     = "existing_name"
 		existingClientID = "existing_client_id"
-
-		allowedTag    = "user_admin"
-		notAllowedTag = "not_allowed_tag"
 	)

 	var (
@@ -583,19 +59,10 @@ func TestStorage_Add(t *testing.T) {
 		UID:       existingClientUID,
 	}

-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	s := newTestStorage(t)
-	tags := s.AllowedTags()
-	require.NotZero(t, len(tags))
-	require.True(t, slices.IsSorted(tags))
-
-	_, ok := slices.BinarySearch(tags, allowedTag)
-	require.True(t, ok)
-
-	_, ok = slices.BinarySearch(tags, notAllowedTag)
-	require.False(t, ok)
-
-	err := s.Add(ctx, existingClient)
+	s := client.NewStorage(&client.Config{
+		AllowedTags: nil,
+	})
+	err := s.Add(existingClient)
 	require.NoError(t, err)

 	testCases := []struct {
@@ -652,51 +119,11 @@ func TestStorage_Add(t *testing.T) {
 		},
 		wantErrMsg: `adding client: another client "existing_name" ` +
 			`uses the same ClientID "existing_client_id"`,
-	}, {
-		name: "not_allowed_tag",
-		cli: &client.Persistent{
-			Name: "not_allowed_tag",
-			Tags: []string{notAllowedTag},
-			IPs:  []netip.Addr{netip.MustParseAddr("4.4.4.4")},
-			UID:  client.MustNewUID(),
-		},
-		wantErrMsg: `adding client: invalid tag: "not_allowed_tag"`,
-	}, {
-		name: "allowed_tag",
-		cli: &client.Persistent{
-			Name: "allowed_tag",
-			Tags: []string{allowedTag},
-			IPs:  []netip.Addr{netip.MustParseAddr("5.5.5.5")},
-			UID:  client.MustNewUID(),
-		},
-		wantErrMsg: "",
-	}, {
-		name: "",
-		cli: &client.Persistent{
-			Name: "",
-			IPs:  []netip.Addr{netip.MustParseAddr("6.6.6.6")},
-			UID:  client.MustNewUID(),
-		},
-		wantErrMsg: "adding client: empty name",
-	}, {
-		name: "no_id",
-		cli: &client.Persistent{
-			Name: "no_id",
-			UID:  client.MustNewUID(),
-		},
-		wantErrMsg: "adding client: id required",
-	}, {
-		name: "no_uid",
-		cli: &client.Persistent{
-			Name: "no_uid",
-			IPs:  []netip.Addr{netip.MustParseAddr("7.7.7.7")},
-		},
-		wantErrMsg: "adding client: uid required",
 	}}

 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			err = s.Add(ctx, tc.cli)
+			err = s.Add(tc.cli)

 			testutil.AssertErrorMsg(t, tc.wantErrMsg, err)
 		})
@@ -714,9 +141,10 @@ func TestStorage_RemoveByName(t *testing.T) {
 		UID:  client.MustNewUID(),
 	}

-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	s := newTestStorage(t)
-	err := s.Add(ctx, existingClient)
+	s := client.NewStorage(&client.Config{
+		AllowedTags: nil,
+	})
+	err := s.Add(existingClient)
 	require.NoError(t, err)

 	testCases := []struct {
@@ -740,8 +168,10 @@ func TestStorage_RemoveByName(t *testing.T) {
 	}

 	t.Run("duplicate_remove", func(t *testing.T) {
-		s = newTestStorage(t)
-		err = s.Add(ctx, existingClient)
+		s = client.NewStorage(&client.Config{
+			AllowedTags: nil,
+		})
+		err = s.Add(existingClient)
 		require.NoError(t, err)

 		assert.True(t, s.RemoveByName(existingName))
@@ -911,127 +341,6 @@ func TestStorage_FindLoose(t *testing.T) {
 	}
 }

-func TestStorage_FindByName(t *testing.T) {
-	const (
-		cliIP1 = "1.1.1.1"
-		cliIP2 = "2.2.2.2"
-	)
-
-	const (
-		clientExistingName        = "client_existing"
-		clientAnotherExistingName = "client_another_existing"
-		nonExistingClientName     = "client_non_existing"
-	)
-
-	var (
-		clientExisting = &client.Persistent{
-			Name: clientExistingName,
-			IPs:  []netip.Addr{netip.MustParseAddr(cliIP1)},
-		}
-
-		clientAnotherExisting = &client.Persistent{
-			Name: clientAnotherExistingName,
-			IPs:  []netip.Addr{netip.MustParseAddr(cliIP2)},
-		}
-	)
-
-	clients := []*client.Persistent{
-		clientExisting,
-		clientAnotherExisting,
-	}
-	s := newStorage(t, clients)
-
-	testCases := []struct {
-		want       *client.Persistent
-		name       string
-		clientName string
-	}{{
-		name:       "existing",
-		clientName: clientExistingName,
-		want:       clientExisting,
-	}, {
-		name:       "another_existing",
-		clientName: clientAnotherExistingName,
-		want:       clientAnotherExisting,
-	}, {
-		name:       "non_existing",
-		clientName: nonExistingClientName,
-		want:       nil,
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			c, ok := s.FindByName(tc.clientName)
-			if tc.want == nil {
-				assert.False(t, ok)
-
-				return
-			}
-
-			assert.True(t, ok)
-			assert.Equal(t, tc.want, c)
-		})
-	}
-}
-
-func TestStorage_FindByMAC(t *testing.T) {
-	var (
-		cliMAC               = mustParseMAC("11:11:11:11:11:11")
-		cliAnotherMAC        = mustParseMAC("22:22:22:22:22:22")
-		nonExistingClientMAC = mustParseMAC("33:33:33:33:33:33")
-	)
-
-	var (
-		clientExisting = &client.Persistent{
-			Name: "client",
-			MACs: []net.HardwareAddr{cliMAC},
-		}
-
-		clientAnotherExisting = &client.Persistent{
-			Name: "another_client",
-			MACs: []net.HardwareAddr{cliAnotherMAC},
-		}
-	)
-
-	clients := []*client.Persistent{
-		clientExisting,
-		clientAnotherExisting,
-	}
-	s := newStorage(t, clients)
-
-	testCases := []struct {
-		want      *client.Persistent
-		name      string
-		clientMAC net.HardwareAddr
-	}{{
-		name:      "existing",
-		clientMAC: cliMAC,
-		want:      clientExisting,
-	}, {
-		name:      "another_existing",
-		clientMAC: cliAnotherMAC,
-		want:      clientAnotherExisting,
-	}, {
-		name:      "non_existing",
-		clientMAC: nonExistingClientMAC,
-		want:      nil,
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			c, ok := s.FindByMAC(tc.clientMAC)
-			if tc.want == nil {
-				assert.False(t, ok)
-
-				return
-			}
-
-			assert.True(t, ok)
-			assert.Equal(t, tc.want, c)
-		})
-	}
-}
-
 func TestStorage_Update(t *testing.T) {
 	const (
 		clientName          = "client_name"
@@ -1104,7 +413,6 @@ func TestStorage_Update(t *testing.T) {
 			`uses the same ClientID "obstructing_client_id"`,
 	}}

-	ctx := testutil.ContextWithTimeout(t, testTimeout)
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			s := newStorage(
@@ -1115,7 +423,7 @@ func TestStorage_Update(t *testing.T) {
 				},
 			)

-			err := s.Update(ctx, clientName, tc.cli)
+			err := s.Update(clientName, tc.cli)
 			testutil.AssertErrorMsg(t, tc.wantErrMsg, err)
 		})
 	}
--- a/internal/configmigrate/configmigrate.go
+++ b/internal/configmigrate/configmigrate.go
@@ -2,4 +2,4 @@
 package configmigrate

 // LastSchemaVersion is the most recent schema version.
-const LastSchemaVersion uint = 29
+const LastSchemaVersion uint = 28
--- a/internal/configmigrate/migrations_internal_test.go
+++ b/internal/configmigrate/migrations_internal_test.go
@@ -19,7 +19,6 @@ func TestUpgradeSchema1to2(t *testing.T) {

 	m := New(&Config{
 		WorkingDir: "",
-		DataDir:    "",
 	})

 	err := m.migrateTo2(diskConf)
--- a/internal/configmigrate/migrator.go
+++ b/internal/configmigrate/migrator.go
@@ -10,24 +10,20 @@ import (

 // Config is a the configuration for initializing a [Migrator].
 type Config struct {
-	// WorkingDir is the absolute path to the working directory of AdGuardHome.
+	// WorkingDir is an absolute path to the working directory of AdGuardHome.
 	WorkingDir string
-
-	// DataDir is the absolute path to the data directory of AdGuardHome.
-	DataDir string
 }

 // Migrator performs the YAML configuration file migrations.
 type Migrator struct {
+	// workingDir is an absolute path to the working directory of AdGuardHome.
 	workingDir string
-	dataDir    string
 }

 // New creates a new Migrator.
-func New(c *Config) (m *Migrator) {
+func New(cfg *Config) (m *Migrator) {
 	return &Migrator{
-		workingDir: c.WorkingDir,
-		dataDir:    c.DataDir,
+		workingDir: cfg.WorkingDir,
 	}
 }

@@ -124,7 +120,6 @@ func (m *Migrator) upgradeConfigSchema(current, target uint, diskConf yobj) (err
 		25: migrateTo26,
 		26: migrateTo27,
 		27: migrateTo28,
-		28: m.migrateTo29,
 	}

 	for i, migrate := range upgrades[current:target] {
--- a/internal/configmigrate/migrator_test.go
+++ b/internal/configmigrate/migrator_test.go
@@ -1,12 +1,9 @@
 package configmigrate_test

 import (
-	"bytes"
 	"io/fs"
 	"os"
 	"path"
-	"path/filepath"
-	"runtime"
 	"testing"

 	"github.com/AdguardTeam/AdGuardHome/internal/configmigrate"
@@ -205,7 +202,6 @@ func TestMigrateConfig_Migrate(t *testing.T) {

 			migrator := configmigrate.New(&configmigrate.Config{
 				WorkingDir: t.Name(),
-				DataDir:    filepath.Join(t.Name(), "data"),
 			})
 			newBody, upgraded, err := migrator.Migrate(body, tc.targetVersion)
 			require.NoError(t, err)
@@ -215,43 +211,3 @@ func TestMigrateConfig_Migrate(t *testing.T) {
 		})
 	}
 }
-
-// TODO(a.garipov):  Consider ways of merging into the previous one.
-func TestMigrateConfig_Migrate_v29(t *testing.T) {
-	const (
-		pathUnix       = `/path/to/file.txt`
-		userDirPatUnix = `TestMigrateConfig_Migrate/v29/data/userfilters/*`
-
-		pathWindows       = `C:\path\to\file.txt`
-		userDirPatWindows = `TestMigrateConfig_Migrate\v29\data\userfilters\*`
-	)
-
-	pathToReplace := pathUnix
-	patternToReplace := userDirPatUnix
-	if runtime.GOOS == "windows" {
-		pathToReplace = pathWindows
-		patternToReplace = userDirPatWindows
-	}
-
-	body, err := fs.ReadFile(testdata, "TestMigrateConfig_Migrate/v29/input.yml")
-	require.NoError(t, err)
-
-	body = bytes.ReplaceAll(body, []byte("FILEPATH"), []byte(pathToReplace))
-
-	wantBody, err := fs.ReadFile(testdata, "TestMigrateConfig_Migrate/v29/output.yml")
-	require.NoError(t, err)
-
-	wantBody = bytes.ReplaceAll(wantBody, []byte("FILEPATH"), []byte(pathToReplace))
-	wantBody = bytes.ReplaceAll(wantBody, []byte("USERFILTERSPATH"), []byte(patternToReplace))
-
-	migrator := configmigrate.New(&configmigrate.Config{
-		WorkingDir: t.Name(),
-		DataDir:    "TestMigrateConfig_Migrate/v29/data",
-	})
-
-	newBody, upgraded, err := migrator.Migrate(body, 29)
-	require.NoError(t, err)
-	require.True(t, upgraded)
-
-	require.YAMLEq(t, string(wantBody), string(newBody))
-}
--- a/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v29/input.yml
+++ b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v29/input.yml
@@ -1,117 +0,0 @@
-http:
-  address: 127.0.0.1:3000
-  session_ttl: 3h
-  pprof:
-    enabled: true
-    port: 6060
-users:
- name: testuser
-  password: testpassword
-dns:
-  bind_hosts:
-  - 127.0.0.1
-  port: 53
-  parental_sensitivity: 0
-  upstream_dns:
-  - tls://1.1.1.1
-  - tls://1.0.0.1
-  - quic://8.8.8.8:784
-  bootstrap_dns:
-  - 8.8.8.8:53
-  edns_client_subnet:
-    enabled:    true
-    use_custom: false
-    custom_ip:  ""
-filtering:
-  filtering_enabled: true
-  parental_enabled: false
-  safebrowsing_enabled: false
-  safe_search:
-    enabled:    false
-    bing:       true
-    duckduckgo: true
-    google:     true
-    pixabay:    true
-    yandex:     true
-    youtube:    true
-  protection_enabled: true
-  blocked_services:
-    schedule:
-      time_zone: Local
-    ids:
-    - 500px
-  blocked_response_ttl: 10
-filters:
- url: https://adaway.org/hosts.txt
-  name: AdAway
-  enabled: false
- url: FILEPATH
-  name: Local Filter
-  enabled: false
-clients:
-  persistent:
-  - name: localhost
-    ids:
-    - 127.0.0.1
-    - aa:aa:aa:aa:aa:aa
-    use_global_settings: true
-    use_global_blocked_services: true
-    filtering_enabled: false
-    parental_enabled: false
-    safebrowsing_enabled: false
-    safe_search:
-      enabled:    true
-      bing:       true
-      duckduckgo: true
-      google:     true
-      pixabay:    true
-      yandex:     true
-      youtube:    true
-    blocked_services:
-      schedule:
-        time_zone: Local
-      ids:
-      - 500px
-  runtime_sources:
-    whois: true
-    arp:   true
-    rdns:  true
-    dhcp:  true
-    hosts: true
-dhcp:
-  enabled: false
-  interface_name: vboxnet0
-  local_domain_name: local
-  dhcpv4:
-    gateway_ip: 192.168.0.1
-    subnet_mask: 255.255.255.0
-    range_start: 192.168.0.10
-    range_end: 192.168.0.250
-    lease_duration: 1234
-    icmp_timeout_msec: 10
-schema_version: 28
-user_rules: []
-querylog:
-  enabled: true
-  file_enabled: true
-  interval: 720h
-  size_memory: 1000
-  ignored:
-  - '|.^'
-statistics:
-  enabled: true
-  interval: 240h
-  ignored:
-  - '|.^'
-os:
-  group: ''
-  rlimit_nofile: 123
-  user: ''
-log:
-  file: ""
-  max_backups: 0
-  max_size: 100
-  max_age: 3
-  compress: true
-  local_time: false
-  verbose: true
--- a/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v29/output.yml
+++ b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v29/output.yml
@@ -1,120 +0,0 @@
-http:
-  address: 127.0.0.1:3000
-  session_ttl: 3h
-  pprof:
-    enabled: true
-    port: 6060
-users:
- name: testuser
-  password: testpassword
-dns:
-  bind_hosts:
-  - 127.0.0.1
-  port: 53
-  parental_sensitivity: 0
-  upstream_dns:
-  - tls://1.1.1.1
-  - tls://1.0.0.1
-  - quic://8.8.8.8:784
-  bootstrap_dns:
-  - 8.8.8.8:53
-  edns_client_subnet:
-    enabled:    true
-    use_custom: false
-    custom_ip:  ""
-filtering:
-  filtering_enabled: true
-  parental_enabled: false
-  safebrowsing_enabled: false
-  safe_fs_patterns:
-      - USERFILTERSPATH
-      - FILEPATH
-  safe_search:
-    enabled:    false
-    bing:       true
-    duckduckgo: true
-    google:     true
-    pixabay:    true
-    yandex:     true
-    youtube:    true
-  protection_enabled: true
-  blocked_services:
-    schedule:
-      time_zone: Local
-    ids:
-    - 500px
-  blocked_response_ttl: 10
-filters:
- url: https://adaway.org/hosts.txt
-  name: AdAway
-  enabled: false
- url: FILEPATH
-  name: Local Filter
-  enabled: false
-clients:
-  persistent:
-  - name: localhost
-    ids:
-    - 127.0.0.1
-    - aa:aa:aa:aa:aa:aa
-    use_global_settings: true
-    use_global_blocked_services: true
-    filtering_enabled: false
-    parental_enabled: false
-    safebrowsing_enabled: false
-    safe_search:
-      enabled:    true
-      bing:       true
-      duckduckgo: true
-      google:     true
-      pixabay:    true
-      yandex:     true
-      youtube:    true
-    blocked_services:
-      schedule:
-        time_zone: Local
-      ids:
-      - 500px
-  runtime_sources:
-    whois: true
-    arp:   true
-    rdns:  true
-    dhcp:  true
-    hosts: true
-dhcp:
-  enabled: false
-  interface_name: vboxnet0
-  local_domain_name: local
-  dhcpv4:
-    gateway_ip: 192.168.0.1
-    subnet_mask: 255.255.255.0
-    range_start: 192.168.0.10
-    range_end: 192.168.0.250
-    lease_duration: 1234
-    icmp_timeout_msec: 10
-schema_version: 29
-user_rules: []
-querylog:
-  enabled: true
-  file_enabled: true
-  interval: 720h
-  size_memory: 1000
-  ignored:
-  - '|.^'
-statistics:
-  enabled: true
-  interval: 240h
-  ignored:
-  - '|.^'
-os:
-  group: ''
-  rlimit_nofile: 123
-  user: ''
-log:
-  file: ""
-  max_backups: 0
-  max_size: 100
-  max_age: 3
-  compress: true
-  local_time: false
-  verbose: true
--- a/internal/configmigrate/v29.go
+++ b/internal/configmigrate/v29.go
@@ -1,63 +0,0 @@
-package configmigrate
-
-import (
-	"fmt"
-	"path/filepath"
-)
-
-// migrateTo29 performs the following changes:
-//
-//	# BEFORE:
-//	'filters':
-//	  - 'enabled': true
-//	    'url': /path/to/file.txt
-//	    'name': My FS Filter
-//	    'id': 1234
-//
-//	# AFTER:
-//	'filters':
-//	  - 'enabled': true
-//	    'url': /path/to/file.txt
-//	    'name': My FS Filter
-//	    'id': 1234
-//	# …
-//	'filtering':
-//	  'safe_fs_patterns':
-//	    - '/opt/AdGuardHome/data/userfilters/*'
-//	    - '/path/to/file.txt'
-//	  # …
-func (m Migrator) migrateTo29(diskConf yobj) (err error) {
-	diskConf["schema_version"] = 29
-
-	filterVals, ok, err := fieldVal[[]any](diskConf, "filters")
-	if !ok {
-		return err
-	}
-
-	paths := []string{
-		filepath.Join(m.dataDir, "userfilters", "*"),
-	}
-
-	for i, v := range filterVals {
-		var f yobj
-		f, ok = v.(yobj)
-		if !ok {
-			return fmt.Errorf("filters: at index %d: expected object, got %T", i, v)
-		}
-
-		var u string
-		u, ok, _ = fieldVal[string](f, "url")
-		if ok && filepath.IsAbs(u) {
-			paths = append(paths, u)
-		}
-	}
-
-	fltConf, ok, err := fieldVal[yobj](diskConf, "filtering")
-	if !ok {
-		return err
-	}
-
-	fltConf["safe_fs_patterns"] = paths
-
-	return nil
-}
--- a/internal/dhcpd/db.go
+++ b/internal/dhcpd/db.go
@@ -12,7 +12,6 @@ import (
 	"strings"
 	"time"

-	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/AdGuardHome/internal/dhcpsvc"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/log"
@@ -186,7 +185,7 @@ func writeDB(path string, leases []*dbLease) (err error) {
 		return err
 	}

-	err = maybe.WriteFile(path, buf, aghos.DefaultPermFile)
+	err = maybe.WriteFile(path, buf, 0o644)
 	if err != nil {
 		// Don't wrap the error since it's informative enough as is.
 		return err
--- a/internal/dhcpsvc/config.go
+++ b/internal/dhcpsvc/config.go
@@ -3,12 +3,11 @@ package dhcpsvc
 import (
 	"fmt"
 	"log/slog"
-	"maps"
 	"os"
-	"slices"
 	"time"

 	"github.com/AdguardTeam/golibs/errors"
+	"github.com/AdguardTeam/golibs/mapsutil"
 	"github.com/AdguardTeam/golibs/netutil"
 )

@@ -79,13 +78,14 @@ func (conf *Config) Validate() (err error) {
 		return errors.Join(errs...)
 	}

-	for _, iface := range slices.Sorted(maps.Keys(conf.Interfaces)) {
-		ic := conf.Interfaces[iface]
+	mapsutil.SortedRange(conf.Interfaces, func(iface string, ic *InterfaceConfig) (ok bool) {
 		err = ic.validate()
 		if err != nil {
 			errs = append(errs, fmt.Errorf("interface %q: %w", iface, err))
 		}
-	}
+
+		return true
+	})

 	return errors.Join(errs...)
 }
--- a/internal/dhcpsvc/server.go
+++ b/internal/dhcpsvc/server.go
@@ -4,15 +4,14 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
-	"maps"
 	"net"
 	"net/netip"
-	"slices"
 	"sync"
 	"sync/atomic"
 	"time"

 	"github.com/AdguardTeam/golibs/errors"
+	"github.com/AdguardTeam/golibs/mapsutil"
 )

 // DHCPServer is a DHCP server for both IPv4 and IPv6 address families.
@@ -108,8 +107,7 @@ func newInterfaces(
 	v6 = make(dhcpInterfacesV6, 0, len(ifaces))

 	var errs []error
-	for _, name := range slices.Sorted(maps.Keys(ifaces)) {
-		iface := ifaces[name]
+	mapsutil.SortedRange(ifaces, func(name string, iface *InterfaceConfig) (cont bool) {
 		var i4 *dhcpInterfaceV4
 		i4, err = newDHCPInterfaceV4(ctx, l, name, iface.IPv4)
 		if err != nil {
@@ -122,8 +120,9 @@ func newInterfaces(
 		if i6 != nil {
 			v6 = append(v6, i6)
 		}
-	}

+		return true
+	})
 	if err = errors.Join(errs...); err != nil {
 		return nil, nil, err
 	}
--- a/internal/dnsforward/clientid_test.go
+++ b/internal/dnsforward/clientid_test.go
@@ -218,8 +218,8 @@ func TestServer_clientIDFromDNSContext(t *testing.T) {
 			}

 			srv := &Server{
-				conf:       ServerConfig{TLSConfig: tlsConf},
-				baseLogger: slogutil.NewDiscardLogger(),
+				conf:   ServerConfig{TLSConfig: tlsConf},
+				logger: slogutil.NewDiscardLogger(),
 			}

 			var (
--- a/internal/dnsforward/config.go
+++ b/internal/dnsforward/config.go
@@ -159,7 +159,7 @@ type Config struct {
 	// IpsetList is the ipset configuration that allows AdGuard Home to add IP
 	// addresses of the specified domain names to an ipset list.  Syntax:
 	//
-	//	DOMAIN[,DOMAIN].../IPSET_NAME[,IPSET_NAME]...
+	//	DOMAIN[,DOMAIN].../IPSET_NAME
 	//
 	// This field is ignored if [IpsetListFileName] is set.
 	IpsetList []string `yaml:"ipset"`
@@ -318,7 +318,6 @@ func (s *Server) newProxyConfig() (conf *proxy.Config, err error) {
 	trustedPrefixes := netutil.UnembedPrefixes(srvConf.TrustedProxies)

 	conf = &proxy.Config{
-		Logger:                    s.baseLogger.With(slogutil.KeyPrefix, "dnsproxy"),
 		HTTP3:                     srvConf.ServeHTTP3,
 		Ratelimit:                 int(srvConf.Ratelimit),
 		RatelimitSubnetLenIPv4:    srvConf.RatelimitSubnetLenIPv4,
@@ -343,6 +342,10 @@ func (s *Server) newProxyConfig() (conf *proxy.Config, err error) {
 		MessageConstructor:        s,
 	}

+	if s.logger != nil {
+		conf.Logger = s.logger.With(slogutil.KeyPrefix, "dnsproxy")
+	}
+
 	if srvConf.EDNSClientSubnet.UseCustom {
 		// TODO(s.chzhen):  Use netip.Addr instead of net.IP inside dnsproxy.
 		conf.EDNSAddr = net.IP(srvConf.EDNSClientSubnet.CustomIP.AsSlice())
@@ -424,6 +427,8 @@ func parseBogusNXDOMAIN(confBogusNXDOMAIN []string) (subnets []netip.Prefix, err
 	return subnets, nil
 }

+const defaultBlockedResponseTTL = 3600
+
 // initDefaultSettings initializes default settings if nothing
 // is configured
 func (s *Server) initDefaultSettings() {
@@ -454,24 +459,24 @@ func (s *Server) initDefaultSettings() {

 // prepareIpsetListSettings reads and prepares the ipset configuration either
 // from a file or from the data in the configuration file.
-func (s *Server) prepareIpsetListSettings() (ipsets []string, err error) {
+func (s *Server) prepareIpsetListSettings() (err error) {
 	fn := s.conf.IpsetListFileName
 	if fn == "" {
-		return s.conf.IpsetList, nil
+		return s.ipset.init(s.conf.IpsetList)
 	}

 	// #nosec G304 -- Trust the path explicitly given by the user.
 	data, err := os.ReadFile(fn)
 	if err != nil {
-		return nil, err
+		return err
 	}

-	ipsets = stringutil.SplitTrimmed(string(data), "\n")
-	ipsets = slices.DeleteFunc(ipsets, IsCommentOrEmpty)
+	ipsets := stringutil.SplitTrimmed(string(data), "\n")
+	ipsets = stringutil.FilterOut(ipsets, IsCommentOrEmpty)

 	log.Debug("dns: using %d ipset rules from file %q", len(ipsets), fn)

-	return ipsets, nil
+	return s.ipset.init(ipsets)
 }

 // loadUpstreams parses upstream DNS servers from the configured file or from
--- a/internal/dnsforward/dnsforward.go
+++ b/internal/dnsforward/dnsforward.go
@@ -123,17 +123,18 @@ type Server struct {
 	// access drops disallowed clients.
 	access *accessManager

-	// baseLogger is used to create loggers for other entities.  It should not
-	// have a prefix and must not be nil.
-	baseLogger *slog.Logger
+	// logger is used for logging during server routines.
+	//
+	// TODO(d.kolyshev): Make it never nil.
+	// TODO(d.kolyshev): Use this logger.
+	logger *slog.Logger

 	// localDomainSuffix is the suffix used to detect internal hosts.  It
 	// must be a valid domain name plus dots on each side.
 	localDomainSuffix string

-	// ipset processes DNS requests using ipset data.  It must not be nil after
-	// initialization.  See [newIpsetHandler].
-	ipset *ipsetHandler
+	// ipset processes DNS requests using ipset data.
+	ipset ipsetCtx

 	// privateNets is the configured set of IP networks considered private.
 	privateNets netutil.SubnetSet
@@ -244,7 +245,7 @@ func NewServer(p DNSCreateParams) (s *Server, err error) {
 		stats:       p.Stats,
 		queryLog:    p.QueryLog,
 		privateNets: p.PrivateNets,
-		baseLogger:  p.Logger,
+		logger:      p.Logger.With(slogutil.KeyPrefix, "dnsforward"),
 		// TODO(e.burkov):  Use some case-insensitive string comparison.
 		localDomainSuffix: strings.ToLower(localDomainSuffix),
 		etcHosts:          etcHosts,
@@ -608,18 +609,11 @@ func (s *Server) prepareLocalResolvers() (uc *proxy.UpstreamConfig, err error) {
 // the primary DNS proxy instance.  It assumes s.serverLock is locked or the
 // Server not running.
 func (s *Server) prepareInternalDNS() (err error) {
-	ipsetList, err := s.prepareIpsetListSettings()
+	err = s.prepareIpsetListSettings()
 	if err != nil {
 		return fmt.Errorf("preparing ipset settings: %w", err)
 	}

-	ipsetLogger := s.baseLogger.With(slogutil.KeyPrefix, "ipset")
-	s.ipset, err = newIpsetHandler(context.TODO(), ipsetLogger, ipsetList)
-	if err != nil {
-		// Don't wrap the error, because it's informative enough as is.
-		return err
-	}
-
 	bootOpts := &upstream.Options{
 		Timeout:      DefaultTimeout,
 		HTTPVersions: UpstreamHTTPVersions(s.conf.UseHTTP3Upstreams),
@@ -683,7 +677,6 @@ func (s *Server) setupAddrProc() {
 		s.addrProc = client.EmptyAddrProc{}
 	} else {
 		c := s.conf.AddrProcConf
-		c.BaseLogger = s.baseLogger
 		c.DialContext = s.DialContext
 		c.PrivateSubnets = s.privateNets
 		c.UsePrivateRDNS = s.conf.UsePrivateRDNS
@@ -727,7 +720,6 @@ func validateBlockingMode(
 func (s *Server) prepareInternalProxy() (err error) {
 	srvConf := s.conf
 	conf := &proxy.Config{
-		Logger:                    s.baseLogger.With(slogutil.KeyPrefix, "dnsproxy"),
 		CacheEnabled:              true,
 		CacheSizeBytes:            4096,
 		PrivateRDNSUpstreamConfig: srvConf.PrivateRDNSUpstreamConfig,
@@ -740,6 +732,10 @@ func (s *Server) prepareInternalProxy() (err error) {
 		MessageConstructor:        s,
 	}

+	if s.logger != nil {
+		conf.Logger = s.logger.With(slogutil.KeyPrefix, "dnsproxy")
+	}
+
 	err = setProxyUpstreamMode(conf, srvConf.UpstreamMode, srvConf.FastestTimeout.Duration)
 	if err != nil {
 		return fmt.Errorf("invalid upstream mode: %w", err)
--- a/internal/dnsforward/dnsforward_test.go
+++ b/internal/dnsforward/dnsforward_test.go
@@ -513,14 +513,12 @@ func TestSafeSearch(t *testing.T) {
 		SafeSearchCacheSize: 1000,
 		CacheTime:           30,
 	}
-
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	safeSearch, err := safesearch.NewDefault(ctx, &safesearch.DefaultConfig{
-		Logger:         slogutil.NewDiscardLogger(),
-		ServicesConfig: safeSearchConf,
-		CacheSize:      filterConf.SafeSearchCacheSize,
-		CacheTTL:       time.Minute * time.Duration(filterConf.CacheTime),
-	})
+	safeSearch, err := safesearch.NewDefault(
+		safeSearchConf,
+		"",
+		filterConf.SafeSearchCacheSize,
+		time.Minute*time.Duration(filterConf.CacheTime),
+	)
 	require.NoError(t, err)

 	filterConf.SafeSearch = safeSearch
@@ -585,15 +583,9 @@ func TestSafeSearch(t *testing.T) {
 		t.Run(tc.host, func(t *testing.T) {
 			req := createTestMessage(tc.host)

-			// TODO(a.garipov):  Create our own helper for this.
 			var reply *dns.Msg
-			once := &sync.Once{}
-			require.EventuallyWithT(t, func(c *assert.CollectT) {
-				r, _, errExch := client.Exchange(req, addr)
-				if assert.NoError(c, errExch) {
-					once.Do(func() { reply = r })
-				}
-			}, testTimeout*10, testTimeout)
+			reply, _, err = client.Exchange(req, addr)
+			require.NoErrorf(t, err, "couldn't talk to server %s: %s", addr, err)

 			if tc.wantCNAME != "" {
 				require.Len(t, reply.Answer, 2)
--- a/internal/dnsforward/http_test.go
+++ b/internal/dnsforward/http_test.go
@@ -228,7 +228,7 @@ func TestDNSForwardHTTP_handleSetConfig(t *testing.T) {
 	}, {
 		name: "upstream_dns_bad",
 		wantSet: `validating dns config: upstream servers: parsing error at index 0: ` +
-			`cannot prepare the upstream: invalid address !!!: bad domain name "!!!": ` +
+			`cannot prepare the upstream: invalid address !!!: bad hostname "!!!": ` +
 			`bad top-level domain name label "!!!": bad top-level domain name label rune '!'`,
 	}, {
 		name: "bootstraps_bad",
--- a/internal/dnsforward/ipset.go
+++ b/internal/dnsforward/ipset.go
@@ -1,43 +1,28 @@
 package dnsforward

 import (
-	"context"
 	"fmt"
-	"log/slog"
 	"net"
 	"os"
 	"strings"

 	"github.com/AdguardTeam/AdGuardHome/internal/ipset"
 	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/miekg/dns"
 )

-// ipsetHandler is the ipset context.  ipsetMgr can be nil.
-type ipsetHandler struct {
+// ipsetCtx is the ipset context.  ipsetMgr can be nil.
+type ipsetCtx struct {
 	ipsetMgr ipset.Manager
-	logger   *slog.Logger
 }

-// newIpsetHandler returns a new initialized [ipsetHandler].  It is not safe for
-// concurrent use.
-func newIpsetHandler(
-	ctx context.Context,
-	logger *slog.Logger,
-	ipsetList []string,
-) (h *ipsetHandler, err error) {
-	h = &ipsetHandler{
-		logger: logger,
-	}
-	conf := &ipset.Config{
-		Logger: logger,
-		Lines:  ipsetList,
-	}
-	h.ipsetMgr, err = ipset.NewManager(ctx, conf)
-	if errors.Is(err, os.ErrInvalid) ||
-		errors.Is(err, os.ErrPermission) ||
-		errors.Is(err, errors.ErrUnsupported) {
+// init initializes the ipset context.  It is not safe for concurrent use.
+//
+// TODO(a.garipov): Rewrite into a simple constructor?
+func (c *ipsetCtx) init(ipsetConf []string) (err error) {
+	c.ipsetMgr, err = ipset.NewManager(ipsetConf)
+	if errors.Is(err, os.ErrInvalid) || errors.Is(err, os.ErrPermission) {
 		// ipset cannot currently be initialized if the server was installed
 		// from Snap or when the user or the binary doesn't have the required
 		// permissions, or when the kernel doesn't support netfilter.
@@ -46,28 +31,30 @@ func newIpsetHandler(
 		//
 		// TODO(a.garipov): The Snap problem can probably be solved if we add
 		// the netlink-connector interface plug.
-		logger.WarnContext(ctx, "cannot initialize", slogutil.KeyError, err)
+		log.Info("ipset: warning: cannot initialize: %s", err)

-		return h, nil
+		return nil
+	} else if errors.Is(err, errors.ErrUnsupported) {
+		log.Info("ipset: warning: %s", err)
+
+		return nil
 	} else if err != nil {
-		return nil, fmt.Errorf("initializing ipset: %w", err)
-	}
-
-	return h, nil
-}
-
-// close closes the Linux Netfilter connections.  close can be called on a nil
-// handler.
-func (h *ipsetHandler) close() (err error) {
-	if h != nil && h.ipsetMgr != nil {
-		return h.ipsetMgr.Close()
+		return fmt.Errorf("initializing ipset: %w", err)
 	}

 	return nil
 }

-// dctxIsFilled returns true if dctx has enough information to process.
-func dctxIsFilled(dctx *dnsContext) (ok bool) {
+// close closes the Linux Netfilter connections.
+func (c *ipsetCtx) close() (err error) {
+	if c.ipsetMgr != nil {
+		return c.ipsetMgr.Close()
+	}
+
+	return nil
+}
+
+func (c *ipsetCtx) dctxIsfilled(dctx *dnsContext) (ok bool) {
 	return dctx != nil &&
 		dctx.responseFromUpstream &&
 		dctx.proxyCtx != nil &&
@@ -78,8 +65,8 @@ func dctxIsFilled(dctx *dnsContext) (ok bool) {

 // skipIpsetProcessing returns true when the ipset processing can be skipped for
 // this request.
-func (h *ipsetHandler) skipIpsetProcessing(dctx *dnsContext) (ok bool) {
-	if h == nil || h.ipsetMgr == nil || !dctxIsFilled(dctx) {
+func (c *ipsetCtx) skipIpsetProcessing(dctx *dnsContext) (ok bool) {
+	if c == nil || c.ipsetMgr == nil || !c.dctxIsfilled(dctx) {
 		return true
 	}

@@ -121,31 +108,31 @@ func ipsFromAnswer(ans []dns.RR) (ip4s, ip6s []net.IP) {
 }

 // process adds the resolved IP addresses to the domain's ipsets, if any.
-func (h *ipsetHandler) process(dctx *dnsContext) (rc resultCode) {
-	// TODO(s.chzhen):  Use passed context.
-	ctx := context.TODO()
-	h.logger.DebugContext(ctx, "started processing")
-	defer h.logger.DebugContext(ctx, "finished processing")
+func (c *ipsetCtx) process(dctx *dnsContext) (rc resultCode) {
+	log.Debug("dnsforward: ipset: started processing")
+	defer log.Debug("dnsforward: ipset: finished processing")

-	if h.skipIpsetProcessing(dctx) {
+	if c.skipIpsetProcessing(dctx) {
 		return resultCodeSuccess
 	}

+	log.Debug("ipset: starting processing")
+
 	req := dctx.proxyCtx.Req
 	host := req.Question[0].Name
 	host = strings.TrimSuffix(host, ".")
 	host = strings.ToLower(host)

 	ip4s, ip6s := ipsFromAnswer(dctx.proxyCtx.Res.Answer)
-	n, err := h.ipsetMgr.Add(ctx, host, ip4s, ip6s)
+	n, err := c.ipsetMgr.Add(host, ip4s, ip6s)
 	if err != nil {
 		// Consider ipset errors non-critical to the request.
-		h.logger.ErrorContext(ctx, "adding host ips", slogutil.KeyError, err)
+		log.Error("dnsforward: ipset: adding host ips: %s", err)

 		return resultCodeSuccess
 	}

-	h.logger.DebugContext(ctx, "added new ipset entries", "num", n)
+	log.Debug("dnsforward: ipset: added %d new ipset entries", n)

 	return resultCodeSuccess
 }
--- a/internal/dnsforward/ipset_internal_test.go
+++ b/internal/dnsforward/ipset_internal_test.go
@@ -1,12 +1,10 @@
 package dnsforward

 import (
-	"context"
 	"net"
 	"testing"

 	"github.com/AdguardTeam/dnsproxy/proxy"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 )
@@ -18,7 +16,7 @@ type fakeIpsetMgr struct {
 }

 // Add implements the aghnet.IpsetManager interface for *fakeIpsetMgr.
-func (m *fakeIpsetMgr) Add(_ context.Context, host string, ip4s, ip6s []net.IP) (n int, err error) {
+func (m *fakeIpsetMgr) Add(host string, ip4s, ip6s []net.IP) (n int, err error) {
 	m.ip4s = append(m.ip4s, ip4s...)
 	m.ip6s = append(m.ip6s, ip6s...)

@@ -60,9 +58,7 @@ func TestIpsetCtx_process(t *testing.T) {
 			responseFromUpstream: true,
 		}

-		ictx := &ipsetHandler{
-			logger: slogutil.NewDiscardLogger(),
-		}
+		ictx := &ipsetCtx{}
 		rc := ictx.process(dctx)
 		assert.Equal(t, resultCodeSuccess, rc)

@@ -81,9 +77,8 @@ func TestIpsetCtx_process(t *testing.T) {
 		}

 		m := &fakeIpsetMgr{}
-		ictx := &ipsetHandler{
+		ictx := &ipsetCtx{
 			ipsetMgr: m,
-			logger:   slogutil.NewDiscardLogger(),
 		}

 		rc := ictx.process(dctx)
@@ -106,9 +101,8 @@ func TestIpsetCtx_process(t *testing.T) {
 		}

 		m := &fakeIpsetMgr{}
-		ictx := &ipsetHandler{
+		ictx := &ipsetCtx{
 			ipsetMgr: m,
-			logger:   slogutil.NewDiscardLogger(),
 		}

 		rc := ictx.process(dctx)
@@ -130,9 +124,8 @@ func TestIpsetCtx_SkipIpsetProcessing(t *testing.T) {
 	}

 	m := &fakeIpsetMgr{}
-	ictx := &ipsetHandler{
+	ictx := &ipsetCtx{
 		ipsetMgr: m,
-		logger:   slogutil.NewDiscardLogger(),
 	}

 	testCases := []struct {
--- a/internal/dnsforward/msg.go
+++ b/internal/dnsforward/msg.go
@@ -58,7 +58,7 @@ func (s *Server) genDNSFilterMessage(
 			return s.replyCompressed(req)
 		}

-		return s.NewMsgNODATA(req)
+		return s.newMsgNODATA(req)
 	}

 	switch res.Reason {
@@ -344,6 +344,51 @@ func (s *Server) makeResponseREFUSED(req *dns.Msg) *dns.Msg {
 	return s.reply(req, dns.RcodeRefused)
 }

+// newMsgNODATA returns a properly initialized NODATA response.
+//
+// See https://www.rfc-editor.org/rfc/rfc2308#section-2.2.
+func (s *Server) newMsgNODATA(req *dns.Msg) (resp *dns.Msg) {
+	resp = s.reply(req, dns.RcodeSuccess)
+	resp.Ns = s.genSOA(req)
+
+	return resp
+}
+
+func (s *Server) genSOA(request *dns.Msg) []dns.RR {
+	zone := ""
+	if len(request.Question) > 0 {
+		zone = request.Question[0].Name
+	}
+
+	soa := dns.SOA{
+		// values copied from verisign's nonexistent .com domain
+		// their exact values are not important in our use case because they are used for domain transfers between primary/secondary DNS servers
+		Refresh: 1800,
+		Retry:   900,
+		Expire:  604800,
+		Minttl:  86400,
+		// copied from AdGuard DNS
+		Ns:     "fake-for-negative-caching.adguard.com.",
+		Serial: 100500,
+		// rest is request-specific
+		Hdr: dns.RR_Header{
+			Name:   zone,
+			Rrtype: dns.TypeSOA,
+			Ttl:    s.dnsFilter.BlockedResponseTTL(),
+			Class:  dns.ClassINET,
+		},
+		Mbox: "hostmaster.", // zone will be appended later if it's not empty or "."
+	}
+	if soa.Hdr.Ttl == 0 {
+		soa.Hdr.Ttl = defaultBlockedResponseTTL
+	}
+	if len(zone) > 0 && zone[0] != '.' {
+		soa.Mbox += zone
+	}
+
+	return []dns.RR{&soa}
+}
+
 // type check
 var _ proxy.MessageConstructor = (*Server)(nil)

@@ -380,52 +425,3 @@ func (s *Server) NewMsgNOTIMPLEMENTED(req *dns.Msg) (resp *dns.Msg) {

 	return resp
 }
-
-// NewMsgNODATA implements the [proxy.MessageConstructor] interface for *Server.
-func (s *Server) NewMsgNODATA(req *dns.Msg) (resp *dns.Msg) {
-	resp = s.reply(req, dns.RcodeSuccess)
-	resp.Ns = s.genSOA(req)
-
-	return resp
-}
-
-func (s *Server) genSOA(req *dns.Msg) []dns.RR {
-	zone := ""
-	if len(req.Question) > 0 {
-		zone = req.Question[0].Name
-	}
-
-	const defaultBlockedResponseTTL = 3600
-
-	soa := dns.SOA{
-		// Values copied from verisign's nonexistent.com domain.
-		//
-		// Their exact values are not important in our use case because they are
-		// used for domain transfers between primary/secondary DNS servers.
-		Refresh: 1800,
-		Retry:   900,
-		Expire:  604800,
-		Minttl:  86400,
-		// copied from AdGuard DNS
-		Ns:     "fake-for-negative-caching.adguard.com.",
-		Serial: 100500,
-		// rest is request-specific
-		Hdr: dns.RR_Header{
-			Name:   zone,
-			Rrtype: dns.TypeSOA,
-			Ttl:    s.dnsFilter.BlockedResponseTTL(),
-			Class:  dns.ClassINET,
-		},
-		// zone will be appended later if it's not ".".
-		Mbox: "hostmaster.",
-	}
-	if soa.Hdr.Ttl == 0 {
-		soa.Hdr.Ttl = defaultBlockedResponseTTL
-	}
-
-	if zone != "." {
-		soa.Mbox += zone
-	}
-
-	return []dns.RR{&soa}
-}
--- a/internal/dnsforward/process.go
+++ b/internal/dnsforward/process.go
@@ -2,7 +2,6 @@ package dnsforward

 import (
 	"cmp"
-	"context"
 	"encoding/binary"
 	"net"
 	"net/netip"
@@ -160,7 +159,7 @@ func (s *Server) processInitial(dctx *dnsContext) (rc resultCode) {
 	q := pctx.Req.Question[0]
 	qt := q.Qtype
 	if s.conf.AAAADisabled && qt == dns.TypeAAAA {
-		pctx.Res = s.NewMsgNODATA(pctx.Req)
+		pctx.Res = s.newMsgNODATA(pctx.Req)

 		return resultCodeFinish
 	}
@@ -204,8 +203,7 @@ func (s *Server) processClientIP(addr netip.Addr) {
 	s.serverLock.RLock()
 	defer s.serverLock.RUnlock()

-	// TODO(s.chzhen):  Pass context.
-	s.addrProc.Process(context.TODO(), addr)
+	s.addrProc.Process(addr)
 }

 // processDDRQuery responds to Discovery of Designated Resolvers (DDR) SVCB
--- a/internal/dnsforward/process_internal_test.go
+++ b/internal/dnsforward/process_internal_test.go
@@ -2,7 +2,6 @@ package dnsforward

 import (
 	"cmp"
-	"context"
 	"net"
 	"net/netip"
 	"testing"
@@ -91,7 +90,7 @@ func TestServer_ProcessInitial(t *testing.T) {

 			var gotAddr netip.Addr
 			s.addrProc = &aghtest.AddressProcessor{
-				OnProcess: func(ctx context.Context, ip netip.Addr) { gotAddr = ip },
+				OnProcess: func(ip netip.Addr) { gotAddr = ip },
 				OnClose:   func() (err error) { panic("not implemented") },
 			}

@@ -432,7 +431,7 @@ func TestServer_ProcessDHCPHosts_localRestriction(t *testing.T) {
 				dnsFilter:         createTestDNSFilter(t),
 				dhcpServer:        dhcp,
 				localDomainSuffix: localDomainSuffix,
-				baseLogger:        slogutil.NewDiscardLogger(),
+				logger:            slogutil.NewDiscardLogger(),
 			}

 			req := &dns.Msg{
@@ -568,7 +567,7 @@ func TestServer_ProcessDHCPHosts(t *testing.T) {
 			dnsFilter:         createTestDNSFilter(t),
 			dhcpServer:        testDHCP,
 			localDomainSuffix: tc.suffix,
-			baseLogger:        slogutil.NewDiscardLogger(),
+			logger:            slogutil.NewDiscardLogger(),
 		}

 		req := &dns.Msg{
--- a/internal/dnsforward/stats_test.go
+++ b/internal/dnsforward/stats_test.go
@@ -203,7 +203,7 @@ func TestServer_ProcessQueryLogsAndStats(t *testing.T) {
 		ql := &testQueryLog{}
 		st := &testStats{}
 		srv := &Server{
-			baseLogger: slogutil.NewDiscardLogger(),
+			logger:     slogutil.NewDiscardLogger(),
 			queryLog:   ql,
 			stats:      st,
 			anonymizer: aghnet.NewIPMut(nil),
--- a/internal/filtering/filter.go
+++ b/internal/filtering/filter.go
@@ -11,7 +11,6 @@ import (
 	"strings"
 	"time"

-	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/AdGuardHome/internal/aghrenameio"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering/rulelist"
 	"github.com/AdguardTeam/golibs/container"
@@ -449,7 +448,11 @@ func (d *DNSFilter) updateIntl(flt *FilterYAML) (ok bool, err error) {

 	var res *rulelist.ParseResult

-	tmpFile, err := aghrenameio.NewPendingFile(flt.Path(d.conf.DataDir), aghos.DefaultPermFile)
+	// Change the default 0o600 permission to something more acceptable by end
+	// users.
+	//
+	// See https://github.com/AdguardTeam/AdGuardHome/issues/3198.
+	tmpFile, err := aghrenameio.NewPendingFile(flt.Path(d.conf.DataDir), 0o644)
 	if err != nil {
 		return false, err
 	}
@@ -519,11 +522,6 @@ func (d *DNSFilter) reader(fltURL string) (r io.ReadCloser, err error) {
 		return r, nil
 	}

-	fltURL = filepath.Clean(fltURL)
-	if !pathMatchesAny(d.safeFSPatterns, fltURL) {
-		return nil, fmt.Errorf("path %q does not match safe patterns", fltURL)
-	}
-
 	r, err = os.Open(fltURL)
 	if err != nil {
 		return nil, fmt.Errorf("opening file: %w", err)
--- a/internal/filtering/filtering.go
+++ b/internal/filtering/filtering.go
@@ -19,7 +19,6 @@ import (
 	"time"

 	"github.com/AdguardTeam/AdGuardHome/internal/aghhttp"
-	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering/rulelist"
 	"github.com/AdguardTeam/golibs/container"
 	"github.com/AdguardTeam/golibs/errors"
@@ -131,10 +130,6 @@ type Config struct {
 	// UserRules is the global list of custom rules.
 	UserRules []string `yaml:"-"`

-	// SafeFSPatterns are the patterns for matching which local filtering-rule
-	// files can be added.
-	SafeFSPatterns []string `yaml:"safe_fs_patterns"`
-
 	SafeBrowsingCacheSize uint `yaml:"safebrowsing_cache_size"` // (in bytes)
 	SafeSearchCacheSize   uint `yaml:"safesearch_cache_size"`   // (in bytes)
 	ParentalCacheSize     uint `yaml:"parental_cache_size"`     // (in bytes)
@@ -262,8 +257,6 @@ type DNSFilter struct {
 	refreshLock *sync.Mutex

 	hostCheckers []hostChecker
-
-	safeFSPatterns []string
 }

 // Filter represents a filter list
@@ -994,22 +987,13 @@ func New(c *Config, blockFilters []Filter) (d *DNSFilter, err error) {
 	d = &DNSFilter{
 		idGen:                  newIDGenerator(int32(time.Now().Unix())),
 		bufPool:                syncutil.NewSlicePool[byte](rulelist.DefaultRuleBufSize),
-		safeSearch:             c.SafeSearch,
 		refreshLock:            &sync.Mutex{},
 		safeBrowsingChecker:    c.SafeBrowsingChecker,
 		parentalControlChecker: c.ParentalControlChecker,
 		confMu:                 &sync.RWMutex{},
 	}

-	for i, p := range c.SafeFSPatterns {
-		// Use Match to validate the patterns here.
-		_, err = filepath.Match(p, "test")
-		if err != nil {
-			return nil, fmt.Errorf("safe_fs_patterns: at index %d: %w", i, err)
-		}
-
-		d.safeFSPatterns = append(d.safeFSPatterns, p)
-	}
+	d.safeSearch = c.SafeSearch

 	d.hostCheckers = []hostChecker{{
 		check: d.matchSysHosts,
@@ -1038,7 +1022,7 @@ func New(c *Config, blockFilters []Filter) (d *DNSFilter, err error) {

 	err = d.prepareRewrites()
 	if err != nil {
-		return nil, fmt.Errorf("rewrites: preparing: %w", err)
+		return nil, fmt.Errorf("rewrites: preparing: %s", err)
 	}

 	if d.conf.BlockedServices != nil {
@@ -1053,16 +1037,11 @@ func New(c *Config, blockFilters []Filter) (d *DNSFilter, err error) {
 		if err != nil {
 			d.Close()

-			return nil, fmt.Errorf("initializing filtering subsystem: %w", err)
+			return nil, fmt.Errorf("initializing filtering subsystem: %s", err)
 		}
 	}

-	err = aghos.MkdirAll(filepath.Join(d.conf.DataDir, filterDir), aghos.DefaultPermDir)
-	if err != nil {
-		d.Close()
-
-		return nil, fmt.Errorf("making filtering directory: %w", err)
-	}
+	_ = os.MkdirAll(filepath.Join(d.conf.DataDir, filterDir), 0o755)

 	d.loadFilters(d.conf.Filters)
 	d.loadFilters(d.conf.WhitelistFilters)
--- a/internal/filtering/hashprefix/cache.go
+++ b/internal/filtering/hashprefix/cache.go
@@ -47,6 +47,7 @@ func fromCacheItem(item *cacheItem) (data []byte) {
 	data = binary.BigEndian.AppendUint64(data, uint64(expiry))

 	for _, v := range item.hashes {
+		// nolint:looppointer // The subslice of v is used for a copy.
 		data = append(data, v[:]...)
 	}

@@ -62,6 +63,7 @@ func (c *Checker) findInCache(

 	i := 0
 	for _, hash := range hashes {
+		// nolint:looppointer // The has subslice is used for a cache lookup.
 		data := c.cache.Get(hash[:prefixLen])
 		if data == nil {
 			hashes[i] = hash
@@ -96,6 +98,7 @@ func (c *Checker) storeInCache(hashesToRequest, respHashes []hostnameHash) {

 	for _, hash := range respHashes {
 		var pref prefix
+		// nolint:looppointer // The hash subslice is used for a copy.
 		copy(pref[:], hash[:])

 		hashToStore[pref] = append(hashToStore[pref], hash)
@@ -106,9 +109,11 @@ func (c *Checker) storeInCache(hashesToRequest, respHashes []hostnameHash) {
 	}

 	for _, hash := range hashesToRequest {
+		// nolint:looppointer // The hash subslice is used for a cache lookup.
 		val := c.cache.Get(hash[:prefixLen])
 		if val == nil {
 			var pref prefix
+			// nolint:looppointer // The hash subslice is used for a copy.
 			copy(pref[:], hash[:])

 			c.setCache(pref, nil)
--- a/internal/filtering/hashprefix/hashprefix.go
+++ b/internal/filtering/hashprefix/hashprefix.go
@@ -173,6 +173,7 @@ func (c *Checker) getQuestion(hashes []hostnameHash) (q string) {
 	b := &strings.Builder{}

 	for _, hash := range hashes {
+		// nolint:looppointer // The hash subslice is used for hex encoding.
 		stringutil.WriteToBuilder(b, hex.EncodeToString(hash[:prefixLen]), ".")
 	}

--- a/internal/filtering/http.go
+++ b/internal/filtering/http.go
@@ -13,7 +13,6 @@ import (
 	"time"

 	"github.com/AdguardTeam/AdGuardHome/internal/aghhttp"
-	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering/rulelist"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/log"
@@ -21,22 +20,14 @@ import (
 )

 // validateFilterURL validates the filter list URL or file name.
-func (d *DNSFilter) validateFilterURL(urlStr string) (err error) {
+func validateFilterURL(urlStr string) (err error) {
 	defer func() { err = errors.Annotate(err, "checking filter: %w") }()

 	if filepath.IsAbs(urlStr) {
-		urlStr = filepath.Clean(urlStr)
-		_, err = aghos.Stat(urlStr)
-		if err != nil {
-			// Don't wrap the error since it's informative enough as is.
-			return err
-		}
+		_, err = os.Stat(urlStr)

-		if !pathMatchesAny(d.safeFSPatterns, urlStr) {
-			return fmt.Errorf("path %q does not match safe patterns", urlStr)
-		}
-
-		return nil
+		// Don't wrap the error since it's informative enough as is.
+		return err
 	}

 	u, err := url.ParseRequestURI(urlStr)
@@ -74,7 +65,7 @@ func (d *DNSFilter) handleFilteringAddURL(w http.ResponseWriter, r *http.Request
 		return
 	}

-	err = d.validateFilterURL(fj.URL)
+	err = validateFilterURL(fj.URL)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)

@@ -234,7 +225,7 @@ func (d *DNSFilter) handleFilteringSetURL(w http.ResponseWriter, r *http.Request
 		return
 	}

-	err = d.validateFilterURL(fj.Data.URL)
+	err = validateFilterURL(fj.Data.URL)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "invalid url: %s", err)

--- a/internal/filtering/path.go
+++ b/internal/filtering/path.go
@@ -1,37 +0,0 @@
-package filtering
-
-import (
-	"fmt"
-	"path/filepath"
-)
-
-// pathMatchesAny returns true if filePath matches one of globs.  globs must be
-// valid.  filePath must be absolute and clean.  If globs are empty,
-// pathMatchesAny returns false.
-//
-// TODO(a.garipov): Move to golibs?
-func pathMatchesAny(globs []string, filePath string) (ok bool) {
-	if len(globs) == 0 {
-		return false
-	}
-
-	clean, err := filepath.Abs(filePath)
-	if err != nil {
-		panic(fmt.Errorf("pathMatchesAny: %w", err))
-	} else if clean != filePath {
-		panic(fmt.Errorf("pathMatchesAny: filepath %q is not absolute", filePath))
-	}
-
-	for _, g := range globs {
-		ok, err = filepath.Match(g, filePath)
-		if err != nil {
-			panic(fmt.Errorf("pathMatchesAny: bad pattern: %w", err))
-		}
-
-		if ok {
-			return true
-		}
-	}
-
-	return false
-}
--- a/internal/filtering/path_unix_internal_test.go
+++ b/internal/filtering/path_unix_internal_test.go
@@ -1,78 +0,0 @@
-//go:build unix
-
-package filtering
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestPathInAnyDir(t *testing.T) {
-	t.Parallel()
-
-	const (
-		filePath      = "/path/to/file.txt"
-		filePathGlob  = "/path/to/*"
-		otherFilePath = "/otherpath/to/file.txt"
-	)
-
-	testCases := []struct {
-		want     assert.BoolAssertionFunc
-		filePath string
-		name     string
-		globs    []string
-	}{{
-		want:     assert.False,
-		filePath: filePath,
-		name:     "nil_pats",
-		globs:    nil,
-	}, {
-		want:     assert.True,
-		filePath: filePath,
-		name:     "match",
-		globs: []string{
-			filePath,
-			otherFilePath,
-		},
-	}, {
-		want:     assert.False,
-		filePath: filePath,
-		name:     "no_match",
-		globs: []string{
-			otherFilePath,
-		},
-	}, {
-		want:     assert.True,
-		filePath: filePath,
-		name:     "match_star",
-		globs: []string{
-			filePathGlob,
-		},
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			tc.want(t, pathMatchesAny(tc.globs, tc.filePath))
-		})
-	}
-
-	require.True(t, t.Run("panic_on_unabs_file_path", func(t *testing.T) {
-		t.Parallel()
-
-		assert.Panics(t, func() {
-			_ = pathMatchesAny([]string{"/home/user"}, "../../etc/passwd")
-		})
-	}))
-
-	require.True(t, t.Run("panic_on_bad_pat", func(t *testing.T) {
-		t.Parallel()
-
-		assert.Panics(t, func() {
-			_ = pathMatchesAny([]string{`\`}, filePath)
-		})
-	}))
-}
--- a/internal/filtering/path_windows_internal_test.go
+++ b/internal/filtering/path_windows_internal_test.go
@@ -1,73 +0,0 @@
-//go:build windows
-
-package filtering
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestPathInAnyDir(t *testing.T) {
-	t.Parallel()
-
-	const (
-		filePath      = `C:\path\to\file.txt`
-		filePathGlob  = `C:\path\to\*`
-		otherFilePath = `C:\otherpath\to\file.txt`
-	)
-
-	testCases := []struct {
-		want     assert.BoolAssertionFunc
-		filePath string
-		name     string
-		globs    []string
-	}{{
-		want:     assert.False,
-		filePath: filePath,
-		name:     "nil_pats",
-		globs:    nil,
-	}, {
-		want:     assert.True,
-		filePath: filePath,
-		name:     "match",
-		globs: []string{
-			filePath,
-			otherFilePath,
-		},
-	}, {
-		want:     assert.False,
-		filePath: filePath,
-		name:     "no_match",
-		globs: []string{
-			otherFilePath,
-		},
-	}, {
-		want:     assert.True,
-		filePath: filePath,
-		name:     "match_star",
-		globs: []string{
-			filePathGlob,
-		},
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			tc.want(t, pathMatchesAny(tc.globs, tc.filePath))
-		})
-	}
-
-	require.True(t, t.Run("panic_on_unabs_file_path", func(t *testing.T) {
-		t.Parallel()
-
-		assert.Panics(t, func() {
-			_ = pathMatchesAny([]string{`C:\home\user`}, `..\..\etc\passwd`)
-		})
-	}))
-
-	// TODO(a.garipov): See if there is anything for which filepath.Match
-	// returns ErrBadPattern on Windows.
-}
--- a/internal/filtering/rulelist/filter.go
+++ b/internal/filtering/rulelist/filter.go
@@ -11,7 +11,6 @@ import (
 	"path/filepath"
 	"time"

-	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/AdGuardHome/internal/aghrenameio"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/ioutil"
@@ -197,7 +196,7 @@ func (f *Filter) readFromHTTP(
 		return "", nil, fmt.Errorf("got status code %d, want %d", resp.StatusCode, http.StatusOK)
 	}

-	fltFile, err := aghrenameio.NewPendingFile(cachePath, aghos.DefaultPermFile)
+	fltFile, err := aghrenameio.NewPendingFile(cachePath, 0o644)
 	if err != nil {
 		return "", nil, fmt.Errorf("creating temp file: %w", err)
 	}
@@ -272,7 +271,7 @@ func parseIntoCache(
 	filePath string,
 	cachePath string,
 ) (parseRes *ParseResult, err error) {
-	tmpFile, err := aghrenameio.NewPendingFile(cachePath, aghos.DefaultPermFile)
+	tmpFile, err := aghrenameio.NewPendingFile(cachePath, 0o644)
 	if err != nil {
 		return nil, fmt.Errorf("creating temp file: %w", err)
 	}
--- a/internal/filtering/safesearch.go
+++ b/internal/filtering/safesearch.go
@@ -1,17 +1,15 @@
 package filtering

-import "context"
-
 // SafeSearch interface describes a service for search engines hosts rewrites.
 type SafeSearch interface {
 	// CheckHost checks host with safe search filter.  CheckHost must be safe
 	// for concurrent use.  qtype must be either [dns.TypeA] or [dns.TypeAAAA].
-	CheckHost(ctx context.Context, host string, qtype uint16) (res Result, err error)
+	CheckHost(host string, qtype uint16) (res Result, err error)

 	// Update updates the configuration of the safe search filter.  Update must
 	// be safe for concurrent use.  An implementation of Update may ignore some
 	// fields, but it must document which.
-	Update(ctx context.Context, conf SafeSearchConfig) (err error)
+	Update(conf SafeSearchConfig) (err error)
 }

 // SafeSearchConfig is a struct with safe search related settings.
@@ -42,13 +40,10 @@ func (d *DNSFilter) checkSafeSearch(
 		return Result{}, nil
 	}

-	// TODO(s.chzhen):  Pass context.
-	ctx := context.TODO()
-
 	clientSafeSearch := setts.ClientSafeSearch
 	if clientSafeSearch != nil {
-		return clientSafeSearch.CheckHost(ctx, host, qtype)
+		return clientSafeSearch.CheckHost(host, qtype)
 	}

-	return d.safeSearch.CheckHost(ctx, host, qtype)
+	return d.safeSearch.CheckHost(host, qtype)
 }
--- a/internal/filtering/safesearch/safesearch.go
+++ b/internal/filtering/safesearch/safesearch.go
@@ -3,11 +3,9 @@ package safesearch

 import (
 	"bytes"
-	"context"
 	"encoding/binary"
 	"encoding/gob"
 	"fmt"
-	"log/slog"
 	"net/netip"
 	"strings"
 	"sync"
@@ -16,20 +14,13 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering/rulelist"
 	"github.com/AdguardTeam/golibs/cache"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/urlfilter"
 	"github.com/AdguardTeam/urlfilter/filterlist"
 	"github.com/AdguardTeam/urlfilter/rules"
-	"github.com/c2h5oh/datasize"
 	"github.com/miekg/dns"
 )

-// Attribute keys and values for logging.
-const (
-	LogPrefix    = "safesearch"
-	LogKeyClient = "client"
-)
-
 // Service is a enum with service names used as search providers.
 type Service string

@@ -66,32 +57,9 @@ func isServiceProtected(s filtering.SafeSearchConfig, service Service) (ok bool)
 	}
 }

-// DefaultConfig is the configuration structure for [Default].
-type DefaultConfig struct {
-	// Logger is used for logging the operation of the safe search filter.
-	Logger *slog.Logger
-
-	// ClientName is the name of the persistent client associated with the safe
-	// search filter, if there is one.
-	ClientName string
-
-	// CacheSize is the size of the filter results cache.
-	CacheSize uint
-
-	// CacheTTL is the Time to Live duration for cached items.
-	CacheTTL time.Duration
-
-	// ServicesConfig contains safe search settings for services.  It must not
-	// be nil.
-	ServicesConfig filtering.SafeSearchConfig
-}
-
 // Default is the default safe search filter that uses filtering rules with the
 // dnsrewrite modifier.
 type Default struct {
-	// logger is used for logging the operation of the safe search filter.
-	logger *slog.Logger
-
 	// mu protects engine.
 	mu *sync.RWMutex

@@ -99,28 +67,33 @@ type Default struct {
 	// engine may be nil, which means that this safe search filter is disabled.
 	engine *urlfilter.DNSEngine

-	// cache stores safe search filtering results.
-	cache cache.Cache
-
-	// cacheTTL is the Time to Live duration for cached items.
-	cacheTTL time.Duration
+	cache     cache.Cache
+	logPrefix string
+	cacheTTL  time.Duration
 }

-// NewDefault returns an initialized default safe search filter.  ctx is used
-// to log the initial refresh.
-func NewDefault(ctx context.Context, conf *DefaultConfig) (ss *Default, err error) {
+// NewDefault returns an initialized default safe search filter.  name is used
+// for logging.
+func NewDefault(
+	conf filtering.SafeSearchConfig,
+	name string,
+	cacheSize uint,
+	cacheTTL time.Duration,
+) (ss *Default, err error) {
 	ss = &Default{
-		logger: conf.Logger,
-		mu:     &sync.RWMutex{},
+		mu: &sync.RWMutex{},
+
 		cache: cache.New(cache.Config{
 			EnableLRU: true,
-			MaxSize:   conf.CacheSize,
+			MaxSize:   cacheSize,
 		}),
-		cacheTTL: conf.CacheTTL,
+		// Use %s, because the client safe-search names already contain double
+		// quotes.
+		logPrefix: fmt.Sprintf("safesearch %s: ", name),
+		cacheTTL:  cacheTTL,
 	}

-	// TODO(s.chzhen):  Move to [Default.InitialRefresh].
-	err = ss.resetEngine(ctx, rulelist.URLFilterIDSafeSearch, conf.ServicesConfig)
+	err = ss.resetEngine(rulelist.URLFilterIDSafeSearch, conf)
 	if err != nil {
 		// Don't wrap the error, because it's informative enough as is.
 		return nil, err
@@ -129,15 +102,29 @@ func NewDefault(ctx context.Context, conf *DefaultConfig) (ss *Default, err erro
 	return ss, nil
 }

+// log is a helper for logging  that includes the name of the safe search
+// filter.  level must be one of [log.DEBUG], [log.INFO], and [log.ERROR].
+func (ss *Default) log(level log.Level, msg string, args ...any) {
+	switch level {
+	case log.DEBUG:
+		log.Debug(ss.logPrefix+msg, args...)
+	case log.INFO:
+		log.Info(ss.logPrefix+msg, args...)
+	case log.ERROR:
+		log.Error(ss.logPrefix+msg, args...)
+	default:
+		panic(fmt.Errorf("safesearch: unsupported logging level %d", level))
+	}
+}
+
 // resetEngine creates new engine for provided safe search configuration and
 // sets it in ss.
 func (ss *Default) resetEngine(
-	ctx context.Context,
 	listID int,
 	conf filtering.SafeSearchConfig,
 ) (err error) {
 	if !conf.Enabled {
-		ss.logger.DebugContext(ctx, "disabled")
+		ss.log(log.INFO, "disabled")

 		return nil
 	}
@@ -162,7 +149,7 @@ func (ss *Default) resetEngine(

 	ss.engine = urlfilter.NewDNSEngine(rs)

-	ss.logger.InfoContext(ctx, "reset rules", "count", ss.engine.RulesCount)
+	ss.log(log.INFO, "reset %d rules", ss.engine.RulesCount)

 	return nil
 }
@@ -171,14 +158,10 @@ func (ss *Default) resetEngine(
 var _ filtering.SafeSearch = (*Default)(nil)

 // CheckHost implements the [filtering.SafeSearch] interface for *Default.
-func (ss *Default) CheckHost(
-	ctx context.Context,
-	host string,
-	qtype rules.RRType,
-) (res filtering.Result, err error) {
+func (ss *Default) CheckHost(host string, qtype rules.RRType) (res filtering.Result, err error) {
 	start := time.Now()
 	defer func() {
-		ss.logger.DebugContext(ctx, "lookup finished", "host", host, "elapsed", time.Since(start))
+		ss.log(log.DEBUG, "lookup for %q finished in %s", host, time.Since(start))
 	}()

 	switch qtype {
@@ -189,9 +172,9 @@ func (ss *Default) CheckHost(
 	}

 	// Check cache. Return cached result if it was found
-	cachedValue, isFound := ss.getCachedResult(ctx, host, qtype)
+	cachedValue, isFound := ss.getCachedResult(host, qtype)
 	if isFound {
-		ss.logger.DebugContext(ctx, "found in cache", "host", host)
+		ss.log(log.DEBUG, "found in cache: %q", host)

 		return cachedValue, nil
 	}
@@ -203,7 +186,7 @@ func (ss *Default) CheckHost(

 	fltRes, err := ss.newResult(rewrite, qtype)
 	if err != nil {
-		ss.logger.ErrorContext(ctx, "looking up addresses", "host", host, slogutil.KeyError, err)
+		ss.log(log.DEBUG, "looking up addresses for %q: %s", host, err)

 		return filtering.Result{}, err
 	}
@@ -212,7 +195,7 @@ func (ss *Default) CheckHost(

 	// TODO(a.garipov): Consider switch back to resolving CNAME records IPs and
 	// saving results to cache.
-	ss.setCacheResult(ctx, host, qtype, res)
+	ss.setCacheResult(host, qtype, res)

 	return res, nil
 }
@@ -272,12 +255,7 @@ func (ss *Default) newResult(

 // setCacheResult stores data in cache for host.  qtype is expected to be either
 // [dns.TypeA] or [dns.TypeAAAA].
-func (ss *Default) setCacheResult(
-	ctx context.Context,
-	host string,
-	qtype rules.RRType,
-	res filtering.Result,
-) {
+func (ss *Default) setCacheResult(host string, qtype rules.RRType, res filtering.Result) {
 	expire := uint32(time.Now().Add(ss.cacheTTL).Unix())
 	exp := make([]byte, 4)
 	binary.BigEndian.PutUint32(exp, expire)
@@ -285,7 +263,7 @@ func (ss *Default) setCacheResult(

 	err := gob.NewEncoder(buf).Encode(res)
 	if err != nil {
-		ss.logger.ErrorContext(ctx, "cache encoding", slogutil.KeyError, err)
+		ss.log(log.ERROR, "cache encoding: %s", err)

 		return
 	}
@@ -293,18 +271,12 @@ func (ss *Default) setCacheResult(
 	val := buf.Bytes()
 	_ = ss.cache.Set([]byte(dns.Type(qtype).String()+" "+host), val)

-	ss.logger.DebugContext(
-		ctx,
-		"stored in cache",
-		"host", host,
-		"entry_size", datasize.ByteSize(len(val)),
-	)
+	ss.log(log.DEBUG, "stored in cache: %q, %d bytes", host, len(val))
 }

 // getCachedResult returns stored data from cache for host.  qtype is expected
 // to be either [dns.TypeA] or [dns.TypeAAAA].
 func (ss *Default) getCachedResult(
-	ctx context.Context,
 	host string,
 	qtype rules.RRType,
 ) (res filtering.Result, ok bool) {
@@ -326,7 +298,7 @@ func (ss *Default) getCachedResult(

 	err := gob.NewDecoder(buf).Decode(&res)
 	if err != nil {
-		ss.logger.ErrorContext(ctx, "cache decoding", slogutil.KeyError, err)
+		ss.log(log.ERROR, "cache decoding: %s", err)

 		return filtering.Result{}, false
 	}
@@ -336,11 +308,11 @@ func (ss *Default) getCachedResult(

 // Update implements the [filtering.SafeSearch] interface for *Default.  Update
 // ignores the CustomResolver and Enabled fields.
-func (ss *Default) Update(ctx context.Context, conf filtering.SafeSearchConfig) (err error) {
+func (ss *Default) Update(conf filtering.SafeSearchConfig) (err error) {
 	ss.mu.Lock()
 	defer ss.mu.Unlock()

-	err = ss.resetEngine(ctx, rulelist.URLFilterIDSafeSearch, conf)
+	err = ss.resetEngine(rulelist.URLFilterIDSafeSearch, conf)
 	if err != nil {
 		// Don't wrap the error, because it's informative enough as is.
 		return err
--- a/internal/filtering/safesearch/safesearch_internal_test.go
+++ b/internal/filtering/safesearch/safesearch_internal_test.go
@@ -6,8 +6,6 @@ import (
 	"time"

 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
-	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/AdguardTeam/urlfilter/rules"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
@@ -23,9 +21,6 @@ const (
 	testCacheTTL  = 30 * time.Minute
 )

-// testTimeout is the common timeout for tests and contexts.
-const testTimeout = 1 * time.Second
-
 var defaultSafeSearchConf = filtering.SafeSearchConfig{
 	Enabled:    true,
 	Bing:       true,
@@ -40,12 +35,7 @@ var defaultSafeSearchConf = filtering.SafeSearchConfig{
 var yandexIP = netip.AddrFrom4([4]byte{213, 180, 193, 56})

 func newForTest(t testing.TB, ssConf filtering.SafeSearchConfig) (ss *Default) {
-	ss, err := NewDefault(testutil.ContextWithTimeout(t, testTimeout), &DefaultConfig{
-		Logger:         slogutil.NewDiscardLogger(),
-		ServicesConfig: ssConf,
-		CacheSize:      testCacheSize,
-		CacheTTL:       testCacheTTL,
-	})
+	ss, err := NewDefault(ssConf, "", testCacheSize, testCacheTTL)
 	require.NoError(t, err)

 	return ss
@@ -62,17 +52,16 @@ func TestSafeSearchCacheYandex(t *testing.T) {
 	const domain = "yandex.ru"

 	ss := newForTest(t, filtering.SafeSearchConfig{Enabled: false})
-	ctx := testutil.ContextWithTimeout(t, testTimeout)

 	// Check host with disabled safesearch.
-	res, err := ss.CheckHost(ctx, domain, testQType)
+	res, err := ss.CheckHost(domain, testQType)
 	require.NoError(t, err)

 	assert.False(t, res.IsFiltered)
 	assert.Empty(t, res.Rules)

 	ss = newForTest(t, defaultSafeSearchConf)
-	res, err = ss.CheckHost(ctx, domain, testQType)
+	res, err = ss.CheckHost(domain, testQType)
 	require.NoError(t, err)

 	// For yandex we already know valid IP.
@@ -81,7 +70,7 @@ func TestSafeSearchCacheYandex(t *testing.T) {
 	assert.Equal(t, res.Rules[0].IP, yandexIP)

 	// Check cache.
-	cachedValue, isFound := ss.getCachedResult(ctx, domain, testQType)
+	cachedValue, isFound := ss.getCachedResult(domain, testQType)
 	require.True(t, isFound)
 	require.Len(t, cachedValue.Rules, 1)

--- a/internal/filtering/safesearch/safesearch_test.go
+++ b/internal/filtering/safesearch/safesearch_test.go
@@ -10,15 +10,15 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering/rulelist"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering/safesearch"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

-// testTimeout is the common timeout for tests and contexts.
-const testTimeout = 1 * time.Second
+func TestMain(m *testing.M) {
+	testutil.DiscardLogOutput(m)
+}

 // Common test constants.
 const (
@@ -47,13 +47,7 @@ var yandexIP = netip.AddrFrom4([4]byte{213, 180, 193, 56})

 func TestDefault_CheckHost_yandex(t *testing.T) {
 	conf := testConf
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	ss, err := safesearch.NewDefault(ctx, &safesearch.DefaultConfig{
-		Logger:         slogutil.NewDiscardLogger(),
-		ServicesConfig: conf,
-		CacheSize:      testCacheSize,
-		CacheTTL:       testCacheTTL,
-	})
+	ss, err := safesearch.NewDefault(conf, "", testCacheSize, testCacheTTL)
 	require.NoError(t, err)

 	hosts := []string{
@@ -88,7 +82,7 @@ func TestDefault_CheckHost_yandex(t *testing.T) {
 			for _, host := range hosts {
 				// Check host for each domain.
 				var res filtering.Result
-				res, err = ss.CheckHost(ctx, host, tc.qt)
+				res, err = ss.CheckHost(host, tc.qt)
 				require.NoError(t, err)

 				assert.True(t, res.IsFiltered)
@@ -109,13 +103,7 @@ func TestDefault_CheckHost_yandex(t *testing.T) {
 }

 func TestDefault_CheckHost_google(t *testing.T) {
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	ss, err := safesearch.NewDefault(ctx, &safesearch.DefaultConfig{
-		Logger:         slogutil.NewDiscardLogger(),
-		ServicesConfig: testConf,
-		CacheSize:      testCacheSize,
-		CacheTTL:       testCacheTTL,
-	})
+	ss, err := safesearch.NewDefault(testConf, "", testCacheSize, testCacheTTL)
 	require.NoError(t, err)

 	// Check host for each domain.
@@ -130,7 +118,7 @@ func TestDefault_CheckHost_google(t *testing.T) {
 	} {
 		t.Run(host, func(t *testing.T) {
 			var res filtering.Result
-			res, err = ss.CheckHost(ctx, host, testQType)
+			res, err = ss.CheckHost(host, testQType)
 			require.NoError(t, err)

 			assert.True(t, res.IsFiltered)
@@ -161,19 +149,13 @@ func (r *testResolver) LookupIP(
 }

 func TestDefault_CheckHost_duckduckgoAAAA(t *testing.T) {
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	ss, err := safesearch.NewDefault(ctx, &safesearch.DefaultConfig{
-		Logger:         slogutil.NewDiscardLogger(),
-		ServicesConfig: testConf,
-		CacheSize:      testCacheSize,
-		CacheTTL:       testCacheTTL,
-	})
+	ss, err := safesearch.NewDefault(testConf, "", testCacheSize, testCacheTTL)
 	require.NoError(t, err)

 	// The DuckDuckGo safe-search addresses are resolved through CNAMEs, but
 	// DuckDuckGo doesn't have a safe-search IPv6 address.  The result should be
 	// the same as the one for Yandex IPv6.  That is, a NODATA response.
-	res, err := ss.CheckHost(ctx, "www.duckduckgo.com", dns.TypeAAAA)
+	res, err := ss.CheckHost("www.duckduckgo.com", dns.TypeAAAA)
 	require.NoError(t, err)

 	assert.True(t, res.IsFiltered)
@@ -184,38 +166,32 @@ func TestDefault_CheckHost_duckduckgoAAAA(t *testing.T) {

 func TestDefault_Update(t *testing.T) {
 	conf := testConf
-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	ss, err := safesearch.NewDefault(ctx, &safesearch.DefaultConfig{
-		Logger:         slogutil.NewDiscardLogger(),
-		ServicesConfig: conf,
-		CacheSize:      testCacheSize,
-		CacheTTL:       testCacheTTL,
-	})
+	ss, err := safesearch.NewDefault(conf, "", testCacheSize, testCacheTTL)
 	require.NoError(t, err)

-	res, err := ss.CheckHost(ctx, "www.yandex.com", testQType)
+	res, err := ss.CheckHost("www.yandex.com", testQType)
 	require.NoError(t, err)

 	assert.True(t, res.IsFiltered)

-	err = ss.Update(ctx, filtering.SafeSearchConfig{
+	err = ss.Update(filtering.SafeSearchConfig{
 		Enabled: true,
 		Google:  false,
 	})
 	require.NoError(t, err)

-	res, err = ss.CheckHost(ctx, "www.yandex.com", testQType)
+	res, err = ss.CheckHost("www.yandex.com", testQType)
 	require.NoError(t, err)

 	assert.False(t, res.IsFiltered)

-	err = ss.Update(ctx, filtering.SafeSearchConfig{
+	err = ss.Update(filtering.SafeSearchConfig{
 		Enabled: false,
 		Google:  true,
 	})
 	require.NoError(t, err)

-	res, err = ss.CheckHost(ctx, "www.yandex.com", testQType)
+	res, err = ss.CheckHost("www.yandex.com", testQType)
 	require.NoError(t, err)

 	assert.False(t, res.IsFiltered)
--- a/internal/filtering/safesearchhttp.go
+++ b/internal/filtering/safesearchhttp.go
@@ -51,7 +51,7 @@ func (d *DNSFilter) handleSafeSearchSettings(w http.ResponseWriter, r *http.Requ
 	}

 	conf := *req
-	err = d.safeSearch.Update(r.Context(), conf)
+	err = d.safeSearch.Update(conf)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "updating: %s", err)

--- a/internal/filtering/servicelist.go
+++ b/internal/filtering/servicelist.go
--- a/internal/home/auth.go
+++ b/internal/home/auth.go
@@ -9,7 +9,6 @@ import (
 	"sync"
 	"time"

-	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/netutil"
@@ -90,11 +89,7 @@ func InitAuth(
 		trustedProxies: trustedProxies,
 	}
 	var err error
-
-	opts := *bbolt.DefaultOptions
-	opts.OpenFile = aghos.OpenFile
-
-	a.db, err = bbolt.Open(dbFilename, aghos.DefaultPermFile, &opts)
+	a.db, err = bbolt.Open(dbFilename, 0o644, nil)
 	if err != nil {
 		log.Error("auth: open DB: %s: %s", dbFilename, err)
 		if err.Error() == "invalid argument" {
--- a/internal/home/authglinet.go
+++ b/internal/home/authglinet.go
@@ -97,7 +97,6 @@ func glGetTokenDate(file string) uint32 {

 	buf := bytes.NewBuffer(bs)

-	// TODO(a.garipov): Get rid of github.com/josharian/native dependency.
 	err = binary.Read(buf, native.Endian, &dateToken)
 	if err != nil {
 		log.Error("decoding token: %s", err)
--- a/internal/home/clients.go
+++ b/internal/home/clients.go
@@ -1,9 +1,8 @@
 package home

 import (
-	"context"
 	"fmt"
-	"log/slog"
+	"net"
 	"net/netip"
 	"slices"
 	"sync"
@@ -12,32 +11,59 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
 	"github.com/AdguardTeam/AdGuardHome/internal/arpdb"
 	"github.com/AdguardTeam/AdGuardHome/internal/client"
+	"github.com/AdguardTeam/AdGuardHome/internal/dhcpsvc"
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
-	"github.com/AdguardTeam/AdGuardHome/internal/filtering/safesearch"
 	"github.com/AdguardTeam/AdGuardHome/internal/querylog"
 	"github.com/AdguardTeam/AdGuardHome/internal/schedule"
 	"github.com/AdguardTeam/AdGuardHome/internal/whois"
 	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/dnsproxy/upstream"
 	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
+	"github.com/AdguardTeam/golibs/hostsfile"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/stringutil"
 )

+// DHCP is an interface for accessing DHCP lease data the [clientsContainer]
+// needs.
+type DHCP interface {
+	// Leases returns all the DHCP leases.
+	Leases() (leases []*dhcpsvc.Lease)
+
+	// HostByIP returns the hostname of the DHCP client with the given IP
+	// address.  The address will be netip.Addr{} if there is no such client,
+	// due to an assumption that a DHCP client must always have a hostname.
+	HostByIP(ip netip.Addr) (host string)
+
+	// MACByIP returns the MAC address for the given IP address leased.  It
+	// returns nil if there is no such client, due to an assumption that a DHCP
+	// client must always have a MAC address.
+	MACByIP(ip netip.Addr) (mac net.HardwareAddr)
+}
+
 // clientsContainer is the storage of all runtime and persistent clients.
 type clientsContainer struct {
-	// baseLogger is used to create loggers with custom prefixes for safe search
-	// filter.  It must not be nil.
-	baseLogger *slog.Logger
-
 	// storage stores information about persistent clients.
 	storage *client.Storage

+	// runtimeIndex stores information about runtime clients.
+	runtimeIndex *client.RuntimeIndex
+
+	// dhcp is the DHCP service implementation.
+	dhcp DHCP
+
 	// clientChecker checks if a client is blocked by the current access
 	// settings.
 	clientChecker BlockedClientChecker

+	// etcHosts contains list of rewrite rules taken from the operating system's
+	// hosts database.
+	etcHosts *aghnet.HostsContainer
+
+	// arpDB stores the neighbors retrieved from ARP.
+	arpDB arpdb.Interface
+
 	// lock protects all fields.
 	//
 	// TODO(a.garipov): Use a pointer and describe which fields are protected in
@@ -68,10 +94,8 @@ type BlockedClientChecker interface {
 // dhcpServer: optional
 // Note: this function must be called only once
 func (clients *clientsContainer) Init(
-	ctx context.Context,
-	baseLogger *slog.Logger,
 	objects []*clientObject,
-	dhcpServer client.DHCP,
+	dhcpServer DHCP,
 	etcHosts *aghnet.HostsContainer,
 	arpDB arpdb.Interface,
 	filteringConf *filtering.Config,
@@ -81,19 +105,28 @@ func (clients *clientsContainer) Init(
 		return errors.Error("clients container already initialized")
 	}

-	clients.baseLogger = baseLogger
+	clients.runtimeIndex = client.NewRuntimeIndex()
+
+	clients.storage = client.NewStorage(&client.Config{
+		AllowedTags: clientTags,
+	})
+
+	// TODO(e.burkov):  Use [dhcpsvc] implementation when it's ready.
+	clients.dhcp = dhcpServer
+
+	clients.etcHosts = etcHosts
+	clients.arpDB = arpDB
+	err = clients.addFromConfig(objects, filteringConf)
+	if err != nil {
+		// Don't wrap the error, because it's informative enough as is.
+		return err
+	}
+
 	clients.safeSearchCacheSize = filteringConf.SafeSearchCacheSize
 	clients.safeSearchCacheTTL = time.Minute * time.Duration(filteringConf.CacheTime)

-	confClients := make([]*client.Persistent, 0, len(objects))
-	for i, o := range objects {
-		var p *client.Persistent
-		p, err = o.toPersistent(ctx, baseLogger, clients.safeSearchCacheSize, clients.safeSearchCacheTTL)
-		if err != nil {
-			return fmt.Errorf("init persistent client at index %d: %w", i, err)
-		}
-
-		confClients = append(confClients, p)
+	if clients.testing {
+		return nil
 	}

 	// The clients.etcHosts may be nil even if config.Clients.Sources.HostsFile
@@ -102,27 +135,21 @@ func (clients *clientsContainer) Init(
 	// TODO(e.burkov):  The option should probably be returned, since hosts file
 	// currently used not only for clients' information enrichment, but also in
 	// the filtering module and upstream addresses resolution.
-	var hosts client.HostsContainer
-	if config.Clients.Sources.HostsFile && etcHosts != nil {
-		hosts = etcHosts
-	}
-
-	clients.storage, err = client.NewStorage(ctx, &client.StorageConfig{
-		Logger:                 baseLogger.With(slogutil.KeyPrefix, "client_storage"),
-		InitialClients:         confClients,
-		DHCP:                   dhcpServer,
-		EtcHosts:               hosts,
-		ARPDB:                  arpDB,
-		ARPClientsUpdatePeriod: arpClientsUpdatePeriod,
-		RuntimeSourceDHCP:      config.Clients.Sources.DHCP,
-	})
-	if err != nil {
-		return fmt.Errorf("init client storage: %w", err)
+	if config.Clients.Sources.HostsFile && clients.etcHosts != nil {
+		go clients.handleHostsUpdates()
 	}

 	return nil
 }

+// handleHostsUpdates receives the updates from the hosts container and adds
+// them to the clients container.  It is intended to be used as a goroutine.
+func (clients *clientsContainer) handleHostsUpdates() {
+	for upd := range clients.etcHosts.Upd() {
+		clients.addFromHostsFile(upd)
+	}
+}
+
 // webHandlersRegistered prevents a [clientsContainer] from registering its web
 // handlers more than once.
 //
@@ -130,7 +157,7 @@ func (clients *clientsContainer) Init(
 var webHandlersRegistered = false

 // Start starts the clients container.
-func (clients *clientsContainer) Start(ctx context.Context) (err error) {
+func (clients *clientsContainer) Start() {
 	if clients.testing {
 		return
 	}
@@ -140,7 +167,14 @@ func (clients *clientsContainer) Start(ctx context.Context) (err error) {
 		clients.registerWebHandlers()
 	}

-	return clients.storage.Start(ctx)
+	go clients.periodicUpdate()
+}
+
+// reloadARP reloads runtime clients from ARP, if configured.
+func (clients *clientsContainer) reloadARP() {
+	if clients.arpDB != nil {
+		clients.addFromSystemARP()
+	}
 }

 // clientObject is the YAML representation of a persistent client.
@@ -179,10 +213,7 @@ type clientObject struct {

 // toPersistent returns an initialized persistent client if there are no errors.
 func (o *clientObject) toPersistent(
-	ctx context.Context,
-	baseLogger *slog.Logger,
-	safeSearchCacheSize uint,
-	safeSearchCacheTTL time.Duration,
+	filteringConf *filtering.Config,
 ) (cli *client.Persistent, err error) {
 	cli = &client.Persistent{
 		Name: o.Name,
@@ -216,23 +247,14 @@ func (o *clientObject) toPersistent(
 	}

 	if o.SafeSearchConf.Enabled {
-		logger := baseLogger.With(
-			slogutil.KeyPrefix, safesearch.LogPrefix,
-			safesearch.LogKeyClient, cli.Name,
+		err = cli.SetSafeSearch(
+			o.SafeSearchConf,
+			filteringConf.SafeSearchCacheSize,
+			time.Minute*time.Duration(filteringConf.CacheTime),
 		)
-		var ss *safesearch.Default
-		ss, err = safesearch.NewDefault(ctx, &safesearch.DefaultConfig{
-			Logger:         logger,
-			ServicesConfig: o.SafeSearchConf,
-			ClientName:     cli.Name,
-			CacheSize:      safeSearchCacheSize,
-			CacheTTL:       safeSearchCacheTTL,
-		})
 		if err != nil {
 			return nil, fmt.Errorf("init safesearch %q: %w", cli.Name, err)
 		}
-
-		cli.SafeSearch = ss
 	}

 	if o.BlockedServices == nil {
@@ -253,6 +275,28 @@ func (o *clientObject) toPersistent(
 	return cli, nil
 }

+// addFromConfig initializes the clients container with objects from the
+// configuration file.
+func (clients *clientsContainer) addFromConfig(
+	objects []*clientObject,
+	filteringConf *filtering.Config,
+) (err error) {
+	for i, o := range objects {
+		var cli *client.Persistent
+		cli, err = o.toPersistent(filteringConf)
+		if err != nil {
+			return fmt.Errorf("clients: init persistent client at index %d: %w", i, err)
+		}
+
+		err = clients.storage.Add(cli)
+		if err != nil {
+			return fmt.Errorf("adding client %q at index %d: %w", cli.Name, i, err)
+		}
+	}
+
+	return nil
+}
+
 // forConfig returns all currently known persistent clients as objects for the
 // configuration file.
 func (clients *clientsContainer) forConfig() (objs []*clientObject) {
@@ -293,6 +337,39 @@ func (clients *clientsContainer) forConfig() (objs []*clientObject) {
 // arpClientsUpdatePeriod defines how often ARP clients are updated.
 const arpClientsUpdatePeriod = 10 * time.Minute

+func (clients *clientsContainer) periodicUpdate() {
+	defer log.OnPanic("clients container")
+
+	for {
+		clients.reloadARP()
+		time.Sleep(arpClientsUpdatePeriod)
+	}
+}
+
+// clientSource checks if client with this IP address already exists and returns
+// the source which updated it last.  It returns [client.SourceNone] if the
+// client doesn't exist.  Note that it is only used in tests.
+func (clients *clientsContainer) clientSource(ip netip.Addr) (src client.Source) {
+	clients.lock.Lock()
+	defer clients.lock.Unlock()
+
+	_, ok := clients.findLocked(ip.String())
+	if ok {
+		return client.SourcePersistent
+	}
+
+	rc := clients.runtimeIndex.Client(ip)
+	if rc != nil {
+		src, _ = rc.Info()
+	}
+
+	if src < client.SourceDHCP && clients.dhcp.HostByIP(ip) != "" {
+		src = client.SourceDHCP
+	}
+
+	return src
+}
+
 // findMultiple is a wrapper around [clientsContainer.find] to make it a valid
 // client finder for the query log.  c is never nil; if no information about the
 // client is found, it returns an artificial client record by only setting the
@@ -338,7 +415,7 @@ func (clients *clientsContainer) clientOrArtificial(
 		}, false
 	}

-	rc := clients.storage.ClientRuntime(ip)
+	rc := clients.findRuntimeClient(ip)
 	if rc != nil {
 		_, host := rc.Info()

@@ -353,6 +430,19 @@ func (clients *clientsContainer) clientOrArtificial(
 	}, true
 }

+// find returns a shallow copy of the client if there is one found.
+func (clients *clientsContainer) find(id string) (c *client.Persistent, ok bool) {
+	clients.lock.Lock()
+	defer clients.lock.Unlock()
+
+	c, ok = clients.findLocked(id)
+	if !ok {
+		return nil, false
+	}
+
+	return c, true
+}
+
 // shouldCountClient is a wrapper around [clientsContainer.find] to make it a
 // valid client information finder for the statistics.  If no information about
 // the client is found, it returns true.
@@ -361,7 +451,7 @@ func (clients *clientsContainer) shouldCountClient(ids []string) (y bool) {
 	defer clients.lock.Unlock()

 	for _, id := range ids {
-		client, ok := clients.storage.Find(id)
+		client, ok := clients.findLocked(id)
 		if ok {
 			return !client.IgnoreStatistics
 		}
@@ -383,7 +473,7 @@ func (clients *clientsContainer) UpstreamConfigByID(
 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	c, ok := clients.storage.Find(id)
+	c, ok := clients.findLocked(id)
 	if !ok {
 		return nil, nil
 	} else if c.UpstreamConfig != nil {
@@ -418,13 +508,107 @@ func (clients *clientsContainer) UpstreamConfigByID(
 	)
 	c.UpstreamConfig = conf

-	// TODO(s.chzhen):  Pass context.
-	err = clients.storage.Update(context.TODO(), c.Name, c)
-	if err != nil {
-		return nil, fmt.Errorf("setting upstream config: %w", err)
+	return conf, nil
+}
+
+// findLocked searches for a client by its ID.  clients.lock is expected to be
+// locked.
+func (clients *clientsContainer) findLocked(id string) (c *client.Persistent, ok bool) {
+	c, ok = clients.storage.Find(id)
+	if ok {
+		return c, true
 	}

-	return conf, nil
+	ip, err := netip.ParseAddr(id)
+	if err != nil {
+		return nil, false
+	}
+
+	// TODO(e.burkov):  Iterate through clients.list only once.
+	return clients.findDHCP(ip)
+}
+
+// findDHCP searches for a client by its MAC, if the DHCP server is active and
+// there is such client.  clients.lock is expected to be locked.
+func (clients *clientsContainer) findDHCP(ip netip.Addr) (c *client.Persistent, ok bool) {
+	foundMAC := clients.dhcp.MACByIP(ip)
+	if foundMAC == nil {
+		return nil, false
+	}
+
+	return clients.storage.FindByMAC(foundMAC)
+}
+
+// runtimeClient returns a runtime client from internal index.  Note that it
+// doesn't include DHCP clients.
+func (clients *clientsContainer) runtimeClient(ip netip.Addr) (rc *client.Runtime) {
+	if ip == (netip.Addr{}) {
+		return nil
+	}
+
+	clients.lock.Lock()
+	defer clients.lock.Unlock()
+
+	return clients.runtimeIndex.Client(ip)
+}
+
+// findRuntimeClient finds a runtime client by their IP.
+func (clients *clientsContainer) findRuntimeClient(ip netip.Addr) (rc *client.Runtime) {
+	rc = clients.runtimeClient(ip)
+	host := clients.dhcp.HostByIP(ip)
+
+	if host != "" {
+		if rc == nil {
+			rc = client.NewRuntime(ip)
+		}
+
+		rc.SetInfo(client.SourceDHCP, []string{host})
+
+		return rc
+	}
+
+	return rc
+}
+
+// setWHOISInfo sets the WHOIS information for a client.  clients.lock is
+// expected to be locked.
+func (clients *clientsContainer) setWHOISInfo(ip netip.Addr, wi *whois.Info) {
+	_, ok := clients.findLocked(ip.String())
+	if ok {
+		log.Debug("clients: client for %s is already created, ignore whois info", ip)
+
+		return
+	}
+
+	rc := clients.runtimeIndex.Client(ip)
+	if rc == nil {
+		// Create a RuntimeClient implicitly so that we don't do this check
+		// again.
+		rc = client.NewRuntime(ip)
+		clients.runtimeIndex.Add(rc)
+
+		log.Debug("clients: set whois info for runtime client with ip %s: %+v", ip, wi)
+	} else {
+		host, _ := rc.Info()
+		log.Debug("clients: set whois info for runtime client %s: %+v", host, wi)
+	}
+
+	rc.SetWHOIS(wi)
+}
+
+// addHost adds a new IP-hostname pairing.  The priorities of the sources are
+// taken into account.  ok is true if the pairing was added.
+//
+// TODO(a.garipov): Only used in internal tests.  Consider removing.
+func (clients *clientsContainer) addHost(
+	ip netip.Addr,
+	host string,
+	src client.Source,
+) (ok bool) {
+	clients.lock.Lock()
+	defer clients.lock.Unlock()
+
+	return clients.addHostLocked(ip, host, src)
 }

 // type check
@@ -432,17 +616,120 @@ var _ client.AddressUpdater = (*clientsContainer)(nil)

 // UpdateAddress implements the [client.AddressUpdater] interface for
 // *clientsContainer
-func (clients *clientsContainer) UpdateAddress(
-	ctx context.Context,
+func (clients *clientsContainer) UpdateAddress(ip netip.Addr, host string, info *whois.Info) {
+	// Common fast path optimization.
+	if host == "" && info == nil {
+		return
+	}
+
+	clients.lock.Lock()
+	defer clients.lock.Unlock()
+
+	if host != "" {
+		ok := clients.addHostLocked(ip, host, client.SourceRDNS)
+		if !ok {
+			log.Debug("clients: host for client %q already set with higher priority source", ip)
+		}
+	}
+
+	if info != nil {
+		clients.setWHOISInfo(ip, info)
+	}
+}
+
+// addHostLocked adds a new IP-hostname pairing.  clients.lock is expected to be
+// locked.
+func (clients *clientsContainer) addHostLocked(
 	ip netip.Addr,
 	host string,
-	info *whois.Info,
-) {
-	clients.storage.UpdateAddress(ctx, ip, host, info)
+	src client.Source,
+) (ok bool) {
+	rc := clients.runtimeIndex.Client(ip)
+	if rc == nil {
+		if src < client.SourceDHCP {
+			if clients.dhcp.HostByIP(ip) != "" {
+				return false
+			}
+		}
+
+		rc = client.NewRuntime(ip)
+		clients.runtimeIndex.Add(rc)
+	}
+
+	rc.SetInfo(src, []string{host})
+
+	log.Debug(
+		"clients: adding client info %s -> %q %q [%d]",
+		ip,
+		src,
+		host,
+		clients.runtimeIndex.Size(),
+	)
+
+	return true
+}
+
+// addFromHostsFile fills the client-hostname pairing index from the system's
+// hosts files.
+func (clients *clientsContainer) addFromHostsFile(hosts *hostsfile.DefaultStorage) {
+	clients.lock.Lock()
+	defer clients.lock.Unlock()
+
+	deleted := clients.runtimeIndex.DeleteBySource(client.SourceHostsFile)
+	log.Debug("clients: removed %d client aliases from system hosts file", deleted)
+
+	added := 0
+	hosts.RangeNames(func(addr netip.Addr, names []string) (cont bool) {
+		// Only the first name of the first record is considered a canonical
+		// hostname for the IP address.
+		//
+		// TODO(e.burkov):  Consider using all the names from all the records.
+		if clients.addHostLocked(addr, names[0], client.SourceHostsFile) {
+			added++
+		}
+
+		return true
+	})
+
+	log.Debug("clients: added %d client aliases from system hosts file", added)
+}
+
+// addFromSystemARP adds the IP-hostname pairings from the output of the arp -a
+// command.
+func (clients *clientsContainer) addFromSystemARP() {
+	if err := clients.arpDB.Refresh(); err != nil {
+		log.Error("refreshing arp container: %s", err)
+
+		clients.arpDB = arpdb.Empty{}
+
+		return
+	}
+
+	ns := clients.arpDB.Neighbors()
+	if len(ns) == 0 {
+		log.Debug("refreshing arp container: the update is empty")
+
+		return
+	}
+
+	clients.lock.Lock()
+	defer clients.lock.Unlock()
+
+	deleted := clients.runtimeIndex.DeleteBySource(client.SourceARP)
+	log.Debug("clients: removed %d client aliases from arp neighborhood", deleted)
+
+	added := 0
+	for _, n := range ns {
+		if clients.addHostLocked(n.IP, n.Name, client.SourceARP) {
+			added++
+		}
+	}
+
+	log.Debug("clients: added %d client aliases from arp neighborhood", added)
 }

 // close gracefully closes all the client-specific upstream configurations of
 // the persistent clients.
-func (clients *clientsContainer) close(ctx context.Context) (err error) {
-	return clients.storage.Shutdown(ctx)
+func (clients *clientsContainer) close() (err error) {
+	return clients.storage.CloseUpstreams()
 }
--- a/internal/home/clients_internal_test.go
+++ b/internal/home/clients_internal_test.go
@@ -3,16 +3,34 @@ package home
 import (
 	"net"
 	"net/netip"
+	"runtime"
 	"testing"
+	"time"

 	"github.com/AdguardTeam/AdGuardHome/internal/client"
+	"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
+	"github.com/AdguardTeam/AdGuardHome/internal/dhcpsvc"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
-	"github.com/AdguardTeam/golibs/testutil"
+	"github.com/AdguardTeam/AdGuardHome/internal/whois"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

+type testDHCP struct {
+	OnLeases func() (leases []*dhcpsvc.Lease)
+	OnHostBy func(ip netip.Addr) (host string)
+	OnMACBy  func(ip netip.Addr) (mac net.HardwareAddr)
+}
+
+// Lease implements the [DHCP] interface for testDHCP.
+func (t *testDHCP) Leases() (leases []*dhcpsvc.Lease) { return t.OnLeases() }
+
+// HostByIP implements the [DHCP] interface for testDHCP.
+func (t *testDHCP) HostByIP(ip netip.Addr) (host string) { return t.OnHostBy(ip) }
+
+// MACByIP implements the [DHCP] interface for testDHCP.
+func (t *testDHCP) MACByIP(ip netip.Addr) (mac net.HardwareAddr) { return t.OnMACBy(ip) }
+
 // newClientsContainer is a helper that creates a new clients container for
 // tests.
 func newClientsContainer(t *testing.T) (c *clientsContainer) {
@@ -22,28 +40,321 @@ func newClientsContainer(t *testing.T) (c *clientsContainer) {
 		testing: true,
 	}

-	ctx := testutil.ContextWithTimeout(t, testTimeout)
-	err := c.Init(
-		ctx,
-		slogutil.NewDiscardLogger(),
-		nil,
-		client.EmptyDHCP{},
-		nil,
-		nil,
-		&filtering.Config{},
-	)
+	dhcp := &testDHCP{
+		OnLeases: func() (leases []*dhcpsvc.Lease) { return nil },
+		OnHostBy: func(ip netip.Addr) (host string) { return "" },
+		OnMACBy:  func(ip netip.Addr) (mac net.HardwareAddr) { return nil },
+	}

-	require.NoError(t, err)
+	require.NoError(t, c.Init(nil, dhcp, nil, nil, &filtering.Config{}))

 	return c
 }

+func TestClients(t *testing.T) {
+	clients := newClientsContainer(t)
+
+	t.Run("add_success", func(t *testing.T) {
+		var (
+			cliNone = "1.2.3.4"
+			cli1    = "1.1.1.1"
+			cli2    = "2.2.2.2"
+
+			cli1IP = netip.MustParseAddr(cli1)
+			cli2IP = netip.MustParseAddr(cli2)
+
+			cliIPv6 = netip.MustParseAddr("1:2:3::4")
+		)
+
+		c := &client.Persistent{
+			Name: "client1",
+			UID:  client.MustNewUID(),
+			IPs:  []netip.Addr{cli1IP, cliIPv6},
+		}
+
+		err := clients.storage.Add(c)
+		require.NoError(t, err)
+
+		c = &client.Persistent{
+			Name: "client2",
+			UID:  client.MustNewUID(),
+			IPs:  []netip.Addr{cli2IP},
+		}
+
+		err = clients.storage.Add(c)
+		require.NoError(t, err)
+
+		c, ok := clients.find(cli1)
+		require.True(t, ok)
+
+		assert.Equal(t, "client1", c.Name)
+
+		c, ok = clients.find("1:2:3::4")
+		require.True(t, ok)
+
+		assert.Equal(t, "client1", c.Name)
+
+		c, ok = clients.find(cli2)
+		require.True(t, ok)
+
+		assert.Equal(t, "client2", c.Name)
+
+		_, ok = clients.find(cliNone)
+		assert.False(t, ok)
+
+		assert.Equal(t, clients.clientSource(cli1IP), client.SourcePersistent)
+		assert.Equal(t, clients.clientSource(cli2IP), client.SourcePersistent)
+	})
+
+	t.Run("add_fail_name", func(t *testing.T) {
+		err := clients.storage.Add(&client.Persistent{
+			Name: "client1",
+			UID:  client.MustNewUID(),
+			IPs:  []netip.Addr{netip.MustParseAddr("1.2.3.5")},
+		})
+		require.Error(t, err)
+	})
+
+	t.Run("add_fail_ip", func(t *testing.T) {
+		err := clients.storage.Add(&client.Persistent{
+			Name: "client3",
+			UID:  client.MustNewUID(),
+		})
+		require.Error(t, err)
+	})
+
+	t.Run("update_fail_ip", func(t *testing.T) {
+		err := clients.storage.Update("client1", &client.Persistent{
+			Name: "client1",
+			UID:  client.MustNewUID(),
+		})
+		assert.Error(t, err)
+	})
+
+	t.Run("update_success", func(t *testing.T) {
+		var (
+			cliOld = "1.1.1.1"
+			cliNew = "1.1.1.2"
+
+			cliNewIP = netip.MustParseAddr(cliNew)
+		)
+
+		prev, ok := clients.storage.FindByName("client1")
+		require.True(t, ok)
+		require.NotNil(t, prev)
+
+		err := clients.storage.Update("client1", &client.Persistent{
+			Name: "client1",
+			UID:  prev.UID,
+			IPs:  []netip.Addr{cliNewIP},
+		})
+		require.NoError(t, err)
+
+		_, ok = clients.find(cliOld)
+		assert.False(t, ok)
+
+		assert.Equal(t, clients.clientSource(cliNewIP), client.SourcePersistent)
+
+		prev, ok = clients.storage.FindByName("client1")
+		require.True(t, ok)
+		require.NotNil(t, prev)
+
+		err = clients.storage.Update("client1", &client.Persistent{
+			Name:           "client1-renamed",
+			UID:            prev.UID,
+			IPs:            []netip.Addr{cliNewIP},
+			UseOwnSettings: true,
+		})
+		require.NoError(t, err)
+
+		c, ok := clients.find(cliNew)
+		require.True(t, ok)
+
+		assert.Equal(t, "client1-renamed", c.Name)
+		assert.True(t, c.UseOwnSettings)
+
+		nilCli, ok := clients.storage.FindByName("client1")
+		require.False(t, ok)
+
+		assert.Nil(t, nilCli)
+
+		require.Len(t, c.IDs(), 1)
+
+		assert.Equal(t, cliNewIP, c.IPs[0])
+	})
+
+	t.Run("del_success", func(t *testing.T) {
+		ok := clients.storage.RemoveByName("client1-renamed")
+		require.True(t, ok)
+
+		_, ok = clients.find("1.1.1.2")
+		assert.False(t, ok)
+	})
+
+	t.Run("del_fail", func(t *testing.T) {
+		ok := clients.storage.RemoveByName("client3")
+		assert.False(t, ok)
+	})
+
+	t.Run("addhost_success", func(t *testing.T) {
+		ip := netip.MustParseAddr("1.1.1.1")
+		ok := clients.addHost(ip, "host", client.SourceARP)
+		assert.True(t, ok)
+
+		ok = clients.addHost(ip, "host2", client.SourceARP)
+		assert.True(t, ok)
+
+		ok = clients.addHost(ip, "host3", client.SourceHostsFile)
+		assert.True(t, ok)
+
+		assert.Equal(t, clients.clientSource(ip), client.SourceHostsFile)
+	})
+
+	t.Run("dhcp_replaces_arp", func(t *testing.T) {
+		ip := netip.MustParseAddr("1.2.3.4")
+		ok := clients.addHost(ip, "from_arp", client.SourceARP)
+		assert.True(t, ok)
+		assert.Equal(t, clients.clientSource(ip), client.SourceARP)
+
+		ok = clients.addHost(ip, "from_dhcp", client.SourceDHCP)
+		assert.True(t, ok)
+		assert.Equal(t, clients.clientSource(ip), client.SourceDHCP)
+	})
+
+	t.Run("addhost_priority", func(t *testing.T) {
+		ip := netip.MustParseAddr("1.1.1.1")
+		ok := clients.addHost(ip, "host1", client.SourceRDNS)
+		assert.True(t, ok)
+
+		assert.Equal(t, client.SourceHostsFile, clients.clientSource(ip))
+	})
+}
+
+func TestClientsWHOIS(t *testing.T) {
+	clients := newClientsContainer(t)
+	whois := &whois.Info{
+		Country: "AU",
+		Orgname: "Example Org",
+	}
+
+	t.Run("new_client", func(t *testing.T) {
+		ip := netip.MustParseAddr("1.1.1.255")
+		clients.setWHOISInfo(ip, whois)
+		rc := clients.runtimeIndex.Client(ip)
+		require.NotNil(t, rc)
+
+		assert.Equal(t, whois, rc.WHOIS())
+	})
+
+	t.Run("existing_auto-client", func(t *testing.T) {
+		ip := netip.MustParseAddr("1.1.1.1")
+		ok := clients.addHost(ip, "host", client.SourceRDNS)
+		assert.True(t, ok)
+
+		clients.setWHOISInfo(ip, whois)
+		rc := clients.runtimeIndex.Client(ip)
+		require.NotNil(t, rc)
+
+		assert.Equal(t, whois, rc.WHOIS())
+	})
+
+	t.Run("can't_set_manually-added", func(t *testing.T) {
+		ip := netip.MustParseAddr("1.1.1.2")
+
+		err := clients.storage.Add(&client.Persistent{
+			Name: "client1",
+			UID:  client.MustNewUID(),
+			IPs:  []netip.Addr{netip.MustParseAddr("1.1.1.2")},
+		})
+		require.NoError(t, err)
+
+		clients.setWHOISInfo(ip, whois)
+		rc := clients.runtimeIndex.Client(ip)
+		require.Nil(t, rc)
+
+		assert.True(t, clients.storage.RemoveByName("client1"))
+	})
+}
+
+func TestClientsAddExisting(t *testing.T) {
+	clients := newClientsContainer(t)
+
+	t.Run("simple", func(t *testing.T) {
+		ip := netip.MustParseAddr("1.1.1.1")
+
+		// Add a client.
+		err := clients.storage.Add(&client.Persistent{
+			Name:    "client1",
+			UID:     client.MustNewUID(),
+			IPs:     []netip.Addr{ip, netip.MustParseAddr("1:2:3::4")},
+			Subnets: []netip.Prefix{netip.MustParsePrefix("2.2.2.0/24")},
+			MACs:    []net.HardwareAddr{{0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA}},
+		})
+		require.NoError(t, err)
+
+		// Now add an auto-client with the same IP.
+		ok := clients.addHost(ip, "test", client.SourceRDNS)
+		assert.True(t, ok)
+	})
+
+	t.Run("complicated", func(t *testing.T) {
+		// TODO(a.garipov): Properly decouple the DHCP server from the client
+		// storage.
+		if runtime.GOOS == "windows" {
+			t.Skip("skipping dhcp test on windows")
+		}
+
+		ip := netip.MustParseAddr("1.2.3.4")
+
+		// First, init a DHCP server with a single static lease.
+		config := &dhcpd.ServerConfig{
+			Enabled: true,
+			DataDir: t.TempDir(),
+			Conf4: dhcpd.V4ServerConf{
+				Enabled:    true,
+				GatewayIP:  netip.MustParseAddr("1.2.3.1"),
+				SubnetMask: netip.MustParseAddr("255.255.255.0"),
+				RangeStart: netip.MustParseAddr("1.2.3.2"),
+				RangeEnd:   netip.MustParseAddr("1.2.3.10"),
+			},
+		}
+
+		dhcpServer, err := dhcpd.Create(config)
+		require.NoError(t, err)
+
+		clients.dhcp = dhcpServer
+
+		err = dhcpServer.AddStaticLease(&dhcpsvc.Lease{
+			HWAddr:   net.HardwareAddr{0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA},
+			IP:       ip,
+			Hostname: "testhost",
+			Expiry:   time.Now().Add(time.Hour),
+		})
+		require.NoError(t, err)
+
+		// Add a new client with the same IP as for a client with MAC.
+		err = clients.storage.Add(&client.Persistent{
+			Name: "client2",
+			UID:  client.MustNewUID(),
+			IPs:  []netip.Addr{ip},
+		})
+		require.NoError(t, err)
+
+		// Add a new client with the IP from the first client's IP range.
+		err = clients.storage.Add(&client.Persistent{
+			Name: "client3",
+			UID:  client.MustNewUID(),
+			IPs:  []netip.Addr{netip.MustParseAddr("2.2.2.2")},
+		})
+		require.NoError(t, err)
+	})
+}
+
 func TestClientsCustomUpstream(t *testing.T) {
 	clients := newClientsContainer(t)
-	ctx := testutil.ContextWithTimeout(t, testTimeout)

 	// Add client with upstreams.
-	err := clients.storage.Add(ctx, &client.Persistent{
+	err := clients.storage.Add(&client.Persistent{
 		Name: "client1",
 		UID:  client.MustNewUID(),
 		IPs:  []netip.Addr{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("1:2:3::4")},
--- a/internal/home/clientshttp.go
+++ b/internal/home/clientshttp.go
@@ -1,7 +1,6 @@
 package home

 import (
-	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -11,10 +10,8 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/aghhttp"
 	"github.com/AdguardTeam/AdGuardHome/internal/client"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
-	"github.com/AdguardTeam/AdGuardHome/internal/filtering/safesearch"
 	"github.com/AdguardTeam/AdGuardHome/internal/schedule"
 	"github.com/AdguardTeam/AdGuardHome/internal/whois"
-	"github.com/AdguardTeam/golibs/logutil/slogutil"
 )

 // clientJSON is a common structure used by several handlers to deal with
@@ -106,9 +103,7 @@ func (clients *clientsContainer) handleGetClients(w http.ResponseWriter, r *http
 		return true
 	})

-	clients.storage.UpdateDHCP(r.Context())
-
-	clients.storage.RangeRuntime(func(rc *client.Runtime) (cont bool) {
+	clients.runtimeIndex.Range(func(rc *client.Runtime) (cont bool) {
 		src, host := rc.Info()
 		cj := runtimeClientJSON{
 			WHOIS:  whoisOrEmpty(rc),
@@ -122,7 +117,18 @@ func (clients *clientsContainer) handleGetClients(w http.ResponseWriter, r *http
 		return true
 	})

-	data.Tags = clients.storage.AllowedTags()
+	for _, l := range clients.dhcp.Leases() {
+		cj := runtimeClientJSON{
+			Name:   l.Hostname,
+			Source: client.SourceDHCP,
+			IP:     l.IP,
+			WHOIS:  &whois.Info{},
+		}
+
+		data.RuntimeClients = append(data.RuntimeClients, cj)
+	}
+
+	data.Tags = clientTags

 	aghhttp.WriteJSONResponseOK(w, r, data)
 }
@@ -184,7 +190,6 @@ func initPrev(cj clientJSON, prev *client.Persistent) (c *client.Persistent, err
 // jsonToClient converts JSON object to persistent client object if there are no
 // errors.
 func (clients *clientsContainer) jsonToClient(
-	ctx context.Context,
 	cj clientJSON,
 	prev *client.Persistent,
 ) (c *client.Persistent, err error) {
@@ -211,23 +216,14 @@ func (clients *clientsContainer) jsonToClient(
 	c.UseOwnBlockedServices = !cj.UseGlobalBlockedServices

 	if c.SafeSearchConf.Enabled {
-		logger := clients.baseLogger.With(
-			slogutil.KeyPrefix, safesearch.LogPrefix,
-			safesearch.LogKeyClient, c.Name,
+		err = c.SetSafeSearch(
+			c.SafeSearchConf,
+			clients.safeSearchCacheSize,
+			clients.safeSearchCacheTTL,
 		)
-		var ss *safesearch.Default
-		ss, err = safesearch.NewDefault(ctx, &safesearch.DefaultConfig{
-			Logger:         logger,
-			ServicesConfig: c.SafeSearchConf,
-			ClientName:     c.Name,
-			CacheSize:      clients.safeSearchCacheSize,
-			CacheTTL:       clients.safeSearchCacheTTL,
-		})
 		if err != nil {
 			return nil, fmt.Errorf("creating safesearch for client %q: %w", c.Name, err)
 		}
-
-		c.SafeSearch = ss
 	}

 	return c, nil
@@ -334,14 +330,14 @@ func (clients *clientsContainer) handleAddClient(w http.ResponseWriter, r *http.
 		return
 	}

-	c, err := clients.jsonToClient(r.Context(), cj, nil)
+	c, err := clients.jsonToClient(cj, nil)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)

 		return
 	}

-	err = clients.storage.Add(r.Context(), c)
+	err = clients.storage.Add(c)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)

@@ -404,14 +400,14 @@ func (clients *clientsContainer) handleUpdateClient(w http.ResponseWriter, r *ht
 		return
 	}

-	c, err := clients.jsonToClient(r.Context(), dj.Data, nil)
+	c, err := clients.jsonToClient(dj.Data, nil)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)

 		return
 	}

-	err = clients.storage.Update(r.Context(), dj.Name, c)
+	err = clients.storage.Update(dj.Name, c)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)

@@ -434,7 +430,7 @@ func (clients *clientsContainer) handleFindClient(w http.ResponseWriter, r *http
 		}

 		ip, _ := netip.ParseAddr(idStr)
-		c, ok := clients.storage.Find(idStr)
+		c, ok := clients.find(idStr)
 		var cj *clientJSON
 		if !ok {
 			cj = clients.findRuntime(ip, idStr)
@@ -456,7 +452,7 @@ func (clients *clientsContainer) handleFindClient(w http.ResponseWriter, r *http
 // /etc/hosts tables, DHCP leases, or blocklists.  cj is guaranteed to be
 // non-nil.
 func (clients *clientsContainer) findRuntime(ip netip.Addr, idStr string) (cj *clientJSON) {
-	rc := clients.storage.ClientRuntime(ip)
+	rc := clients.findRuntimeClient(ip)
 	if rc == nil {
 		// It is still possible that the IP used to be in the runtime clients
 		// list, but then the server was reloaded.  So, check the DNS server's
--- a/Show More
+++ b/Show More