overrides

internal/blocklist/manager.go

@@ -56,8 +56,10 @@ type Manager struct {
 	http  *http.Client
 	stats *StateHolder
 
-	mu      sync.Mutex
-	running map[string]bool // in-flight refreshes, by source name
+	mu         sync.Mutex
+	running    map[string]bool // in-flight refreshes, by source name
+	managedMu  sync.RWMutex
+	managedRPZ string
 
 	// trigger lets the cluster ask one instance to refresh (leader election).
 	trigger chan string
@@ -126,6 +128,13 @@ func (m *Manager) Holder() *Holder { return m.hold }
 // State returns the detailed state the API serves.
 func (m *Manager) State() *State { return m.stats.Get() }
 
+// SetManagedRPZ replaces the shared UI-managed address override source.
+func (m *Manager) SetManagedRPZ(content string) {
+	m.managedMu.Lock()
+	m.managedRPZ = content
+	m.managedMu.Unlock()
+}
+
 // RefreshAll compiles every enabled source plus the local zones. The previous
 // set is kept if every source fails, so a bad deploy never leaves the
 // resolver with no blocklists at all.
@@ -137,6 +146,20 @@ func (m *Manager) RefreshAll(ctx context.Context) (State, error) {
 		sources []Source
 		errs    = map[string]string{}
 	)
+	m.managedMu.RLock()
+	managedRPZ := m.managedRPZ
+	m.managedMu.RUnlock()
+	if strings.TrimSpace(managedRPZ) != "" {
+		rules, st, err := Parse(FormatRPZ, []byte(managedRPZ), ParseOptions{Subdomains: true, DefaultTTL: 60})
+		if err != nil {
+			errs["managed:address-overrides"] = err.Error()
+		} else {
+			for _, r := range rules {
+				b.Add(r, "managed:address-overrides", nil)
+			}
+			b.NoteSource(SourceMeta{Name: "managed:address-overrides", Format: string(FormatRPZ), Rules: len(rules), Bytes: st.Bytes, UpdatedAt: start, Duration: config.Duration(time.Since(start)), Enabled: true})
+		}
+	}
 
 	// Inline block/allow entries first: they are cheap, and putting them
 	// before the lists means a later list cannot override an operator's