From 97ec5d52c30592a7af07cef0a2d8f5f282aec549 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 18 Dec 2025 09:12:06 +0100
Subject: [PATCH] fix(android): allow cleartext for tailnet web

---
 apps/android/app/src/main/AndroidManifest.xml          |  1 +
 .../app/src/main/res/xml/network_security_config.xml   | 10 ++++++++++
 2 files changed, 11 insertions(+)
 create mode 100644 apps/android/app/src/main/res/xml/network_security_config.xml

diff --git a/apps/android/app/src/main/AndroidManifest.xml b/apps/android/app/src/main/AndroidManifest.xml
index 7906ca052..0588e4c4e 100644
--- a/apps/android/app/src/main/AndroidManifest.xml
+++ b/apps/android/app/src/main/AndroidManifest.xml
@@ -21,6 +21,7 @@
         android:roundIcon="@mipmap/ic_launcher_round"
         android:label="@string/app_name"
         android:supportsRtl="true"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:theme="@style/Theme.ClawdisNode">
         <service
             android:name=".NodeForegroundService"
diff --git a/apps/android/app/src/main/res/xml/network_security_config.xml b/apps/android/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 000000000..667745f88
--- /dev/null
+++ b/apps/android/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+  <!-- Allow HTTP for tailnet/local dev endpoints (e.g. canvas/background web). -->
+  <domain-config cleartextTrafficPermitted="true">
+    <domain includeSubdomains="true">clawdis.internal</domain>
+  </domain-config>
+  <domain-config cleartextTrafficPermitted="true">
+    <domain includeSubdomains="true">ts.net</domain>
+  </domain-config>
+</network-security-config>