From a3b861972e8e9e5cd29f4095b729dff01614c899 Mon Sep 17 00:00:00 2001
From: Mark Lopez <m@silvenga.com>
Date: Sat, 18 Jul 2026 16:49:11 -0500
Subject: [PATCH] feat: allow user CA's when validating server's certs under
 android

---
 packages/mobile/android/app/src/main/AndroidManifest.xml | 7 +------
 .../app/src/main/res/xml/network_security_config.xml     | 9 +++++++++
 2 files changed, 10 insertions(+), 6 deletions(-)
 create mode 100644 packages/mobile/android/app/src/main/res/xml/network_security_config.xml

diff --git a/packages/mobile/android/app/src/main/AndroidManifest.xml b/packages/mobile/android/app/src/main/AndroidManifest.xml
index d00b87da..53d0b3b1 100644
--- a/packages/mobile/android/app/src/main/AndroidManifest.xml
+++ b/packages/mobile/android/app/src/main/AndroidManifest.xml
@@ -1,17 +1,12 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <!-- usesCleartextTraffic: OpenChamber connects to user-hosted servers over
-         plain http:// on the local network (LAN transport). Android blocks all
-         cleartext HTTP by default (targetSdk >= 28), which silently failed every
-         LAN probe and forced Android onto relay-only. This mirrors the iOS ATS
-         exceptions (NSAllowsArbitraryLoadsInWebContent + NSAllowsLocalNetworking). -->
     <application
         android:allowBackup="true"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
-        android:usesCleartextTraffic="true"
         android:theme="@style/AppTheme">
         <activity
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode|navigation"
diff --git a/packages/mobile/android/app/src/main/res/xml/network_security_config.xml b/packages/mobile/android/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 00000000..8a76775f
--- /dev/null
+++ b/packages/mobile/android/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>