From 375c5616b2f34d73293b9daaadfad0c9f920a12a Mon Sep 17 00:00:00 2001
From: Avinal Kumar <avinal.xlvii@gmail.com>
Date: Fri, 22 May 2026 17:37:20 +0530
Subject: [PATCH] Allow cleartext HTTP for self-hosted servers

Memos instances may run on local networks, Tailscale (100.x),
or other private infrastructure without TLS. The app defaults
to HTTPS in the login flow; HTTP requires explicit user input.
Android's domain-config doesn't support IP/CIDR matching, so
cleartext is permitted globally with documentation.

Signed-off-by: Avinal Kumar <avinal.xlvii@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context)
---
 androidApp/src/main/res/xml/network_security_config.xml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/androidApp/src/main/res/xml/network_security_config.xml b/androidApp/src/main/res/xml/network_security_config.xml
index 6115950..0185954 100644
--- a/androidApp/src/main/res/xml/network_security_config.xml
+++ b/androidApp/src/main/res/xml/network_security_config.xml
@@ -1,4 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <network-security-config>
-    <base-config cleartextTrafficPermitted="false" />
+    <!--
+        Cleartext (HTTP) is permitted because users connect to self-hosted
+        Memos instances that may run on local networks, Tailscale (100.x),
+        or other private infrastructure without TLS. The app defaults to
+        HTTPS in the login flow; HTTP requires explicit user input.
+    -->
+    <base-config cleartextTrafficPermitted="true" />
 </network-security-config>