<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!--
        Default config for public source tree:
          - HTTPS only, system CA trust (works with Let's Encrypt / Cloudflare).
          - Cleartext allowed for localhost + emulator host-loopback for local dev.

        FOR FORKS RUNNING A SELF-SIGNED CERT:
          Add a <domain-config> block with your domain, embed your cert as
          @raw/your_vps_cert, and pin the SHA-256 SPKI hash. Example:

          <domain-config cleartextTrafficPermitted="false">
              <domain includeSubdomains="false">your-backend.example.com</domain>
              <trust-anchors>
                  <certificates src="@raw/your_vps_cert"/>
              </trust-anchors>
              <pin-set>
                  <pin digest="SHA-256">YOUR_SPKI_BASE64_HASH</pin>
              </pin-set>
          </domain-config>

        Generate the pin with:
          openssl x509 -in your.crt -pubkey -noout | \
            openssl pkey -pubin -outform der | \
            openssl dgst -sha256 -binary | openssl enc -base64
    -->

    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">localhost</domain>
        <domain includeSubdomains="false">10.0.2.2</domain>
    </domain-config>

    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system"/>
        </trust-anchors>
    </base-config>
</network-security-config>
