<?xml version="1.0" encoding="utf-8"?>
<!--
    Network security configuration.

    Linthra is a self-hosted music player: people commonly run their own
    Navidrome / Subsonic or Jellyfin server on the local network, reached over
    plain http:// at an address like http://192.168.1.50:4533. Android blocks
    cleartext (http) traffic by default on modern targets, so without this the
    app could not connect to a LAN server at all — only to HTTPS endpoints.

    Android's Network Security Config can only whitelist specific domains, not
    private-IP ranges, and LAN servers use arbitrary private IPs, so cleartext
    is permitted app-wide here. This is a deliberate connectivity choice for a
    self-hosted app; it adds no tracking and sends nothing to any third party.
    HTTPS is always preferred and is recommended for any server reachable from
    outside the local network.

    For HTTPS, Linthra trusts the system CAs plus user-installed CAs (the ones
    added under Settings > Security > Encryption & credentials > User
    credentials). Self-hosted servers often use a private CA or self-signed
    certificate; installing that CA on the device lets Linthra connect without
    weakening TLS — certificate chains and hostnames are still fully verified,
    and a certificate not anchored in either store is still rejected (the app
    surfaces a clear "couldn't verify your server's certificate" message).
-->
<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />
        </trust-anchors>
    </base-config>
</network-security-config>
