<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- Default: require HTTPS -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    
    <!-- Allow cleartext for local network (Tailscale) -->
    <domain-config cleartextTrafficPermitted="true">
        <!-- Tailscale CGNAT range -->
        <domain includeSubdomains="true">100.64.0.0</domain>
        <domain includeSubdomains="true">100.127.255.255</domain>
        
        <!-- Local network -->
        <domain includeSubdomains="true">192.168.0.0</domain>
        <domain includeSubdomains="true">192.168.255.255</domain>
        <domain includeSubdomains="true">10.0.0.0</domain>
        <domain includeSubdomains="true">10.255.255.255</domain>
        
        <!-- Localhost -->
        <domain includeSubdomains="false">localhost</domain>
        <domain includeSubdomains="false">127.0.0.1</domain>
    </domain-config>
</network-security-config>
