From f5d4c7037bed71d4f95c5fb4c2eac4481aca6a7b Mon Sep 17 00:00:00 2001
From: Andy Scherzinger <info@andy-scherzinger.de>
Date: Tue, 17 Mar 2026 14:59:22 +0100
Subject: [PATCH] docs: Add reasoning for the allowance of http as well as user
 certs

Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
---
 app/src/main/res/xml/network_security_config.xml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
index 6556a45a2..aee5e89f9 100644
--- a/app/src/main/res/xml/network_security_config.xml
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -2,14 +2,16 @@
 <!--
   ~ Nextcloud Notes - Android Client
   ~
-  ~ SPDX-FileCopyrightText: 2017-2024 Nextcloud GmbH and Nextcloud contributors
-  ~ SPDX-FileCopyrightText: 2017 Andrea Scarpino <me@andreascarpino.it
+  ~ SPDX-FileCopyrightText: 2017-2026 Nextcloud GmbH and Nextcloud contributors
+  ~ SPDX-FileCopyrightText: 2017 Andrea Scarpino <me@andreascarpino.it>
   ~ SPDX-License-Identifier: GPL-3.0-or-later
 -->
 <network-security-config>
+    <!-- Allowing cleartextTrafficPermitted - we don't control the server yet strongly suggesting TLS/SSL -->
     <base-config cleartextTrafficPermitted="true">
         <trust-anchors>
             <certificates src="system" />
+            <!-- We allow user-certificates so managed device can make use of self-signed/client certificates -->
             <certificates src="user" />
         </trust-anchors>
     </base-config>