<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- Allow cleartext (HTTP) only to localhost where our Go binary listens -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">127.0.0.1</domain>
        <domain includeSubdomains="false">localhost</domain>
    </domain-config>
    <!-- Block cleartext everywhere else -->
    <base-config cleartextTrafficPermitted="false" />
</network-security-config>
