From 6877e3255383e13999a42cafd1362f8470b052eb Mon Sep 17 00:00:00 2001
From: sl-ios <sl-ios@saltylab.local>
Date: Fri, 3 Apr 2026 18:02:18 -0400
Subject: [PATCH] fix: add ATS exception for Tailscale WebSocket (error -1022)
 (Issue #709)

NSAllowsLocalNetworking covers CGNAT 100.64.0.0/10 range used by Tailscale,
fixing ATS blocking plain ws:// connections. Also adds NSExceptionDomains
entry for 100.64.0.2 as explicit fallback.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 SulTee/SulTee/Info.plist | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/SulTee/SulTee/Info.plist b/SulTee/SulTee/Info.plist
index 1119bba..40874c4 100644
--- a/SulTee/SulTee/Info.plist
+++ b/SulTee/SulTee/Info.plist
@@ -48,6 +48,22 @@
 		<string>UIInterfaceOrientationLandscapeLeft</string>
 		<string>UIInterfaceOrientationLandscapeRight</string>
 	</array>
+	<key>NSAppTransportSecurity</key>
+	<dict>
+		<!-- Allow plain ws:// to Tailscale (CGNAT 100.64.0.0/10) and other local addresses.
+		     Error -1022 occurs because ATS blocks non-TLS connections by default.
+		     NSAllowsLocalNetworking covers loopback, link-local, and CGNAT ranges. -->
+		<key>NSAllowsLocalNetworking</key>
+		<true/>
+		<key>NSExceptionDomains</key>
+		<dict>
+			<key>100.64.0.2</key>
+			<dict>
+				<key>NSExceptionAllowsInsecureHTTPLoads</key>
+				<true/>
+			</dict>
+		</dict>
+	</dict>
 	<key>UIApplicationSceneManifest</key>
 	<dict>
 		<key>UIApplicationSupportsMultipleScenes</key>