fix(swift-ios): allow HTTP connections to NetBird and Tailscale IPs

[DominicVonk]

What Changed

Aligned the native Swift iOS app with the Expo app by configuring App Transport Security with only NSAllowsArbitraryLoads = true. This replaces the narrower NSAllowsLocalNetworking and ts.net exception configuration.

Why

T3 Code users can connect to arbitrary self-hosted servers over NetBird or Tailscale, including plain HTTP endpoints at 100.* and 10.* addresses or custom hostnames. The app cannot enumerate those destinations ahead of time. Matching the Expo client ensures the Swift client applies one global ATS policy to all user-configured server URLs; keeping NSAllowsLocalNetworking would cause modern iOS versions to ignore NSAllowsArbitraryLoads.

Checklist

• This PR is small and focused
• I explained what changed and why
• No UI changes

Verified with plutil -lint apps/swift-ios/Resources/Info.plist, git diff --check, and Xcode build settings confirming Resources/Info.plist is the app target plist.

Created with GPT-5.6 in the Codex harness.

---

Note

Medium Risk
Broadens ATS to allow cleartext HTTP for all domains, not just Tailscale/local networking, which has security and App Store review implications even though it matches the Expo client.

Overview
Aligns the Swift iOS App Transport Security policy with the Expo app so users can reach arbitrary self-hosted servers over NetBird/Tailscale, including plain HTTP at 100.*/10.* and custom hostnames.

Replaces NSAllowsLocalNetworking plus the ts.net insecure-HTTP exception with a single NSAllowsArbitraryLoads = true setting in Info.plist. Keeping both flags would cause modern iOS to ignore the broader allow.

^{Reviewed by Cursor Bugbot for commit 00d07f5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Allow HTTP connections to NetBird and Tailscale IPs in iOS app

Updates Info.plist to set NSAllowsArbitraryLoads = true, replacing the previous NSAllowsLocalNetworking flag and the ts.net-specific HTTP exception domain.

Risk: NSAllowsArbitraryLoads bypasses App Transport Security for all domains, not just NetBird and Tailscale IPs, which may affect App Store review.

^{Macroscope summarized 00d07f5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: af23d90f-8d23-4bed-88d2-8aa570319131

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This changes iOS App Transport Security from NSAllowsLocalNetworking to NSAllowsArbitraryLoads, which disables ATS entirely and allows insecure HTTP connections to any domain - a significant security relaxation that warrants human review.

^{You can customize Macroscope's approvability policy. Learn more.}