HTTP only connections

HTTP-only connections configuration

LabNex does not support HTTP-only GitLab instances in its official releases. This is a deliberate decision based on Android’s network security model. Modern Android versions block cleartext (HTTP) traffic by default, and allowing it requires an explicit opt-in at build time. Because LabNex allows users to enter their own GitLab URL at runtime, there is no safe way to selectively enable HTTP without weakening security for all connections.

That said, if you fully understand the risks and are building LabNex for your own personal use, it is technically possible to modify the source code to allow HTTP connections. This is not supported, not recommended, and not provided in official builds. The following instructions are intended for advanced users only.

Option 1: Allow HTTP for All Hosts (Simplest)

This approach enables cleartext HTTP globally. Any HTTP URL will be allowed.

Steps

1- Open AndroidManifest.xml (https://github.com/labnex/LabNex/blob/main/app/src/main/AndroidManifest.xml)
2- Locate the <application> tag
3- Add the following attribute:

<application
    android:usesCleartextTraffic="true"
    ... >

4- Update SignInActivity to accept http connections. (https://github.com/labnex/LabNex/blob/main/app/src/main/java/com/labnex/app/activities/SignInActivity.java)
Change:

instanceUrl = URI.create("https://" + instanceUrlRaw + "/api/v4/");

To:

instanceUrl = URI.create("http://" + instanceUrlRaw + "/api/v4/");

5- Build and install the app manually

This is the simplest approach, but it applies to all network traffic and permanently weakens the app’s transport security.

Option 2: Allow HTTP for a Specific GitLab Host

This approach restricts HTTP to a single, hard-coded domain or IP address. It is safer than global HTTP but less flexible.

Add a network security config for a domain

Add the following to app/src/main/res/xml/network_security_config.xml:

<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">gitlab.internal</domain>
    </domain-config>
...

Replace gitlab.internal with your GitLab hostname or IP address.

Update SignInActivity to accept http connections

https://github.com/labnex/LabNex/blob/main/app/src/main/java/com/labnex/app/activities/SignInActivity.java
Change:

instanceUrl = URI.create("https://" + instanceUrlRaw + "/api/v4/");

To:

instanceUrl = URI.create("http://" + instanceUrlRaw + "/api/v4/");

Rebuild and install the app.

Recommended Alternative

If you run a private or internal GitLab instance, the recommended solution is to enable HTTPS, even with a self-signed certificate. LabNex fully supports self-signed HTTPS connections and this approach preserves Android’s security guarantees without requiring source code changes.