From e54628b5608255dc3365578ce129f4f5547ccb7f Mon Sep 17 00:00:00 2001
From: Rob Emery <git@mintsoft.net>
Date: Sun, 13 Oct 2024 16:25:01 +0100
Subject: [PATCH 1/5] Bumping to Android 6/SDK 23 so that client encryption is
 enforced as Android 5 just ignores it

Signed-off-by: Rob Emery <git@mintsoft.net>
---
 tunnel/build.gradle.kts | 2 +-
 ui/build.gradle.kts     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tunnel/build.gradle.kts b/tunnel/build.gradle.kts
index 6e07eb5ca..079e25299 100644
--- a/tunnel/build.gradle.kts
+++ b/tunnel/build.gradle.kts
@@ -18,7 +18,7 @@ android {
     }
     namespace = "${pkg}.tunnel"
     defaultConfig {
-        minSdk = 21
+        minSdk = 23
     }
     externalNativeBuild {
         cmake {
diff --git a/ui/build.gradle.kts b/ui/build.gradle.kts
index f64c9a8e3..12f6f2de4 100644
--- a/ui/build.gradle.kts
+++ b/ui/build.gradle.kts
@@ -21,7 +21,7 @@ android {
     namespace = pkg
     defaultConfig {
         applicationId = pkg
-        minSdk = 21
+        minSdk = 23
         targetSdk = 36
         versionCode = providers.gradleProperty("wireguardVersionCode").get().toInt()
         versionName = providers.gradleProperty("wireguardVersionName").get()

From d95ae0a369d6589aeb552d507780cb13532bf59f Mon Sep 17 00:00:00 2001
From: Rob Emery <git@mintsoft.net>
Date: Mon, 16 Sep 2024 15:50:44 +0100
Subject: [PATCH 2/5] Enabling backup when the ClientSideEncryption is enabled

Signed-off-by: Rob Emery <git@mintsoft.net>
---
 ui/src/main/AndroidManifest.xml | 3 ++-
 ui/src/main/res/xml/backup.xml  | 6 ++++++
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 ui/src/main/res/xml/backup.xml

diff --git a/ui/src/main/AndroidManifest.xml b/ui/src/main/AndroidManifest.xml
index 86c989b3e..d2ed55159 100644
--- a/ui/src/main/AndroidManifest.xml
+++ b/ui/src/main/AndroidManifest.xml
@@ -40,7 +40,8 @@
 
     <application
         android:name=".Application"
-        android:allowBackup="false"
+        android:allowBackup="true"
+        android:fullBackupContent="@xml/backup"
         android:banner="@mipmap/banner"
         android:enableOnBackInvokedCallback="true"
         android:icon="@mipmap/ic_launcher"
diff --git a/ui/src/main/res/xml/backup.xml b/ui/src/main/res/xml/backup.xml
new file mode 100644
index 000000000..fa1dcb1d3
--- /dev/null
+++ b/ui/src/main/res/xml/backup.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." requireFlags="clientSideEncryption" />
+    <include domain="database" path="." requireFlags="clientSideEncryption" />
+    <include domain="file" path="." requireFlags="clientSideEncryption" />
+</full-backup-content>
\ No newline at end of file

From b5d03890f1b32d8575b8513cff3e3a1120b24c20 Mon Sep 17 00:00:00 2001
From: Rob Emery <mintsoft@users.noreply.github.com>
Date: Tue, 23 Sep 2025 12:42:12 +0000
Subject: [PATCH 3/5] This doesn't need to be 23, the tunnel can be 21 without
 affecting the backups

Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: Rob Emery <mintsoft@users.noreply.github.com>
---
 tunnel/build.gradle.kts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tunnel/build.gradle.kts b/tunnel/build.gradle.kts
index 079e25299..6e07eb5ca 100644
--- a/tunnel/build.gradle.kts
+++ b/tunnel/build.gradle.kts
@@ -18,7 +18,7 @@ android {
     }
     namespace = "${pkg}.tunnel"
     defaultConfig {
-        minSdk = 23
+        minSdk = 21
     }
     externalNativeBuild {
         cmake {

From a24b92c173086e0b710ffb067f376925ed2e25c9 Mon Sep 17 00:00:00 2001
From: Rob Emery <git@mintsoft.net>
Date: Tue, 23 Sep 2025 13:44:04 +0100
Subject: [PATCH 4/5] database not required

---
 ui/src/main/res/xml/backup.xml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/ui/src/main/res/xml/backup.xml b/ui/src/main/res/xml/backup.xml
index fa1dcb1d3..8e4a12cd3 100644
--- a/ui/src/main/res/xml/backup.xml
+++ b/ui/src/main/res/xml/backup.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <full-backup-content>
     <include domain="sharedpref" path="." requireFlags="clientSideEncryption" />
-    <include domain="database" path="." requireFlags="clientSideEncryption" />
     <include domain="file" path="." requireFlags="clientSideEncryption" />
-</full-backup-content>
\ No newline at end of file
+</full-backup-content>

From f5b7b689b4a2cc9872a8eec403a55ebb1a25e7b4 Mon Sep 17 00:00:00 2001
From: Rob Emery <git@mintsoft.net>
Date: Tue, 23 Sep 2025 13:58:27 +0100
Subject: [PATCH 5/5] For API>=31 the old XML is deprecated and we should be
 using dataExtractionRules

---
 ui/src/main/AndroidManifest.xml             | 1 +
 ui/src/main/res/xml/dataExtractionRules.xml | 7 +++++++
 2 files changed, 8 insertions(+)
 create mode 100644 ui/src/main/res/xml/dataExtractionRules.xml

diff --git a/ui/src/main/AndroidManifest.xml b/ui/src/main/AndroidManifest.xml
index d2ed55159..f05d84f26 100644
--- a/ui/src/main/AndroidManifest.xml
+++ b/ui/src/main/AndroidManifest.xml
@@ -42,6 +42,7 @@
         android:name=".Application"
         android:allowBackup="true"
         android:fullBackupContent="@xml/backup"
+        android:dataExtractionRules="@xml/dataExtractionRules"
         android:banner="@mipmap/banner"
         android:enableOnBackInvokedCallback="true"
         android:icon="@mipmap/ic_launcher"
diff --git a/ui/src/main/res/xml/dataExtractionRules.xml b/ui/src/main/res/xml/dataExtractionRules.xml
new file mode 100644
index 000000000..acaea64ab
--- /dev/null
+++ b/ui/src/main/res/xml/dataExtractionRules.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+ <cloud-backup disableIfNoEncryptionCapabilities="true">
+   <include domain="file" path="."/>
+   <include domain="sharedpref" path="."/>
+ </cloud-backup>
+</data-extraction-rules>