From f6877b81755ca4a3cf25aaf4ac9f70d1a289f95e Mon Sep 17 00:00:00 2001
From: Benson Wong <83972+mostlygeek@users.noreply.github.com>
Date: Thu, 11 Jun 2026 22:15:14 -0700
Subject: [PATCH] main: show message when listening on network (#836)

fixes: #739
---
 internal/shared/loopback.go | 31 +++++++++++++++++++++++++++++++
 llama-swap.go               |  7 +++++++
 2 files changed, 38 insertions(+)
 create mode 100644 internal/shared/loopback.go

diff --git a/internal/shared/loopback.go b/internal/shared/loopback.go
new file mode 100644
index 00000000..e728bc29
--- /dev/null
+++ b/internal/shared/loopback.go
@@ -0,0 +1,31 @@
+package shared
+
+import "net"
+
+// IsLoopbackAddr reports whether listenAddr binds exclusively to loopback.
+// Addresses with an empty or wildcard host (e.g. ":8080", "0.0.0.0:8080",
+// "[::]:8080") bind on all interfaces and return false.
+func IsLoopbackAddr(listenAddr string) bool {
+	host, _, err := net.SplitHostPort(listenAddr)
+	if err != nil {
+		return false
+	}
+	if host == "" {
+		return false
+	}
+	ip := net.ParseIP(host)
+	if ip != nil {
+		return ip.IsLoopback()
+	}
+	// hostname case (e.g. "localhost")
+	addrs, err := net.LookupHost(host)
+	if err != nil {
+		return false
+	}
+	for _, a := range addrs {
+		if !net.ParseIP(a).IsLoopback() {
+			return false
+		}
+	}
+	return len(addrs) > 0
+}
diff --git a/llama-swap.go b/llama-swap.go
index ed071545..dbdb227f 100644
--- a/llama-swap.go
+++ b/llama-swap.go
@@ -6,6 +6,7 @@ import (
 	"flag"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -53,6 +54,7 @@ var logTimeFormats = map[string]string{
 	"stampnano":   time.StampNano,
 }
 
+
 func main() {
 	flagConfig := flag.String("config", "", "path to config file (required)")
 	flagListen := flag.String("listen", "", "listen address (default :8080 or :8443 for TLS)")
@@ -262,6 +264,11 @@ func main() {
 		}
 	}()
 
+	if !shared.IsLoopbackAddr(listenAddr) {
+		_, port, _ := net.SplitHostPort(listenAddr)
+		proxyLog.Infof("llama-swap is reachable by all hosts on the network, use -listen localhost:%s to restrict to loopback only", port)
+	}
+
 	exitChan := make(chan struct{})
 
 	go func() {