feat(control-center): allow LAN bind with mandatory fixed console token (serve-lan)

cmd/control-center/main.go

@@ -11,6 +11,7 @@ import (
 	"flag"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -112,10 +113,17 @@ func cmdServe(args []string) error {
 	}
 	defer st.Close()
 
+	loopback := isLoopbackAddr(cfg.HTTPAddr)
 	if cfg.ConsoleToken == "" {
+		if !loopback {
+			return fmt.Errorf("refusing to bind %s without a fixed console token: set CC_CONSOLE_TOKEN", cfg.HTTPAddr)
+		}
 		cfg.ConsoleToken = randomToken()
 		slog.Warn("CC_CONSOLE_TOKEN not set; generated ephemeral console token")
 	}
+	if !loopback {
+		slog.Warn("control-center is reachable from the network; all /api routes require tokens")
+	}
 	srv := server.New(cfg, st)
 
 	var emb *embed.HTTPClient
@@ -245,3 +253,18 @@ func randomToken() string {
 	}
 	return hex.EncodeToString(b)
 }
+
+// isLoopbackAddr reports whether addr ("host:port") binds only to loopback.
+func isLoopbackAddr(addr string) bool {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		host = addr
+	}
+	if host == "" {
+		return false // ":8790" listens on all interfaces
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		return ip.IsLoopback()
+	}
+	return host == "localhost"
+}