Add --advertise-addr flag to beacon for MIG public-DNAT deployments

When a beacon runs on a GCP MIG behind a public DNAT (e.g. the
rendezvous reserved IP routing UDP :9001 to internal MIG instances),
auto-detection from the TCP local addr to the registry yields the
INTERNAL VPC address (10.128.0.x). External daemons cannot reach
those, so beacon_list responses silently black-hole all relay traffic
through them — the issue diagnosed in pkg/daemon/beacon_select.go's
filterUnreachable.

The proper fix is on the beacon side: with --advertise-addr set,
the beacon registers the operator-supplied public DNAT entrypoint
instead. All MIG instances share one public ingress; the registry's
beacon_list returns one routable address; external daemons reach
the beacons via the existing DNAT.

beacon-template-v5 (created 2026-05-02) sets
  --advertise-addr 34.71.57.205:9001
in the systemd ExecStart. v4 is preserved for rollback.

Author: teovl

cmd/beacon/main.go

@@ -19,6 +19,7 @@ import (
 func main() {
 	configPath := flag.String("config", "", "path to config file (JSON)")
 	addr := flag.String("addr", ":9001", "listen address (UDP)")
+	advertiseAddr := flag.String("advertise-addr", "", "address to register with the registry (e.g. 34.71.57.205:9001). When unset, the beacon auto-detects its outbound IP from the TCP connection to the registry — which yields the INTERNAL VPC address on GCP MIG deployments and is unreachable from external daemons. MIG-deployed beacons MUST set this to the public rendezvous DNAT entrypoint.")
 	beaconID := flag.Uint("beacon-id", 0, "unique beacon ID (0 = standalone)")
 	peersFlag := flag.String("peers", "", "comma-separated peer beacon addresses for gossip")
 	healthAddr := flag.String("health", "", "health check HTTP address (e.g. :8080)")
@@ -52,6 +53,9 @@ func main() {
 	if *registryAddr != "" {
 		s.SetRegistry(*registryAddr)
 	}
+	if *advertiseAddr != "" {
+		s.SetAdvertiseAddr(*advertiseAddr)
+	}
 
 	if *healthAddr != "" {
 		go func() {

pkg/beacon/server.go

@@ -52,7 +52,8 @@ type Server struct {
 	peerMu    sync.RWMutex
 	healthOk  atomic.Bool
 
-	registryAddr string // registry address for dynamic peer discovery
+	registryAddr  string // registry address for dynamic peer discovery
+	advertiseAddr string // address to register (overrides auto-detect from TCP local addr)
 
 	done chan struct{} // closed on shutdown
 }
@@ -615,6 +616,17 @@ func (s *Server) SetRegistry(addr string) {
 	s.registryAddr = addr
 }
 
+// SetAdvertiseAddr sets the address this beacon registers with the registry.
+// When empty (default), the beacon auto-detects from its TCP local addr to
+// the registry — which on a GCP MIG deployment yields the INTERNAL VPC
+// address (10.128.0.x), unreachable from external daemons. MIG-deployed
+// beacons must set this to the public DNAT entrypoint (e.g. the rendezvous
+// reserved IP on UDP 9001) so external clients receive a routable address
+// from beacon_list.
+func (s *Server) SetAdvertiseAddr(addr string) {
+	s.advertiseAddr = addr
+}
+
 // registryDiscoveryLoop registers this beacon with the registry and discovers
 // peers every 30 seconds. Requires the beacon to be listening (conn bound).
 func (s *Server) registryDiscoveryLoop() {
@@ -680,17 +692,24 @@ func (s *Server) registryDiscover() {
 		return resp, json.Unmarshal(body, &resp)
 	}
 
-	// Register this beacon with our listen address
-	listenAddr := s.conn.LocalAddr().String()
-	// Resolve wildcard to actual IP for peers to reach us
-	host, port, _ := net.SplitHostPort(listenAddr)
-	if host == "::" || host == "0.0.0.0" || host == "" {
-		// Use the outbound IP (the IP used to reach the registry)
-		if tcpAddr, ok := conn.LocalAddr().(*net.TCPAddr); ok {
-			host = tcpAddr.IP.String()
+	// Pick the address to register. Operator-supplied advertiseAddr wins
+	// (MIG deployments need this — see SetAdvertiseAddr). Otherwise
+	// auto-detect from the TCP local addr, which on a single-node deploy
+	// is the right answer but on a VPC-internal beacon yields a private
+	// 10.x address that external daemons cannot reach.
+	var myAddr string
+	if s.advertiseAddr != "" {
+		myAddr = s.advertiseAddr
+	} else {
+		listenAddr := s.conn.LocalAddr().String()
+		host, port, _ := net.SplitHostPort(listenAddr)
+		if host == "::" || host == "0.0.0.0" || host == "" {
+			if tcpAddr, ok := conn.LocalAddr().(*net.TCPAddr); ok {
+				host = tcpAddr.IP.String()
+			}
 		}
+		myAddr = net.JoinHostPort(host, port)
 	}
-	myAddr := net.JoinHostPort(host, port)
 
 	if err := sendMsg(map[string]interface{}{
 		"type":      "beacon_register",