Controllers: allow separating public & private services

This patch allows one to specify two networks (one for public and one for internal).
Services are monitored on both, and a vip exists for both.

Close #321