fix public ip selfcheck logic

configs/validator-agent.example.yaml

@@ -7,6 +7,17 @@ poll_interval_seconds: 5
 
 self_check:
   timeout_seconds: 10
+  # Must be a resource genuinely outside the cloud project — OpenStack only
+  # applies floating-IP SNAT to traffic leaving via the external network,
+  # so anything reachable over the project's internal network (including
+  # control-api itself, if it's on the same internal network) would report
+  # this validator's private address instead, regardless of whether the
+  # floating IP is correctly attached. Tried in order; falls through to the
+  # next URL only on error/timeout, never on a genuine mismatch. Defaults
+  # to these two public services if omitted.
+  ip_echo_urls:
+    - "https://api.ipify.org"
+    - "https://ifconfig.me/ip"
 
 checks:
   https_timeout_seconds: 10