swarm-authelia: run in its own network namespace

Refs #4815

docs/swarm/services.md

@@ -106,6 +106,12 @@ One authelia per swarm, in a `swarm-authelia` container, at
 provider, differentiated by roles and claims rather than by mechanism —
 there is one IdP and one auth path.
 
+The container sits on the hive bridge in a network namespace of its own and
+dials the store, the collector and its own public name through it. It binds
+no TCP port: the login server, the metrics listener and the bridge each
+listen on a unix socket in `/run/swarm-authelia`, a directory only the
+gateway's nginx and the container's processes can open.
+
 - **`deploy.authelia`** — run the container here.
 - **`swarm.authelia.url`** — where clients go to authenticate. Present
   on **every** hive and the same value on all of them:
@@ -117,7 +123,7 @@ Agent subjects come from swarm-controller's agent-creation job, written
 into the users database by `swarm-authelia-bridge`; human ones come from
 `swarmctl user add` → [setup.md § 2](../getting-started/setup.md#2--your-sso-account).
 
-The bridge listens on loopback on the authelia host, and the gateway
+The bridge listens on a unix socket on the authelia host, and the gateway
 publishes it as
 `https://<swarm.authelia.domain>/bridge/`, which is where
 `deploy.swarm-controller.authBridgeUrl` points by default on every host.

docs/swarm/sso.md

@@ -12,7 +12,7 @@ separate `enable` would be a second fact free to disagree with the first.
 
 ## Getting in the first time
 
-authelia binds loopback only. The **gateway** on the host running it
+authelia binds no TCP port: its listeners are unix sockets only the gateway can reach. The **gateway** on the host running it
 publishes it as `auth.<swarm.domain>` — vhost, dnsmasq record and TLS
 name all follow `deploy.authelia`, so there is nothing to turn on
 separately. (Details, including why a client hive must not declare that