For (at least) the googlechat bridge, the appservice's own webserver has to be made available to users so that they can authenticate. The Docker-based config docs don't address this aspect at all.
It's not clear to me how 'conditional' sections in those docs work, or I'd have tried to send a PR already... any guidance on how the conditional presentation bits work would be much appreciated.