diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..5dafe52
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+.git
+.reference
+.local
+Dockerfile
+.dockerignore
diff --git a/AGENTS.md b/AGENTS.md
index 8e87838..cff4f4b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -44,6 +44,12 @@ what we take vs. skip). Never vendor it into the build.
 
 ## Gotchas
 
+- **Deployment**: the multi-stage `Dockerfile` builds a static non-root
+  alpine image; verify `CGO_ENABLED=0 go build -trimpath -ldflags="-s -w"
+  ./cmd/tunneld` after changing build-affecting code (no Docker runtime on
+  the dev machine). Visitors must reach `tunneld` directly on 443/80 — never
+  behind a TLS-terminating proxy (Coolify's Traefik included).
+
 - **macOS system curl (LibreSSL) does not send SNI for `*.localhost` names**,
   so `curl https://api.<id>.localhost:8443/` gets closed (the relay requires
   SNI). Test with `openssl s_client -servername ...` or Homebrew curl.
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..807b461
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1
+# tunneld: the single-node self-hosted OpenTunnel-compatible server.
+# Deploy on Coolify (or any Docker host) with host port mappings
+# 443 -> 8443 and 80 -> 8080 and a volume on /app/data; see README.md.
+
+FROM golang:1.27-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY cmd ./cmd
+COPY internal ./internal
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/tunneld ./cmd/tunneld
+
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates \
+    && adduser -D -u 1000 tunneld \
+    && mkdir -p /app/data && chown tunneld:tunneld /app/data
+COPY --from=build /out/tunneld /usr/local/bin/tunneld
+USER tunneld
+# Tunnels are <id>.<OPENTUNNEL_DOMAIN>; set it per deployment.
+ENV TUNNELD_DATA=/app/data/data.json \
+    LOCAL_CA_FILE=/app/data/ca.pem \
+    TLS_LISTEN=:8443 \
+    HTTP_LISTEN=:8080 \
+    HTTP_MODE=redirect
+EXPOSE 8443 8080
+VOLUME ["/app/data"]
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
+    CMD wget -qO /dev/null http://127.0.0.1:8080/health || exit 1
+ENTRYPOINT ["/usr/local/bin/tunneld"]
diff --git a/README.md b/README.md
index 3fd307c..dc33b11 100644
--- a/README.md
+++ b/README.md
@@ -51,6 +51,29 @@ Every flag also reads an environment variable (`tunneld -h`):
 | `-data` | `TUNNELD_DATA` | `$XDG_DATA_HOME/tunneld/data.json` | tunnel store (0600) |
 | `-ca-file` | `LOCAL_CA_FILE` | `<data dir>/ca.pem` | where the local CA cert is written |
 
+## Deploy on Coolify (or any Docker host)
+
+The repo has a multi-stage `Dockerfile` producing a static, non-root
+`alpine` image.
+
+1. **Create the app** from this repo (Dockerfile build pack).
+2. **Environment**: set `OPENTUNNEL_DOMAIN` to your domain, e.g.
+   `tunnel.example.com`.
+3. **DNS**: point `tunnel.example.com` and `*.tunnel.example.com` (A/AAAA
+   records) at the host.
+4. **Ports**: map host `443` → container `8443` and host `80` → container
+   `8080`. Do **not** put the app behind Coolify's proxy: visitors' TLS is
+   routed by SNI and terminated by the clients, so a proxy that terminates
+   TLS cannot serve it — `tunneld` itself must own ports 443/80.
+5. **Storage**: add a persistent volume on `/app/data` (the CA, server
+   certificate, and tunnel records live there). A named volume works out of
+   the box; a bind mount must be owned by uid 1000.
+
+Until M2 lands, certificates come from the server's built-in local CA:
+clients need `--ca-cert /app/data/ca.pem` (or `OPENTUNNEL_CA_CERT`), and
+visitors must trust that CA. With real ACME issuance (M2) everything is
+publicly trusted.
+
 ## What works (M1)
 
 - The full HTTP API contract (paths, status codes, bodies, key order) as