Add Dockerfile for Coolify deployment

Static non-root alpine image; tunneld must own host ports 443/80
directly since visitor TLS is SNI-routed and never proxy-terminated.

Dockerfile

@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1
+# tunneld: the single-node self-hosted OpenTunnel-compatible server.
+# Deploy on Coolify (or any Docker host) with host port mappings
+# 443 -> 8443 and 80 -> 8080 and a volume on /app/data; see README.md.
+
+FROM golang:1.27-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY cmd ./cmd
+COPY internal ./internal
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/tunneld ./cmd/tunneld
+
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates \
+    && adduser -D -u 1000 tunneld \
+    && mkdir -p /app/data && chown tunneld:tunneld /app/data
+COPY --from=build /out/tunneld /usr/local/bin/tunneld
+USER tunneld
+# Tunnels are <id>.<OPENTUNNEL_DOMAIN>; set it per deployment.
+ENV TUNNELD_DATA=/app/data/data.json \
+    LOCAL_CA_FILE=/app/data/ca.pem \
+    TLS_LISTEN=:8443 \
+    HTTP_LISTEN=:8080 \
+    HTTP_MODE=redirect
+EXPOSE 8443 8080
+VOLUME ["/app/data"]
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
+    CMD wget -qO /dev/null http://127.0.0.1:8080/health || exit 1
+ENTRYPOINT ["/usr/local/bin/tunneld"]