Add Dockerfile for Coolify deployment

Static non-root alpine image; tunneld must own host ports 443/80
directly since visitor TLS is SNI-routed and never proxy-terminated.

README.md

@@ -51,6 +51,29 @@ Every flag also reads an environment variable (`tunneld -h`):
 | `-data` | `TUNNELD_DATA` | `$XDG_DATA_HOME/tunneld/data.json` | tunnel store (0600) |
 | `-ca-file` | `LOCAL_CA_FILE` | `<data dir>/ca.pem` | where the local CA cert is written |
 
+## Deploy on Coolify (or any Docker host)
+
+The repo has a multi-stage `Dockerfile` producing a static, non-root
+`alpine` image.
+
+1. **Create the app** from this repo (Dockerfile build pack).
+2. **Environment**: set `OPENTUNNEL_DOMAIN` to your domain, e.g.
+   `tunnel.example.com`.
+3. **DNS**: point `tunnel.example.com` and `*.tunnel.example.com` (A/AAAA
+   records) at the host.
+4. **Ports**: map host `443` → container `8443` and host `80` → container
+   `8080`. Do **not** put the app behind Coolify's proxy: visitors' TLS is
+   routed by SNI and terminated by the clients, so a proxy that terminates
+   TLS cannot serve it — `tunneld` itself must own ports 443/80.
+5. **Storage**: add a persistent volume on `/app/data` (the CA, server
+   certificate, and tunnel records live there). A named volume works out of
+   the box; a bind mount must be owned by uid 1000.
+
+Until M2 lands, certificates come from the server's built-in local CA:
+clients need `--ca-cert /app/data/ca.pem` (or `OPENTUNNEL_CA_CERT`), and
+visitors must trust that CA. With real ACME issuance (M2) everything is
+publicly trusted.
+
 ## What works (M1)
 
 - The full HTTP API contract (paths, status codes, bodies, key order) as