Initial Discord bot in Docker behind a per-container Cloudflare WARP tunnel

- discord.js 14 bot with /ping and /warp, periodic WARP egress-IP logging
- Dockerfile: node:22-bookworm-slim + cloudflare-warp 2026.7.1377.0 (.deb)
- entrypoint boots dbus/warp-svc, registers, connects, verifies warp=on
- docker-compose with NET_ADMIN, /dev/net/tun, sysctls, healthcheck
- deploy script, README, CHANGELOG, lockfile generated inside Docker

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docker/Dockerfile

@@ -0,0 +1,45 @@
+# ---------------------------------------------------------------------------
+# Stage 1: install Node dependencies (npm runs only inside Docker)
+# ---------------------------------------------------------------------------
+FROM node:22-bookworm-slim AS deps
+WORKDIR /app
+COPY bot/package.json bot/package-lock.json ./
+RUN npm ci --omit=dev
+
+# ---------------------------------------------------------------------------
+# Stage 2: runtime image = Node 22 on Debian 12 (bookworm) + Cloudflare WARP
+# ---------------------------------------------------------------------------
+FROM node:22-bookworm-slim
+
+ARG WARP_VERSION=2026.7.1377.0
+ARG WARP_DEB_URL=https://downloads.cloudflareclient.com/v1/download/bookworm-intel/version/${WARP_VERSION}
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    NODE_ENV=production
+
+# dbus + iproute2 are required by warp-svc; curl for health checks.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ca-certificates curl gnupg dbus iproute2 procps \
+ && curl -fsSL "${WARP_DEB_URL}" -o /tmp/cloudflare-warp.deb \
+ && apt-get install -y --no-install-recommends /tmp/cloudflare-warp.deb \
+ && rm -f /tmp/cloudflare-warp.deb \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/* \
+ && warp-cli --version
+
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY bot/package.json ./package.json
+COPY bot/src ./src
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+# WARP registration/state lives here; mount a volume per container to keep it.
+VOLUME ["/var/lib/cloudflare-warp"]
+
+HEALTHCHECK --interval=60s --timeout=15s --start-period=90s --retries=3 \
+  CMD curl -fsS --max-time 10 https://www.cloudflare.com/cdn-cgi/trace | grep -Eq '^warp=(on|plus)$' || exit 1
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["node", "src/index.js"]