docker: build and run on Debian trixie

Add a multi-stage image that compiles inside Debian trixie and runs on the
same glibc/libssl/libopus, avoiding the Arch-built binary failing on
Debian. The runtime image installs ffmpeg, qalc, the shared libraries, and
the latest yt-dlp zipapp, and runs as uid 1000.

compose.yaml mounts data/ and piper/, overrides TTS_MODEL_PATH for the
container layout, and builds with host networking because the default
Docker bridge DNS cannot resolve crates.io or deb.debian.org on this host.

1 files changed, 41 insertions, 0 deletions

diff --git a/README.md b/README.md
index 41ef0c3..e52c1b9 100644
--- a/README.md
+++ b/README.md
@@ -56,6 +56,47 @@ bot falls back to Google Translate TTS.
 cargo run --release
 ```
 
+## Docker
+
+The image builds and runs on Debian trixie, so it does not depend on the
+host's gcc/glibc version. This is the recommended way to deploy on Debian
+when developing on a rolling-release distro.
+
+```bash
+docker compose up -d --build
+```
+
+Or without Compose:
+
+```bash
+docker build -t senator-sperma .
+docker run -d --name senator-sperma --restart unless-stopped \
+    --env-file .env \
+    -e TTS_MODEL_PATH=/app/piper \
+    -v "$PWD/data:/app/data" \
+    -v "$PWD/piper:/app/piper:ro" \
+    senator-sperma
+```
+
+Notes:
+
+- `data/` holds the SQLite database and is mounted for persistence. Create it
+  first (`mkdir -p data`) so it is owned by your user rather than root.
+- `piper/` holds the Piper model and is mounted read-only; the container
+  overrides `TTS_MODEL_PATH` to `/app/piper`, so the absolute host path in
+  `.env` is harmless. Put the `.onnx` and `.onnx.json` files there (the same
+  directory used for local runs).
+- The container runs as uid 1000. Make sure `data/` is writable by that uid.
+- `TZ` defaults to `Europe/Warsaw` for cron jobs; override it in
+  `compose.yaml` or with `-e TZ=...` if needed.
+- If Copyparty runs on the host, use `http://host.docker.internal:<port>` in
+  `.env` and enable the commented `extra_hosts` entry in `compose.yaml`.
+- If the build fails to resolve `crates.io` or `deb.debian.org`, run
+  `docker build --network=host -t senator-sperma .`; `compose.yaml` already
+  sets `network: host` for builds on this host.
+- yt-dlp is fetched from the latest upstream release at image build time.
+  Rebuild with `--no-cache` (`docker compose build --no-cache`) to refresh it.
+
 ## Commands
 
 Slash commands are autoregistered globally on startup. Some are registered