feat(infra): add cloudflared tunnel service to docker-compose

- Add cloudflare/cloudflared:latest service with restart policy
- Route https://slack.simpleportchecker.com -> http://app:8000
- Token injected via CLOUDFLARE_TUNNEL_TOKEN env var (gitignored .env)
- Add CLOUDFLARE_TUNNEL_TOKEN placeholder to .env.example
- Tunnel health-depends on app service_healthy
- Logging: json-file, 5m max-size, 2 files

.env.example

@@ -12,6 +12,11 @@ TELEGRAM_TOKEN=your_telegram_bot_token_here
 SLACK_BOT_TOKEN=xoxb-your-slack-bot-token-here
 SLACK_SIGNING_SECRET=your_slack_signing_secret_here
 
+# --- Cloudflare Tunnel (optional) --------------------------------------------
+# Required only if using the cloudflared service in docker-compose.
+# Create a tunnel at https://one.dash.cloudflare.com and paste the token here.
+CLOUDFLARE_TUNNEL_TOKEN=your_cloudflare_tunnel_token_here
+
 # --- Database -----------------------------------------------------------------
 # Docker Compose (default):
 DATABASE_URL=postgresql+asyncpg://aiagent:aiagent_password@postgres:5432/aiagent

docker-compose.yml

@@ -106,6 +106,30 @@ services:
     #   - /tmp
     #   - /app/logs
 
+  # ---------------------------------------------------------------------------
+  # Cloudflare Tunnel — exposes the app via a named public hostname
+  # without opening any inbound firewall ports.
+  # Tunnel URL: https://slack.simpleportchecker.com → http://app:8000
+  # CLOUDFLARE_TUNNEL_TOKEN must be set in .env (never commit the real value).
+  # ---------------------------------------------------------------------------
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    container_name: simple-ai-agent-cloudflared
+    restart: unless-stopped
+    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN}
+    depends_on:
+      app:
+        condition: service_healthy
+    networks:
+      - aiagent-network
+    environment:
+      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "5m"
+        max-file: "2"
+
   postgres:
     image: postgres:16-alpine
     container_name: simple-ai-agent-postgres