diff --git a/deploy/setup.sh b/deploy/setup.sh
new file mode 100755
index 0000000..cf39276
--- /dev/null
+++ b/deploy/setup.sh
@@ -0,0 +1,91 @@
+#!/bin/bash
+# Project Tracker - One-shot deploy script
+# Run on a fresh Debian/Ubuntu server as root
+# Usage: curl -sL https://gitea.ledrew.me/ledadmin/project-tracker/raw/branch/master/deploy/setup.sh | bash
+
+set -e
+
+echo "=== Project Tracker Deploy ==="
+echo ""
+
+# Check if running as root
+if [ "$EUID" -ne 0 ]; then
+  echo "Please run as root: sudo $0"
+  exit 1
+fi
+
+# Detect OS
+if command -v apt-get &> /dev/null; then
+  PKG_MANAGER="apt-get"
+elif command -v yum &> /dev/null; then
+  PKG_MANAGER="yum"
+else
+  echo "Unsupported OS. This script requires Debian/Ubuntu or RHEL/CentOS."
+  exit 1
+fi
+
+# Update system
+echo "[1/5] Updating system packages..."
+$PKG_MANAGER update -qq
+$PKG_MANAGER install -y -qq curl git ca-certificates gnupg > /dev/null 2>&1
+
+# Install Docker
+echo "[2/5] Installing Docker..."
+if command -v docker &> /dev/null; then
+  echo "  Docker already installed."
+else
+  if [ "$PKG_MANAGER" = "apt-get" ]; then
+    install -m 0755 -d /etc/apt/keyrings
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+    chmod a+r /etc/apt/keyrings/docker.gpg
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list
+    $PKG_MANAGER update -qq
+    $PKG_MANAGER install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin > /dev/null 2>&1
+  else
+    $PKG_MANAGER install -y -qq docker docker-compose-plugin > /dev/null 2>&1
+  fi
+  systemctl enable docker --now > /dev/null 2>&1
+  echo "  Docker installed."
+fi
+
+# Enable and start Docker
+systemctl enable docker --now > /dev/null 2>&1 || true
+
+# Clone or update repo
+echo "[3/5] Setting up Project Tracker..."
+if [ -d "/root/project-tracker" ]; then
+  echo "  Updating existing repo..."
+  cd /root/project-tracker
+  git pull
+else
+  echo "  Cloning repo..."
+  git clone https://gitea.ledrew.me/ledadmin/project-tracker.git /root/project-tracker
+fi
+
+# Build and start
+echo "[4/5] Building and starting containers..."
+cd /root/project-tracker/deploy
+docker compose down --remove-orphans 2>/dev/null || true
+docker compose up -d --build
+
+# Wait for backend to be ready
+echo "[5/5] Waiting for backend to start..."
+sleep 3
+
+# Verify
+echo ""
+echo "=== Done ==="
+IP=$(hostname -I | awk '{print $1}')
+if curl -sf http://localhost/api/projects > /dev/null 2>&1; then
+  echo "Project Tracker is LIVE at http://$IP"
+else
+  echo "Project Tracker may need a moment. Check: docker compose logs"
+  echo "App should be at http://$IP"
+fi
+
+echo ""
+echo "Useful commands:"
+echo "  docker compose logs -f       # View logs"
+echo "  docker compose restart       # Restart"
+echo "  docker compose down          # Stop"
+echo ""