diff --git a/app/Console/Commands/CreateAdmin.php b/app/Console/Commands/CreateAdmin.php
new file mode 100644
index 0000000..7ace7d1
--- /dev/null
+++ b/app/Console/Commands/CreateAdmin.php
@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Customer;
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules\Password;
+use Illuminate\Support\Facades\Validator;
+use Spatie\Permission\PermissionRegistrar;
+
+/**
+ * Creates (or promotes) an operator with the Owner role — the account the
+ * installer sets up so a fresh server is usable immediately.
+ *
+ * Promotion is deliberate: running this twice with the same address should fix
+ * a lost role, not fail with "email already taken".
+ */
+class CreateAdmin extends Command
+{
+    protected $signature = 'clupilot:create-admin
+                            {--email= : Login address}
+                            {--name= : Display name}
+                            {--password= : Leave empty to be prompted}';
+
+    protected $description = 'Create or promote an operator account with the Owner role';
+
+    public function handle(): int
+    {
+        $email = $this->option('email') ?: $this->ask('Email');
+        $name = $this->option('name') ?: $this->ask('Name', 'Administrator');
+        $password = $this->option('password') ?: $this->secret('Password');
+
+        $validator = Validator::make(
+            ['email' => $email, 'name' => $name, 'password' => $password],
+            [
+                'email' => 'required|email|max:255',
+                'name' => 'required|string|max:255',
+                'password' => ['required', Password::min(12)],
+            ],
+        );
+
+        if ($validator->fails()) {
+            foreach ($validator->errors()->all() as $error) {
+                $this->error($error);
+            }
+
+            return self::FAILURE;
+        }
+
+        // An operator address that also belongs to a customer would block that
+        // customer from ever getting a portal login.
+        if (Customer::query()->where('email', $email)->exists()) {
+            $this->error('That address already belongs to a customer.');
+
+            return self::FAILURE;
+        }
+
+        $user = User::query()->firstOrNew(['email' => $email]);
+        $existed = $user->exists;
+
+        $user->fill([
+            'name' => $name,
+            'password' => Hash::make($password),
+            'is_admin' => true,
+            'email_verified_at' => $user->email_verified_at ?? now(),
+        ])->save();
+
+        $user->syncRoles(['Owner']);
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+
+        $this->info($existed
+            ? "Existing account {$email} promoted to Owner and password reset."
+            : "Owner account {$email} created.");
+
+        return self::SUCCESS;
+    }
+}
diff --git a/deploy/install.sh b/deploy/install.sh
new file mode 100755
index 0000000..341b02a
--- /dev/null
+++ b/deploy/install.sh
@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+#
+# CluPilot — first-run installer for a fresh Debian/Ubuntu server (netcup VPS).
+#
+# Installs Docker, git and WireGuard, clones the repository, generates every
+# secret the application needs, brings the stack up, runs the migrations,
+# creates the WireGuard hub and your Owner account.
+#
+# Usage (interactive):
+#   curl -fsSL <raw-url>/deploy/install.sh -o install.sh && bash install.sh
+#
+# Usage (unattended — every prompt can be answered by an environment variable):
+#   GIT_TOKEN=… ADMIN_EMAIL=… ADMIN_PASSWORD=… APP_DOMAIN=app.clupilot.com \
+#   ADMIN_DOMAIN=admin.clupilot.com bash install.sh
+#
+# Safe to re-run: it never overwrites an existing .env and never regenerates
+# the WireGuard hub key (that would silently disconnect every host).
+set -euo pipefail
+
+REPO_URL="${REPO_URL:-https://git.bave.dev/boban/CluPilotCloud.git}"
+INSTALL_DIR="${INSTALL_DIR:-/opt/clupilot}"
+BRANCH="${BRANCH:-main}"
+
+log()  { printf '\n\033[1;34m==>\033[0m %s\n' "$*"; }
+warn() { printf '\033[1;33m !\033[0m %s\n' "$*"; }
+die()  { printf '\033[1;31m ✗\033[0m %s\n' "$*" >&2; exit 1; }
+
+ask() { # ask VAR "Prompt" [default]  — skipped when VAR is already set
+    local var="$1" prompt="$2" default="${3:-}" answer
+    if [[ -n "${!var:-}" ]]; then return; fi
+    if [[ ! -t 0 ]]; then die "$var is not set and there is no terminal to ask on."; fi
+    read -r -p "$prompt${default:+ [$default]}: " answer
+    printf -v "$var" '%s' "${answer:-$default}"
+}
+
+ask_secret() {
+    local var="$1" prompt="$2" answer
+    if [[ -n "${!var:-}" ]]; then return; fi
+    if [[ ! -t 0 ]]; then die "$var is not set and there is no terminal to ask on."; fi
+    read -r -s -p "$prompt: " answer; echo
+    printf -v "$var" '%s' "$answer"
+}
+
+rand_b64() { head -c "${1:-32}" /dev/urandom | base64 -w0; }
+rand_hex() { head -c "${1:-24}" /dev/urandom | od -An -tx1 | tr -d ' \n'; }
+
+# ── 0. Preflight ─────────────────────────────────────────────────────────────
+[[ $EUID -eq 0 ]] || die "Please run as root (sudo bash install.sh)."
+[[ -f /etc/os-release ]] || die "Unsupported system: no /etc/os-release."
+. /etc/os-release
+case "${ID}${ID_LIKE:-}" in
+    *debian*|*ubuntu*) ;;
+    *) die "Only Debian and Ubuntu are supported, found: ${PRETTY_NAME}." ;;
+esac
+[[ "$(uname -m)" == "x86_64" ]] || die "Only x86_64 is supported, found $(uname -m)."
+
+log "CluPilot installer on ${PRETTY_NAME}"
+
+# ── 1. Answers we need before doing anything ─────────────────────────────────
+ask APP_DOMAIN   "Public domain for the customer portal" "app.clupilot.com"
+ask WWW_DOMAIN   "Domain for the marketing site" "www.clupilot.com"
+ask ADMIN_DOMAIN "Private domain for the operator console" "admin.clupilot.com"
+ask WS_DOMAIN    "Domain for the websocket server" "ws.clupilot.com"
+ask ADMIN_EMAIL  "Your login address"
+ask ADMIN_NAME   "Your display name" "Administrator"
+ask_secret ADMIN_PASSWORD "Your password (min. 12 characters)"
+[[ ${#ADMIN_PASSWORD} -ge 12 ]] || die "The password must be at least 12 characters."
+
+# The repository is private; a Gitea token with read access is enough.
+if [[ ! -d "$INSTALL_DIR/.git" ]]; then
+    ask_secret GIT_TOKEN "Gitea access token (read access to the repository)"
+fi
+
+# ── 2. Packages ──────────────────────────────────────────────────────────────
+log "Installing packages"
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq ca-certificates curl git gnupg wireguard-tools ufw >/dev/null
+
+if ! command -v docker >/dev/null; then
+    log "Installing Docker"
+    install -m 0755 -d /etc/apt/keyrings
+    curl -fsSL "https://download.docker.com/linux/${ID}/gpg" -o /etc/apt/keyrings/docker.asc
+    chmod a+r /etc/apt/keyrings/docker.asc
+    echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" \
+        > /etc/apt/sources.list.d/docker.list
+    apt-get update -qq
+    apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin >/dev/null
+    systemctl enable --now docker >/dev/null
+fi
+docker compose version >/dev/null || die "docker compose plugin is missing."
+
+# WireGuard needs the module loadable before a container can create wg0.
+modprobe wireguard 2>/dev/null || warn "Could not load the wireguard module — check the kernel."
+echo wireguard > /etc/modules-load.d/wireguard.conf
+
+# ── 3. Source ────────────────────────────────────────────────────────────────
+if [[ -d "$INSTALL_DIR/.git" ]]; then
+    log "Updating existing checkout in $INSTALL_DIR"
+    git -C "$INSTALL_DIR" fetch --quiet origin "$BRANCH"
+    git -C "$INSTALL_DIR" checkout --quiet "$BRANCH"
+    git -C "$INSTALL_DIR" pull --quiet --ff-only origin "$BRANCH"
+else
+    log "Cloning into $INSTALL_DIR"
+    # The token is passed for this one command and never written to disk or to
+    # the git remote — a later `git pull` will ask, or use a deploy key.
+    auth_url="${REPO_URL/https:\/\//https://oauth2:${GIT_TOKEN}@}"
+    git clone --quiet --branch "$BRANCH" "$auth_url" "$INSTALL_DIR"
+    git -C "$INSTALL_DIR" remote set-url origin "$REPO_URL"
+fi
+cd "$INSTALL_DIR"
+
+# ── 4. Configuration ─────────────────────────────────────────────────────────
+if [[ -f .env ]]; then
+    log "Keeping the existing .env (delete it to start over)"
+else
+    log "Writing .env with freshly generated secrets"
+    cp .env.example .env
+
+    set_env() { # set_env KEY VALUE — replaces the line, appends if absent
+        local key="$1" value="$2"
+        if grep -qE "^${key}=" .env; then
+            # `|` as the delimiter: values contain / and + from base64.
+            sed -i "s|^${key}=.*|${key}=${value}|" .env
+        else
+            printf '%s=%s\n' "$key" "$value" >> .env
+        fi
+    }
+
+    set_env APP_ENV production
+    set_env APP_DEBUG false
+    set_env APP_URL "https://${APP_DOMAIN}"
+    set_env APP_KEY "base64:$(rand_b64 32)"
+
+    set_env DB_PASSWORD "$(rand_hex 24)"
+    set_env VPN_CONFIG_KEY "$(rand_b64 32)"
+
+    set_env REVERB_APP_ID "clupilot"
+    set_env REVERB_APP_KEY "$(rand_hex 16)"
+    set_env REVERB_APP_SECRET "$(rand_hex 24)"
+    set_env VITE_REVERB_APP_KEY "$(grep '^REVERB_APP_KEY=' .env | cut -d= -f2-)"
+    set_env VITE_REVERB_HOST "$WS_DOMAIN"
+    set_env VITE_REVERB_PORT 443
+    set_env VITE_REVERB_SCHEME https
+
+    # The console answers only on its own hostname; everything else 404s.
+    set_env ADMIN_HOSTS "${ADMIN_DOMAIN},127.0.0.1,localhost"
+    set_env TRUSTED_RANGES "10.66.0.0/24,127.0.0.1"
+
+    set_env CLUPILOT_WG_ENDPOINT "$(curl -fsS4 https://ifconfig.co 2>/dev/null || echo 'SET-ME'):51820"
+
+    set_env HOST_UID 1000
+    set_env HOST_GID 1000
+    set_env VITE_AUTOSTART false
+
+    chmod 600 .env
+fi
+
+# ── 5. Stack ─────────────────────────────────────────────────────────────────
+log "Building and starting the containers (this takes a few minutes)"
+docker compose build --quiet app
+docker compose up -d
+
+log "Waiting for the application container"
+for _ in $(seq 1 60); do
+    docker compose exec -T app php -v >/dev/null 2>&1 && break
+    sleep 5
+done
+
+log "Running migrations"
+docker compose exec -T app php artisan migrate --force
+
+# ── 6. WireGuard hub ─────────────────────────────────────────────────────────
+if docker compose exec -T queue-provisioning test -f /etc/wireguard/wg0.conf 2>/dev/null; then
+    log "WireGuard hub already configured — leaving it alone"
+else
+    log "Setting up the WireGuard hub"
+    docker compose exec -T queue-provisioning sh -c '
+        set -e; umask 077; mkdir -p /etc/wireguard
+        wg genkey > /etc/wireguard/hub.key
+        cat > /etc/wireguard/wg0.conf <<EOF
+# CluPilot management hub. Peers are managed by the application
+# (wg set + wg-quick save), so this file is rewritten — keep edits minimal.
+[Interface]
+Address = 10.66.0.1/24
+ListenPort = 51820
+PrivateKey = $(cat /etc/wireguard/hub.key)
+EOF
+        chmod 600 /etc/wireguard/wg0.conf /etc/wireguard/hub.key
+        wg-quick up wg0 >/dev/null 2>&1 || true'
+fi
+
+HUB_PUBKEY="$(docker compose exec -T queue-provisioning sh -c 'wg pubkey < /etc/wireguard/hub.key' | tr -d '\r\n')"
+sed -i "s|^CLUPILOT_WG_HUB_PUBKEY=.*|CLUPILOT_WG_HUB_PUBKEY=${HUB_PUBKEY}|" .env
+docker compose exec -T app php artisan config:clear >/dev/null
+
+# ── 7. Your account ──────────────────────────────────────────────────────────
+log "Creating your Owner account"
+docker compose exec -T app php artisan clupilot:create-admin \
+    --email="$ADMIN_EMAIL" --name="$ADMIN_NAME" --password="$ADMIN_PASSWORD"
+
+# ── 8. Firewall ──────────────────────────────────────────────────────────────
+# Only what has to be reachable: SSH, the web ports, and the tunnel. The console
+# is additionally restricted to ADMIN_HOSTS inside the application.
+log "Configuring the firewall"
+ufw --force reset >/dev/null
+ufw default deny incoming >/dev/null
+ufw default allow outgoing >/dev/null
+ufw allow 22/tcp >/dev/null
+ufw allow 80/tcp >/dev/null
+ufw allow 443/tcp >/dev/null
+ufw allow 51820/udp >/dev/null
+ufw --force enable >/dev/null
+
+# ── 9. Done ──────────────────────────────────────────────────────────────────
+PUBLIC_IP="$(curl -fsS4 https://ifconfig.co 2>/dev/null || echo '<server ip>')"
+cat <<SUMMARY
+
+$(printf '\033[1;32m✓ CluPilot is installed.\033[0m')
+
+  Directory        $INSTALL_DIR
+  Console          https://${ADMIN_DOMAIN}/admin   (private — VPN only)
+  Portal           https://${APP_DOMAIN}
+  WireGuard hub    ${PUBLIC_IP}:51820
+  Hub public key   ${HUB_PUBKEY}
+
+Still to do, in this order:
+
+  1. Point the DNS records at ${PUBLIC_IP} and put TLS in front (Zoraxy,
+     Caddy or nginx). ${ADMIN_DOMAIN} must NOT be publicly resolvable.
+  2. Enter STRIPE_WEBHOOK_SECRET in $INSTALL_DIR/.env — Stripe dashboard →
+     Developers → Webhooks → https://${APP_DOMAIN}/webhooks/stripe, events
+     checkout.session.completed and checkout.session.async_payment_succeeded.
+  3. Sign in and switch the website to hidden under Settings until you are
+     ready to be found (Settings → Website visibility).
+
+Updating later:
+
+  cd $INSTALL_DIR && bash deploy/update.sh
+
+SUMMARY
diff --git a/deploy/update.sh b/deploy/update.sh
new file mode 100755
index 0000000..fa30ef4
--- /dev/null
+++ b/deploy/update.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+#
+# CluPilot — pull the latest code and apply it.
+#
+# Order matters: migrations run BEFORE the new containers take traffic, because
+# code that expects a column the database does not have yet answers with 500s.
+# The queue workers are restarted at the end — they are long-running processes
+# and keep the old classes in memory otherwise.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+BRANCH="${BRANCH:-main}"
+
+log() { printf '\n\033[1;34m==>\033[0m %s\n' "$*"; }
+
+log "Fetching $BRANCH"
+git fetch --quiet origin "$BRANCH"
+
+before="$(git rev-parse HEAD)"
+git merge --quiet --ff-only "origin/$BRANCH"
+after="$(git rev-parse HEAD)"
+
+if [[ "$before" == "$after" ]]; then
+    log "Already up to date ($(git rev-parse --short HEAD))"
+    exit 0
+fi
+
+log "Updating $(git rev-parse --short "$before") → $(git rev-parse --short "$after")"
+git --no-pager log --oneline "$before..$after" | sed 's/^/    /'
+
+# Rebuilt only when the image definition actually changed — a rebuild is
+# minutes, a no-op check is seconds.
+if ! git diff --quiet "$before" "$after" -- docker/ composer.json composer.lock package.json package-lock.json; then
+    log "Rebuilding the image"
+    docker compose build --quiet app
+fi
+
+log "Applying migrations"
+docker compose exec -T app php artisan migrate --force
+
+log "Rebuilding assets"
+docker compose exec -T app npm run build
+
+log "Restarting services"
+docker compose up -d
+# Workers hold their PHP classes for the life of the process; without this they
+# keep running the code from before the update.
+docker compose restart queue queue-provisioning scheduler reverb
+
+docker compose exec -T app php artisan config:clear >/dev/null
+docker compose exec -T app php artisan view:clear >/dev/null
+
+log "Done — now on $(git rev-parse --short HEAD)"
diff --git a/docs/deployment.md b/docs/deployment.md
new file mode 100644
index 0000000..4eea1f0
--- /dev/null
+++ b/docs/deployment.md
@@ -0,0 +1,57 @@
+# Deploying CluPilot on a fresh server
+
+Developed locally, deployed by pulling. Two scripts do the work:
+
+```bash
+# once, on a fresh Debian/Ubuntu server as root
+bash deploy/install.sh
+
+# afterwards, to bring it up to date
+cd /opt/clupilot && bash deploy/update.sh
+```
+
+## What the installer does
+
+Docker, git and `wireguard-tools`; clone into `/opt/clupilot`; generate every
+secret (`APP_KEY`, `VPN_CONFIG_KEY`, database password, Reverb keys); start the
+stack; migrate; create the WireGuard hub and print its public key; create your
+Owner account; close the firewall down to 22, 80, 443 and 51820/udp.
+
+It is safe to re-run: an existing `.env` is kept and the hub key is never
+regenerated — doing so would silently disconnect every onboarded host.
+
+Every prompt has an environment variable, so it can also run unattended:
+
+```bash
+GIT_TOKEN=… ADMIN_EMAIL=… ADMIN_PASSWORD=… APP_DOMAIN=app.clupilot.com \
+ADMIN_DOMAIN=admin.clupilot.com bash deploy/install.sh
+```
+
+## Order of the update
+
+Migrations run **before** the new containers take traffic: code that expects a
+column the database does not have yet answers with 500s. The image is rebuilt
+only when `docker/`, composer or npm manifests actually changed. Queue workers
+are restarted at the end — they are long-running PHP processes and keep the old
+classes in memory otherwise. That one bit us during development: a fixed job
+kept failing until the worker was restarted.
+
+## What the installer deliberately leaves to you
+
+- **DNS and TLS.** Put a reverse proxy in front (Zoraxy, Caddy, nginx). The
+  console hostname must not be publicly resolvable: `/admin` answers only on
+  the hostnames in `ADMIN_HOSTS` and 404s everywhere else, but keeping it out
+  of public DNS is the layer above that.
+- **`STRIPE_WEBHOOK_SECRET`.** Stripe dashboard → Developers → Webhooks →
+  `https://<app-domain>/webhooks/stripe`, events `checkout.session.completed`
+  and `checkout.session.async_payment_succeeded`. The secret starts with
+  `whsec_` and differs between test and live mode.
+- **Backups.** At minimum the MariaDB volume and `/etc/wireguard` in the
+  `wireguard` volume — losing the hub key means re-peering every host.
+
+## Hiding the site while you build
+
+Settings → Website visibility. Outsiders then get a placeholder (503,
+`noindex`), while anyone on the management VPN and any signed-in operator keeps
+seeing the real thing. The console stays reachable either way, so the switch can
+always be flipped back.