diff --git a/deploy/git-push.sh b/deploy/git-push.sh
new file mode 100755
index 0000000..5faa0e0
--- /dev/null
+++ b/deploy/git-push.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+# Push to Gitea through SSH tunnel
+# Usage: ./deploy/git-push.sh
+#
+# Requires:
+#   - sshpass installed (brew install sshpass)
+#   - Environment variables: GITEA_USER, GITEA_PASS, GITEA_SSH_PASS
+#   - Or: ~/.netrc with credentials for 185.191.239.154
+
+set -e
+
+REMOTE_HOST="${GITEA_HOST:-185.191.239.154}"
+REMOTE_USER="${GITEA_SSH_USER:-jeremy}"
+LOCAL_PORT=13000
+REMOTE_PORT=3000
+
+# Check for SSH password
+if [ -z "$GITEA_SSH_PASS" ]; then
+  echo "Set GITEA_SSH_PASS environment variable for SSH tunnel"
+  echo "  export GITEA_SSH_PASS='your-ssh-password'"
+  exit 1
+fi
+
+# Start tunnel
+sshpass -p "$GITEA_SSH_PASS" ssh -o StrictHostKeyChecking=no -f -N -L ${LOCAL_PORT}:localhost:${REMOTE_PORT} ${REMOTE_USER}@${REMOTE_HOST} 2>/dev/null
+
+# Push (uses git credential helper or .netrc)
+git push origin main
+
+# Kill tunnel
+kill $(pgrep -f "ssh.*-L.*${LOCAL_PORT}.*${REMOTE_HOST}") 2>/dev/null
+
+echo "Pushed to Gitea at http://${REMOTE_HOST}:${REMOTE_PORT}/jeremy/webproxy"