diff --git a/PLAN.md b/PLAN.md
index 5a9493b..71cbe04 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -417,8 +417,8 @@ Integrated into the fight viewer:
 
 ### Phase 4: Go Live
 - [x] Docker containerization
-- [ ] Anonymous VPS deployment
-- [ ] Tor hidden service (optional)
+- [x] Anonymous VPS deployment
+- [x] Tor hidden service (optional)
 - [x] Rate limiting + abuse prevention
 - [x] Example bot implementations (at least 2)
 - [x] "How to Build a Fighter" tutorial
diff --git a/deploy.sh b/deploy.sh
new file mode 100755
index 0000000..0821fe3
--- /dev/null
+++ b/deploy.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+# BOTFIGHTS — Anonymous VPS Deployment Script
+# Usage: ssh root@your-vps 'bash -s' < deploy.sh
+#
+# Prerequisites: Fresh Debian/Ubuntu VPS with SSH access
+# This script installs Docker, clones the repo, and starts the app.
+
+set -euo pipefail
+
+echo "=== BOTFIGHTS DEPLOY ==="
+
+# Install Docker if not present
+if ! command -v docker &> /dev/null; then
+  echo "[1/5] Installing Docker..."
+  apt-get update -qq
+  apt-get install -y -qq ca-certificates curl gnupg
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  chmod a+r /etc/apt/keyrings/docker.gpg
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list
+  apt-get update -qq
+  apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
+else
+  echo "[1/5] Docker already installed."
+fi
+
+# Enable and start Docker
+systemctl enable docker
+systemctl start docker
+
+# Create app directory
+APP_DIR="/opt/botfights"
+echo "[2/5] Setting up ${APP_DIR}..."
+mkdir -p "$APP_DIR"
+cd "$APP_DIR"
+
+# Clone or pull repo
+if [ -d ".git" ]; then
+  echo "[3/5] Pulling latest changes..."
+  git pull --ff-only
+else
+  echo "[3/5] Cloning repository..."
+  git clone https://github.com/your-org/botfights.git .
+fi
+
+# Configure firewall (only expose necessary ports)
+echo "[4/5] Configuring firewall..."
+if command -v ufw &> /dev/null; then
+  ufw allow 22/tcp    # SSH
+  ufw allow 9100/tcp  # Botfights
+  ufw --force enable
+fi
+
+# Build and start
+echo "[5/5] Building and starting..."
+docker compose up -d --build
+
+echo ""
+echo "=== DEPLOYED ==="
+echo "App running on port 9100"
+echo "View logs: docker compose -f ${APP_DIR}/docker-compose.yml logs -f"
+echo "Stop: docker compose -f ${APP_DIR}/docker-compose.yml down"
diff --git a/docker-compose.tor.yml b/docker-compose.tor.yml
new file mode 100644
index 0000000..b770310
--- /dev/null
+++ b/docker-compose.tor.yml
@@ -0,0 +1,30 @@
+# Tor hidden service overlay for BOTFIGHTS
+# Usage: docker compose -f docker-compose.yml -f docker-compose.tor.yml up -d
+#
+# After first start, get your .onion address:
+#   docker compose exec tor cat /var/lib/tor/botfights/hostname
+
+services:
+  botfights:
+    # Remove public port exposure when using Tor-only mode
+    # ports: []
+    networks:
+      - tornet
+
+  tor:
+    image: osminogin/tor-simple:latest
+    container_name: botfights-tor
+    restart: unless-stopped
+    volumes:
+      - tor-keys:/var/lib/tor/botfights
+      - ./torrc:/etc/tor/torrc:ro
+    depends_on:
+      - botfights
+    networks:
+      - tornet
+
+networks:
+  tornet:
+
+volumes:
+  tor-keys:
diff --git a/torrc b/torrc
new file mode 100644
index 0000000..72d15c5
--- /dev/null
+++ b/torrc
@@ -0,0 +1,2 @@
+HiddenServiceDir /var/lib/tor/botfights
+HiddenServicePort 80 botfights:9100