12 files changed, 750 insertions, 35 deletions

diff --git a/cmd/ship/deploy.go b/cmd/ship/deploy.go
index 24eed1e..9ac754c 100644
--- a/cmd/ship/deploy.go
+++ b/cmd/ship/deploy.go
@@ -415,7 +415,7 @@ func updateAppConfig(st *state.State, opts DeployOptions) error {
                 return fmt.Errorf("app %s not found (use --binary to deploy a new app)", opts.Name)
         }
 
-        if existingApp.Type != "app" {
+        if existingApp.Type != "app" && existingApp.Type != "git-app" {
                 return fmt.Errorf("%s is a static site, not an app", opts.Name)
         }
 
@@ -441,33 +441,37 @@ func updateAppConfig(st *state.State, opts DeployOptions) error {
                 return fmt.Errorf("error creating env file: %w", err)
         }
 
-        // Regenerate systemd unit
-        fmt.Println("-> Updating systemd service...")
-        workDir := fmt.Sprintf("/var/lib/%s", opts.Name)
-        binaryDest := fmt.Sprintf("/usr/local/bin/%s", opts.Name)
-        serviceContent, err := templates.SystemdService(map[string]string{
-                "Name":       opts.Name,
-                "User":       opts.Name,
-                "WorkDir":    workDir,
-                "BinaryPath": binaryDest,
-                "Port":       strconv.Itoa(existingApp.Port),
-                "EnvFile":    envFilePath,
-                "Args":       opts.Args,
-                "Memory":     opts.Memory,
-                "CPU":        opts.CPU,
-        })
-        if err != nil {
-                return fmt.Errorf("error generating systemd unit: %w", err)
-        }
+        // For git-app, the systemd unit comes from .ship/service in the repo,
+        // so we only update the env file and restart.
+        if existingApp.Type != "git-app" {
+                // Regenerate systemd unit
+                fmt.Println("-> Updating systemd service...")
+                workDir := fmt.Sprintf("/var/lib/%s", opts.Name)
+                binaryDest := fmt.Sprintf("/usr/local/bin/%s", opts.Name)
+                serviceContent, err := templates.SystemdService(map[string]string{
+                        "Name":       opts.Name,
+                        "User":       opts.Name,
+                        "WorkDir":    workDir,
+                        "BinaryPath": binaryDest,
+                        "Port":       strconv.Itoa(existingApp.Port),
+                        "EnvFile":    envFilePath,
+                        "Args":       opts.Args,
+                        "Memory":     opts.Memory,
+                        "CPU":        opts.CPU,
+                })
+                if err != nil {
+                        return fmt.Errorf("error generating systemd unit: %w", err)
+                }
 
-        servicePath := fmt.Sprintf("/etc/systemd/system/%s.service", opts.Name)
-        if err := client.WriteSudoFile(servicePath, serviceContent); err != nil {
-                return fmt.Errorf("error creating systemd unit: %w", err)
-        }
+                servicePath := fmt.Sprintf("/etc/systemd/system/%s.service", opts.Name)
+                if err := client.WriteSudoFile(servicePath, serviceContent); err != nil {
+                        return fmt.Errorf("error creating systemd unit: %w", err)
+                }
 
-        fmt.Println("-> Reloading systemd...")
-        if _, err := client.RunSudo("systemctl daemon-reload"); err != nil {
-                return fmt.Errorf("error reloading systemd: %w", err)
+                fmt.Println("-> Reloading systemd...")
+                if _, err := client.RunSudo("systemctl daemon-reload"); err != nil {
+                        return fmt.Errorf("error reloading systemd: %w", err)
+                }
         }
 
         fmt.Println("-> Restarting service...")
diff --git a/cmd/ship/deploy_cmd.go b/cmd/ship/deploy_cmd.go
new file mode 100644
index 0000000..ca5c54d
--- /dev/null
+++ b/cmd/ship/deploy_cmd.go
@@ -0,0 +1,138 @@
+package main
+
+import (
+        "fmt"
+
+        "github.com/bdw/ship/internal/ssh"
+        "github.com/bdw/ship/internal/state"
+        "github.com/spf13/cobra"
+)
+
+var deployGitCmd = &cobra.Command{
+        Use:   "deploy <name>",
+        Short: "Manually rebuild and deploy a git-deployed app",
+        Long: `Trigger a manual rebuild from the latest code in the git repo.
+
+This runs the same steps as the post-receive hook: checkout code,
+install .ship/ configs, docker build (for apps), and restart.
+
+Examples:
+  ship deploy myapp`,
+        Args: cobra.ExactArgs(1),
+        RunE: runDeployGit,
+}
+
+func runDeployGit(cmd *cobra.Command, args []string) error {
+        name := args[0]
+
+        st, err := state.Load()
+        if err != nil {
+                return fmt.Errorf("error loading state: %w", err)
+        }
+
+        host := hostFlag
+        if host == "" {
+                host = st.GetDefaultHost()
+        }
+        if host == "" {
+                return fmt.Errorf("--host is required")
+        }
+
+        app, err := st.GetApp(host, name)
+        if err != nil {
+                return err
+        }
+
+        if app.Type != "git-app" && app.Type != "git-static" {
+                return fmt.Errorf("%s is not a git-deployed app (type: %s)", name, app.Type)
+        }
+
+        fmt.Printf("Deploying %s...\n", name)
+
+        client, err := ssh.Connect(host)
+        if err != nil {
+                return fmt.Errorf("error connecting to VPS: %w", err)
+        }
+        defer client.Close()
+
+        if app.Type == "git-app" {
+                if err := deployGitApp(client, name); err != nil {
+                        return err
+                }
+        } else {
+                if err := deployGitStatic(client, name); err != nil {
+                        return err
+                }
+        }
+
+        fmt.Println("\nDeploy complete!")
+        return nil
+}
+
+func deployGitApp(client *ssh.Client, name string) error {
+        repo := fmt.Sprintf("/srv/git/%s.git", name)
+        src := fmt.Sprintf("/var/lib/%s/src", name)
+
+        fmt.Println("-> Checking out code...")
+        if _, err := client.RunSudo(fmt.Sprintf("git --work-tree=%s --git-dir=%s checkout -f main", src, repo)); err != nil {
+                return fmt.Errorf("error checking out code: %w", err)
+        }
+
+        // Install deployment config from repo
+        serviceSrc := fmt.Sprintf("%s/.ship/service", src)
+        serviceDst := fmt.Sprintf("/etc/systemd/system/%s.service", name)
+        fmt.Println("-> Installing systemd unit...")
+        if _, err := client.RunSudo(fmt.Sprintf("cp %s %s", serviceSrc, serviceDst)); err != nil {
+                fmt.Printf("  Warning: no .ship/service found, skipping\n")
+        } else {
+                if _, err := client.RunSudo("systemctl daemon-reload"); err != nil {
+                        return fmt.Errorf("error reloading systemd: %w", err)
+                }
+        }
+
+        caddySrc := fmt.Sprintf("%s/.ship/Caddyfile", src)
+        caddyDst := fmt.Sprintf("/etc/caddy/sites-enabled/%s.caddy", name)
+        fmt.Println("-> Installing Caddy config...")
+        if _, err := client.RunSudo(fmt.Sprintf("cp %s %s", caddySrc, caddyDst)); err != nil {
+                fmt.Printf("  Warning: no .ship/Caddyfile found, skipping\n")
+        } else {
+                if _, err := client.RunSudo("systemctl reload caddy"); err != nil {
+                        return fmt.Errorf("error reloading Caddy: %w", err)
+                }
+        }
+
+        fmt.Println("-> Building Docker image...")
+        if err := client.RunSudoStream(fmt.Sprintf("docker build -t %s:latest %s", name, src)); err != nil {
+                return fmt.Errorf("error building Docker image: %w", err)
+        }
+
+        fmt.Println("-> Restarting service...")
+        if _, err := client.RunSudo(fmt.Sprintf("systemctl restart %s", name)); err != nil {
+                return fmt.Errorf("error restarting service: %w", err)
+        }
+
+        return nil
+}
+
+func deployGitStatic(client *ssh.Client, name string) error {
+        repo := fmt.Sprintf("/srv/git/%s.git", name)
+        webroot := fmt.Sprintf("/var/www/%s", name)
+
+        fmt.Println("-> Deploying static site...")
+        if _, err := client.RunSudo(fmt.Sprintf("git --work-tree=%s --git-dir=%s checkout -f main", webroot, repo)); err != nil {
+                return fmt.Errorf("error checking out code: %w", err)
+        }
+
+        caddySrc := fmt.Sprintf("%s/.ship/Caddyfile", webroot)
+        caddyDst := fmt.Sprintf("/etc/caddy/sites-enabled/%s.caddy", name)
+        fmt.Println("-> Installing Caddy config...")
+        if _, err := client.RunSudo(fmt.Sprintf("cp %s %s", caddySrc, caddyDst)); err != nil {
+                fmt.Printf("  Warning: no .ship/Caddyfile found, skipping\n")
+        } else {
+                if _, err := client.RunSudo("systemctl reload caddy"); err != nil {
+                        return fmt.Errorf("error reloading Caddy: %w", err)
+                }
+        }
+
+        return nil
+}
diff --git a/cmd/ship/host/init.go b/cmd/ship/host/init.go
index 27f67af..d7143ff 100644
--- a/cmd/ship/host/init.go
+++ b/cmd/ship/host/init.go
@@ -6,6 +6,7 @@ import (
 
         "github.com/bdw/ship/internal/ssh"
         "github.com/bdw/ship/internal/state"
+        "github.com/bdw/ship/internal/templates"
         "github.com/spf13/cobra"
 )
 
@@ -105,6 +106,14 @@ import /etc/caddy/sites-enabled/*
                 hostState.BaseDomain = baseDomain
                 fmt.Printf("  Base domain: %s\n", baseDomain)
         }
+
+        // Git-centric deployment setup (gated on base domain)
+        if baseDomain != "" {
+                if err := setupGitDeploy(client, baseDomain, hostState); err != nil {
+                        return err
+                }
+        }
+
         if st.GetDefaultHost() == "" {
                 st.SetDefaultHost(host)
                 fmt.Printf("  Set %s as default host\n", host)
@@ -119,6 +128,128 @@ import /etc/caddy/sites-enabled/*
         fmt.Printf("     ship --binary ./myapp --domain api.example.com\n")
         fmt.Println("  2. Deploy a static site:")
         fmt.Printf("     ship --static --dir ./dist --domain example.com\n")
+        if baseDomain != "" {
+                fmt.Println("  3. Initialize a git-deployed app:")
+                fmt.Printf("     ship init myapp\n")
+        }
+        return nil
+}
+
+func setupGitDeploy(client *ssh.Client, baseDomain string, hostState *state.Host) error {
+        fmt.Println("-> Installing Docker...")
+        dockerCommands := []string{
+                "apt-get install -y ca-certificates curl gnupg",
+                "install -m 0755 -d /etc/apt/keyrings",
+                "curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc",
+                "chmod a+r /etc/apt/keyrings/docker.asc",
+                `echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo ${VERSION_CODENAME}) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null`,
+                "apt-get update",
+                "apt-get install -y docker-ce docker-ce-cli containerd.io",
+        }
+        for _, cmd := range dockerCommands {
+                if _, err := client.RunSudo(cmd); err != nil {
+                        return fmt.Errorf("error installing Docker: %w", err)
+                }
+        }
+        fmt.Println("  Docker installed")
+
+        fmt.Println("-> Installing git and fcgiwrap...")
+        if _, err := client.RunSudo("apt-get install -y git fcgiwrap"); err != nil {
+                return fmt.Errorf("error installing git/fcgiwrap: %w", err)
+        }
+        fmt.Println("  git and fcgiwrap installed")
+
+        fmt.Println("-> Creating git user...")
+        // Create git user (ignore error if already exists)
+        client.RunSudo("useradd -r -m -d /home/git -s $(which git-shell) git")
+        if _, err := client.RunSudo("usermod -aG docker git"); err != nil {
+                return fmt.Errorf("error adding git user to docker group: %w", err)
+        }
+        fmt.Println("  git user created")
+
+        fmt.Println("-> Copying SSH keys to git user...")
+        copyKeysCommands := []string{
+                "mkdir -p /home/git/.ssh",
+                "cp ~/.ssh/authorized_keys /home/git/.ssh/authorized_keys",
+                "chown -R git:git /home/git/.ssh",
+                "chmod 700 /home/git/.ssh",
+                "chmod 600 /home/git/.ssh/authorized_keys",
+        }
+        for _, cmd := range copyKeysCommands {
+                if _, err := client.RunSudo(cmd); err != nil {
+                        return fmt.Errorf("error copying SSH keys: %w", err)
+                }
+        }
+        fmt.Println("  SSH keys copied")
+
+        fmt.Println("-> Creating /srv/git...")
+        if _, err := client.RunSudo("mkdir -p /srv/git"); err != nil {
+                return fmt.Errorf("error creating /srv/git: %w", err)
+        }
+        if _, err := client.RunSudo("chown git:git /srv/git"); err != nil {
+                return fmt.Errorf("error setting /srv/git ownership: %w", err)
+        }
+        fmt.Println("  /srv/git created")
+
+        fmt.Println("-> Writing sudoers for git user...")
+        sudoersContent := `git ALL=(ALL) NOPASSWD: /bin/systemctl restart *, /bin/systemctl daemon-reload, /bin/systemctl reload caddy, /bin/systemctl enable *, /bin/cp * /etc/systemd/system/*, /bin/cp * /etc/caddy/sites-enabled/*, /bin/mkdir -p /var/lib/*, /bin/mkdir -p /var/www/*, /bin/chown *
+`
+        if err := client.WriteSudoFile("/etc/sudoers.d/ship-git", sudoersContent); err != nil {
+                return fmt.Errorf("error writing sudoers: %w", err)
+        }
+        if _, err := client.RunSudo("chmod 440 /etc/sudoers.d/ship-git"); err != nil {
+                return fmt.Errorf("error setting sudoers permissions: %w", err)
+        }
+        fmt.Println("  sudoers configured")
+
+        fmt.Println("-> Writing vanity import template...")
+        vanityHTML := `<!DOCTYPE html>
+<html><head>
+{{$path := trimPrefix "/" .Req.URL.Path}}
+{{$parts := splitList "/" $path}}
+{{$module := first $parts}}
+<meta name="go-import" content="{{.Host}}/{{$module}} git https://{{.Host}}/{{$module}}.git">
+</head>
+<body>go get {{.Host}}/{{$module}}</body>
+</html>
+`
+        if _, err := client.RunSudo("mkdir -p /opt/ship/vanity"); err != nil {
+                return fmt.Errorf("error creating vanity directory: %w", err)
+        }
+        if err := client.WriteSudoFile("/opt/ship/vanity/index.html", vanityHTML); err != nil {
+                return fmt.Errorf("error writing vanity template: %w", err)
+        }
+        fmt.Println("  vanity template written")
+
+        fmt.Println("-> Writing base domain Caddy config...")
+        codeCaddyContent, err := templates.CodeCaddy(map[string]string{
+                "BaseDomain": baseDomain,
+        })
+        if err != nil {
+                return fmt.Errorf("error generating code caddy config: %w", err)
+        }
+        if err := client.WriteSudoFile("/etc/caddy/sites-enabled/ship-code.caddy", codeCaddyContent); err != nil {
+                return fmt.Errorf("error writing code caddy config: %w", err)
+        }
+        fmt.Println("  base domain Caddy config written")
+
+        fmt.Println("-> Starting Docker and fcgiwrap...")
+        if _, err := client.RunSudo("systemctl enable docker fcgiwrap"); err != nil {
+                return fmt.Errorf("error enabling services: %w", err)
+        }
+        if _, err := client.RunSudo("systemctl start docker fcgiwrap"); err != nil {
+                return fmt.Errorf("error starting services: %w", err)
+        }
+        fmt.Println("  Docker and fcgiwrap started")
+
+        fmt.Println("-> Reloading Caddy...")
+        if _, err := client.RunSudo("systemctl reload caddy"); err != nil {
+                return fmt.Errorf("error reloading Caddy: %w", err)
+        }
+        fmt.Println("  Caddy reloaded")
+
+        hostState.GitSetup = true
+        fmt.Println("  Git deployment setup complete")
         return nil
 }
 
diff --git a/cmd/ship/init.go b/cmd/ship/init.go
new file mode 100644
index 0000000..167347d
--- /dev/null
+++ b/cmd/ship/init.go
@@ -0,0 +1,247 @@
+package main
+
+import (
+        "fmt"
+        "os"
+        "path/filepath"
+        "strconv"
+
+        "github.com/bdw/ship/internal/ssh"
+        "github.com/bdw/ship/internal/state"
+        "github.com/bdw/ship/internal/templates"
+        "github.com/spf13/cobra"
+)
+
+var initCmd = &cobra.Command{
+        Use:   "init <name>",
+        Short: "Initialize a git-deployed project",
+        Long: `Create a bare git repo on the VPS and generate local .ship/ config files.
+
+Pushing to the remote triggers an automatic docker build and deploy (for apps)
+or a static file checkout (for static sites).
+
+Examples:
+  # Initialize an app (Docker-based)
+  ship init myapp
+
+  # Initialize with a custom domain
+  ship init myapp --domain custom.example.com
+
+  # Initialize a static site
+  ship init mysite --static`,
+        Args: cobra.ExactArgs(1),
+        RunE: runInit,
+}
+
+func init() {
+        initCmd.Flags().Bool("static", false, "Initialize as static site")
+        initCmd.Flags().String("domain", "", "Custom domain (default: name.basedomain)")
+}
+
+func runInit(cmd *cobra.Command, args []string) error {
+        name := args[0]
+        static, _ := cmd.Flags().GetBool("static")
+        domain, _ := cmd.Flags().GetString("domain")
+
+        st, err := state.Load()
+        if err != nil {
+                return fmt.Errorf("error loading state: %w", err)
+        }
+
+        host := hostFlag
+        if host == "" {
+                host = st.GetDefaultHost()
+        }
+        if host == "" {
+                return fmt.Errorf("--host is required")
+        }
+
+        hostState := st.GetHost(host)
+        if !hostState.GitSetup {
+                return fmt.Errorf("git deployment not set up on %s (run 'ship host init --base-domain example.com' first)", host)
+        }
+
+        // Check if app already exists
+        if _, err := st.GetApp(host, name); err == nil {
+                return fmt.Errorf("app %s already exists", name)
+        }
+
+        // Resolve domain
+        if domain == "" && hostState.BaseDomain != "" {
+                domain = name + "." + hostState.BaseDomain
+        }
+        if domain == "" {
+                return fmt.Errorf("--domain required (or configure base domain)")
+        }
+
+        appType := "git-app"
+        if static {
+                appType = "git-static"
+        }
+
+        // Allocate port for apps
+        port := 0
+        if !static {
+                port = st.AllocatePort(host)
+        }
+
+        fmt.Printf("Initializing %s: %s\n", appType, name)
+
+        client, err := ssh.Connect(host)
+        if err != nil {
+                return fmt.Errorf("error connecting to VPS: %w", err)
+        }
+        defer client.Close()
+
+        // Create bare repo
+        fmt.Println("-> Creating bare git repo...")
+        repo := fmt.Sprintf("/srv/git/%s.git", name)
+        if _, err := client.RunSudo(fmt.Sprintf("sudo -u git git init --bare %s", repo)); err != nil {
+                return fmt.Errorf("error creating bare repo: %w", err)
+        }
+
+        if static {
+                // Create web root
+                fmt.Println("-> Creating web root...")
+                if _, err := client.RunSudo(fmt.Sprintf("mkdir -p /var/www/%s", name)); err != nil {
+                        return fmt.Errorf("error creating web root: %w", err)
+                }
+                if _, err := client.RunSudo(fmt.Sprintf("chown git:git /var/www/%s", name)); err != nil {
+                        return fmt.Errorf("error setting web root ownership: %w", err)
+                }
+
+                // Write post-receive hook
+                fmt.Println("-> Writing post-receive hook...")
+                hookContent, err := templates.PostReceiveHookStatic(map[string]string{
+                        "Name": name,
+                })
+                if err != nil {
+                        return fmt.Errorf("error generating hook: %w", err)
+                }
+                hookPath := fmt.Sprintf("%s/hooks/post-receive", repo)
+                if err := client.WriteSudoFile(hookPath, hookContent); err != nil {
+                        return fmt.Errorf("error writing hook: %w", err)
+                }
+                if _, err := client.RunSudo(fmt.Sprintf("chmod +x %s", hookPath)); err != nil {
+                        return fmt.Errorf("error making hook executable: %w", err)
+                }
+                if _, err := client.RunSudo(fmt.Sprintf("chown git:git %s", hookPath)); err != nil {
+                        return fmt.Errorf("error setting hook ownership: %w", err)
+                }
+        } else {
+                // Create directories for app
+                fmt.Println("-> Creating app directories...")
+                dirs := []string{
+                        fmt.Sprintf("/var/lib/%s/data", name),
+                        fmt.Sprintf("/var/lib/%s/src", name),
+                }
+                for _, dir := range dirs {
+                        if _, err := client.RunSudo(fmt.Sprintf("mkdir -p %s", dir)); err != nil {
+                                return fmt.Errorf("error creating directory %s: %w", dir, err)
+                        }
+                }
+                if _, err := client.RunSudo(fmt.Sprintf("chown -R git:git /var/lib/%s", name)); err != nil {
+                        return fmt.Errorf("error setting directory ownership: %w", err)
+                }
+
+                // Create env file
+                fmt.Println("-> Creating environment file...")
+                envContent := fmt.Sprintf("PORT=%d\nDATA_DIR=/data\n", port)
+                envPath := fmt.Sprintf("/etc/ship/env/%s.env", name)
+                if err := client.WriteSudoFile(envPath, envContent); err != nil {
+                        return fmt.Errorf("error creating env file: %w", err)
+                }
+
+                // Write post-receive hook
+                fmt.Println("-> Writing post-receive hook...")
+                hookContent, err := templates.PostReceiveHook(map[string]string{
+                        "Name": name,
+                })
+                if err != nil {
+                        return fmt.Errorf("error generating hook: %w", err)
+                }
+                hookPath := fmt.Sprintf("%s/hooks/post-receive", repo)
+                if err := client.WriteSudoFile(hookPath, hookContent); err != nil {
+                        return fmt.Errorf("error writing hook: %w", err)
+                }
+                if _, err := client.RunSudo(fmt.Sprintf("chmod +x %s", hookPath)); err != nil {
+                        return fmt.Errorf("error making hook executable: %w", err)
+                }
+                if _, err := client.RunSudo(fmt.Sprintf("chown git:git %s", hookPath)); err != nil {
+                        return fmt.Errorf("error setting hook ownership: %w", err)
+                }
+        }
+
+        // Save state
+        st.AddApp(host, name, &state.App{
+                Type:   appType,
+                Domain: domain,
+                Port:   port,
+                Repo:   repo,
+        })
+        if err := st.Save(); err != nil {
+                return fmt.Errorf("error saving state: %w", err)
+        }
+
+        // Generate local .ship/ files
+        fmt.Println("-> Generating local .ship/ config...")
+        if err := os.MkdirAll(".ship", 0755); err != nil {
+                return fmt.Errorf("error creating .ship directory: %w", err)
+        }
+
+        if static {
+                caddyContent, err := templates.DefaultStaticCaddy(map[string]string{
+                        "Domain": domain,
+                        "Name":   name,
+                })
+                if err != nil {
+                        return fmt.Errorf("error generating Caddyfile: %w", err)
+                }
+                if err := os.WriteFile(filepath.Join(".ship", "Caddyfile"), []byte(caddyContent), 0644); err != nil {
+                        return fmt.Errorf("error writing Caddyfile: %w", err)
+                }
+        } else {
+                caddyContent, err := templates.DefaultAppCaddy(map[string]string{
+                        "Domain": domain,
+                        "Port":   strconv.Itoa(port),
+                })
+                if err != nil {
+                        return fmt.Errorf("error generating Caddyfile: %w", err)
+                }
+                if err := os.WriteFile(filepath.Join(".ship", "Caddyfile"), []byte(caddyContent), 0644); err != nil {
+                        return fmt.Errorf("error writing Caddyfile: %w", err)
+                }
+
+                serviceContent, err := templates.DockerService(map[string]string{
+                        "Name": name,
+                        "Port": strconv.Itoa(port),
+                })
+                if err != nil {
+                        return fmt.Errorf("error generating service file: %w", err)
+                }
+                if err := os.WriteFile(filepath.Join(".ship", "service"), []byte(serviceContent), 0644); err != nil {
+                        return fmt.Errorf("error writing service file: %w", err)
+                }
+        }
+
+        // Resolve SSH hostname for git remote URL
+        sshHost := host
+
+        fmt.Printf("\nProject initialized: %s\n", name)
+        fmt.Println("\nGenerated:")
+        fmt.Println("  .ship/Caddyfile    — Caddy config (edit to customize routing)")
+        if !static {
+                fmt.Println("  .ship/service      — systemd unit (edit to customize resources, ports)")
+        }
+        fmt.Println("\nNext steps:")
+        if static {
+                fmt.Println("  git add .ship/")
+        } else {
+                fmt.Println("  git add .ship/ Dockerfile")
+        }
+        fmt.Println("  git commit -m \"initial deploy\"")
+        fmt.Printf("  git remote add ship git@%s:%s\n", sshHost, repo)
+        fmt.Println("  git push ship main")
+
+        return nil
+}
diff --git a/cmd/ship/list.go b/cmd/ship/list.go
index 404ca68..a10b2ca 100644
--- a/cmd/ship/list.go
+++ b/cmd/ship/list.go
@@ -40,7 +40,7 @@ func runList(cmd *cobra.Command, args []string) error {
         fmt.Fprintln(w, "NAME\tTYPE\tDOMAIN\tPORT")
         for name, app := range apps {
                 port := ""
-                if app.Type == "app" {
+                if app.Type == "app" || app.Type == "git-app" {
                         port = fmt.Sprintf(":%d", app.Port)
                 }
                 domain := app.Domain
diff --git a/cmd/ship/logs.go b/cmd/ship/logs.go
index 1932c18..4d85fe1 100644
--- a/cmd/ship/logs.go
+++ b/cmd/ship/logs.go
@@ -44,7 +44,7 @@ func runLogs(cmd *cobra.Command, args []string) error {
                 return err
         }
 
-        if app.Type != "app" {
+        if app.Type != "app" && app.Type != "git-app" {
                 return fmt.Errorf("logs are only available for apps, not static sites")
         }
 
diff --git a/cmd/ship/remove.go b/cmd/ship/remove.go
index 922eb8f..8380e87 100644
--- a/cmd/ship/remove.go
+++ b/cmd/ship/remove.go
@@ -46,7 +46,8 @@ func runRemove(cmd *cobra.Command, args []string) error {
         }
         defer client.Close()
 
-        if app.Type == "app" {
+        switch app.Type {
+        case "app":
                 fmt.Println("-> Stopping service...")
                 client.RunSudo(fmt.Sprintf("systemctl stop %s", name))
                 client.RunSudo(fmt.Sprintf("systemctl disable %s", name))
@@ -58,7 +59,29 @@ func runRemove(cmd *cobra.Command, args []string) error {
                 client.RunSudo(fmt.Sprintf("rm -rf /var/lib/%s", name))
                 client.RunSudo(fmt.Sprintf("rm -f /etc/ship/env/%s.env", name))
                 client.RunSudo(fmt.Sprintf("userdel %s", name))
-        } else {
+
+        case "git-app":
+                fmt.Println("-> Stopping service...")
+                client.RunSudo(fmt.Sprintf("systemctl stop %s", name))
+                client.RunSudo(fmt.Sprintf("systemctl disable %s", name))
+
+                client.RunSudo(fmt.Sprintf("rm -f /etc/systemd/system/%s.service", name))
+                client.RunSudo("systemctl daemon-reload")
+
+                fmt.Println("-> Removing Docker image...")
+                client.RunSudo(fmt.Sprintf("docker rmi %s:latest", name))
+
+                fmt.Println("-> Removing files...")
+                client.RunSudo(fmt.Sprintf("rm -rf /var/lib/%s", name))
+                client.RunSudo(fmt.Sprintf("rm -rf /srv/git/%s.git", name))
+                client.RunSudo(fmt.Sprintf("rm -f /etc/ship/env/%s.env", name))
+
+        case "git-static":
+                fmt.Println("-> Removing files...")
+                client.RunSudo(fmt.Sprintf("rm -rf /var/www/%s", name))
+                client.RunSudo(fmt.Sprintf("rm -rf /srv/git/%s.git", name))
+
+        default: // "static"
                 fmt.Println("-> Removing files...")
                 client.RunSudo(fmt.Sprintf("rm -rf /var/www/%s", name))
         }
diff --git a/cmd/ship/restart.go b/cmd/ship/restart.go
index 2c74c62..404624a 100644
--- a/cmd/ship/restart.go
+++ b/cmd/ship/restart.go
@@ -37,7 +37,7 @@ func runRestart(cmd *cobra.Command, args []string) error {
                 return err
         }
 
-        if app.Type != "app" {
+        if app.Type != "app" && app.Type != "git-app" {
                 return fmt.Errorf("restart is only available for apps, not static sites")
         }
 
diff --git a/cmd/ship/root.go b/cmd/ship/root.go
index 837fd4c..93280f5 100644
--- a/cmd/ship/root.go
+++ b/cmd/ship/root.go
@@ -88,6 +88,8 @@ func init() {
         rootCmd.AddCommand(statusCmd)
         rootCmd.AddCommand(restartCmd)
         rootCmd.AddCommand(removeCmd)
+        rootCmd.AddCommand(initCmd)
+        rootCmd.AddCommand(deployGitCmd)
         rootCmd.AddCommand(env.Cmd)
         rootCmd.AddCommand(host.Cmd)
         rootCmd.AddCommand(uiCmd)
diff --git a/cmd/ship/status.go b/cmd/ship/status.go
index 03c548b..536ec8c 100644
--- a/cmd/ship/status.go
+++ b/cmd/ship/status.go
@@ -37,7 +37,7 @@ func runStatus(cmd *cobra.Command, args []string) error {
                 return err
         }
 
-        if app.Type != "app" {
+        if app.Type != "app" && app.Type != "git-app" {
                 return fmt.Errorf("status is only available for apps, not static sites")
         }
 
diff --git a/internal/state/state.go b/internal/state/state.go
index 38657cb..324fd34 100644
--- a/internal/state/state.go
+++ b/internal/state/state.go
@@ -17,15 +17,17 @@ type State struct {
 type Host struct {
         NextPort   int             `json:"next_port"`
         BaseDomain string          `json:"base_domain,omitempty"`
+        GitSetup   bool            `json:"git_setup,omitempty"`
         Apps       map[string]*App `json:"apps"`
 }
 
 // App represents a deployed application or static site
 type App struct {
-        Type   string            `json:"type"`             // "app" or "static"
+        Type   string            `json:"type"`             // "app", "static", "git-app", or "git-static"
         Domain string            `json:"domain"`
-        Port   int               `json:"port,omitempty"`   // only for type="app"
-        Env    map[string]string `json:"env,omitempty"`    // only for type="app"
+        Port   int               `json:"port,omitempty"`   // only for type="app" or "git-app"
+        Repo   string            `json:"repo,omitempty"`   // only for git types, e.g. "/srv/git/foo.git"
+        Env    map[string]string `json:"env,omitempty"`    // only for type="app" or "git-app"
         Args   string            `json:"args,omitempty"`   // only for type="app"
         Files  []string          `json:"files,omitempty"`  // only for type="app"
         Memory string            `json:"memory,omitempty"` // only for type="app"
diff --git a/internal/templates/templates.go b/internal/templates/templates.go
index ce1cbe5..8615117 100644
--- a/internal/templates/templates.go
+++ b/internal/templates/templates.go
@@ -86,3 +86,171 @@ func StaticCaddy(data map[string]string) (string, error) {
 
         return buf.String(), nil
 }
+
+var postReceiveHookTemplate = `#!/bin/bash
+set -euo pipefail
+
+REPO=/srv/git/{{.Name}}.git
+SRC=/var/lib/{{.Name}}/src
+NAME={{.Name}}
+
+while read oldrev newrev refname; do
+    branch=$(git rev-parse --symbolic --abbrev-ref "$refname")
+    [ "$branch" = "main" ] || { echo "Pushed to $branch, skipping deploy."; exit 0; }
+done
+
+echo "==> Checking out code..."
+git --work-tree="$SRC" --git-dir="$REPO" checkout -f main
+
+cd "$SRC"
+
+# Install deployment config from repo
+if [ -f .ship/service ]; then
+    echo "==> Installing systemd unit..."
+    sudo cp .ship/service /etc/systemd/system/${NAME}.service
+    sudo systemctl daemon-reload
+fi
+if [ -f .ship/Caddyfile ]; then
+    echo "==> Installing Caddy config..."
+    sudo cp .ship/Caddyfile /etc/caddy/sites-enabled/${NAME}.caddy
+    sudo systemctl reload caddy
+fi
+
+echo "==> Building Docker image..."
+docker build -t ${NAME}:latest .
+
+echo "==> Restarting service..."
+sudo systemctl restart ${NAME}
+
+echo "==> Deploy complete!"
+`
+
+var postReceiveHookStaticTemplate = `#!/bin/bash
+set -euo pipefail
+
+REPO=/srv/git/{{.Name}}.git
+WEBROOT=/var/www/{{.Name}}
+NAME={{.Name}}
+
+while read oldrev newrev refname; do
+    branch=$(git rev-parse --symbolic --abbrev-ref "$refname")
+    [ "$branch" = "main" ] || { echo "Pushed to $branch, skipping deploy."; exit 0; }
+done
+
+echo "==> Deploying static site..."
+git --work-tree="$WEBROOT" --git-dir="$REPO" checkout -f main
+
+if [ -f "$WEBROOT/.ship/Caddyfile" ]; then
+    echo "==> Installing Caddy config..."
+    sudo cp "$WEBROOT/.ship/Caddyfile" /etc/caddy/sites-enabled/${NAME}.caddy
+    sudo systemctl reload caddy
+fi
+
+echo "==> Deploy complete!"
+`
+
+var codeCaddyTemplate = `{{.BaseDomain}} {
+    @goget query go-get=1
+    handle @goget {
+        root * /opt/ship/vanity
+        templates
+        rewrite * /index.html
+        file_server
+    }
+
+    @git path_regexp "^.*/(HEAD|info/refs|objects/info/[^/]+|git-upload-pack|git-receive-pack)$"
+    handle @git {
+        reverse_proxy unix//run/fcgiwrap.socket {
+            transport fastcgi {
+                env SCRIPT_FILENAME /usr/lib/git-core/git-http-backend
+                env GIT_PROJECT_ROOT /srv/git
+                env GIT_HTTP_EXPORT_ALL 1
+                env REQUEST_METHOD {method}
+                env QUERY_STRING {query}
+                env PATH_INFO {path}
+            }
+        }
+    }
+
+    handle {
+        respond "not found" 404
+    }
+}
+`
+
+var dockerServiceTemplate = `[Unit]
+Description={{.Name}}
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+Type=simple
+ExecStartPre=-/usr/bin/docker rm -f {{.Name}}
+ExecStart=/usr/bin/docker run --rm --name {{.Name}} \
+  -p 127.0.0.1:{{.Port}}:{{.Port}} \
+  --env-file /etc/ship/env/{{.Name}}.env \
+  -v /var/lib/{{.Name}}/data:/data \
+  {{.Name}}:latest
+ExecStop=/usr/bin/docker stop -t 10 {{.Name}}
+Restart=always
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target
+`
+
+var defaultAppCaddyTemplate = `{{.Domain}} {
+    reverse_proxy 127.0.0.1:{{.Port}}
+}
+`
+
+var defaultStaticCaddyTemplate = `{{.Domain}} {
+    root * /var/www/{{.Name}}
+    file_server
+    encode gzip
+}
+`
+
+// PostReceiveHook generates a post-receive hook for git-app repos
+func PostReceiveHook(data map[string]string) (string, error) {
+        return renderTemplate("post-receive", postReceiveHookTemplate, data)
+}
+
+// PostReceiveHookStatic generates a post-receive hook for git-static repos
+func PostReceiveHookStatic(data map[string]string) (string, error) {
+        return renderTemplate("post-receive-static", postReceiveHookStaticTemplate, data)
+}
+
+// CodeCaddy generates the base domain Caddy config for vanity imports + git HTTP
+func CodeCaddy(data map[string]string) (string, error) {
+        return renderTemplate("code-caddy", codeCaddyTemplate, data)
+}
+
+// DockerService generates a systemd unit for a Docker-based app
+func DockerService(data map[string]string) (string, error) {
+        return renderTemplate("docker-service", dockerServiceTemplate, data)
+}
+
+// DefaultAppCaddy generates a default Caddyfile for a git-app
+func DefaultAppCaddy(data map[string]string) (string, error) {
+        return renderTemplate("default-app-caddy", defaultAppCaddyTemplate, data)
+}
+
+// DefaultStaticCaddy generates a default Caddyfile for a git-static site
+func DefaultStaticCaddy(data map[string]string) (string, error) {
+        return renderTemplate("default-static-caddy", defaultStaticCaddyTemplate, data)
+}
+
+func renderTemplate(name, tmplStr string, data map[string]string) (string, error) {
+        tmpl, err := template.New(name).Parse(tmplStr)
+        if err != nil {
+                return "", err
+        }
+
+        var buf bytes.Buffer
+        if err := tmpl.Execute(&buf, data); err != nil {
+                return "", err
+        }
+
+        return buf.String(), nil
+}