diff --git a/deploy/relay.sh b/deploy/relay.sh
new file mode 100644
index 0000000..e37e8f4
--- /dev/null
+++ b/deploy/relay.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Bring up the relay tunnel. Expects .env alongside this script.
+set -eu
+. "$(dirname "$0")/../.env"
+
+: "${RELAY_ENDPOINT:?RELAY_ENDPOINT not set}"
+: "${RELAY_USER:?RELAY_USER not set}"
+: "${RELAY_TOKEN:?RELAY_TOKEN not set}"
+
+exec /usr/bin/socat \
+  TCP-LISTEN:8443,reuseaddr,fork \
+  OPENSSL:"${RELAY_ENDPOINT#https://}",verify=0