diff --git a/hub/onboard-spoke.sh b/hub/onboard-spoke.sh
new file mode 100644
index 0000000..d77fc6f
--- /dev/null
+++ b/hub/onboard-spoke.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RCLONE_CONF="${HOME}/.config/rclone/rclone.conf"
+SSH_DIR="${HOME}/.ssh"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+info()   { echo -e "${GREEN}[+]${NC} $*"; }
+warn()   { echo -e "${YELLOW}[!]${NC} $*"; }
+die()    { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
+header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN}  $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
+
+header "TinyBoard Hub — Onboard New Spoke"
+
+read -rp "Spoke name (e.g. rocky): " SPOKE_NAME
+[ -n "$SPOKE_NAME" ] || die "Spoke name cannot be empty"
+
+read -rp "Tunnel port for $SPOKE_NAME: " TUNNEL_PORT
+[[ "$TUNNEL_PORT" =~ ^[0-9]+$ ]] || die "Invalid port"
+
+KEY_NAME="armbian-${SPOKE_NAME}-$(date +%Y%m)"
+KEY_PATH="$SSH_DIR/$KEY_NAME"
+
+header "Checking Tunnel"
+info "Verifying spoke is reachable on port $TUNNEL_PORT..."
+ssh -o BatchMode=yes -o ConnectTimeout=10 -p "$TUNNEL_PORT" armbian@localhost exit 2>/dev/null \
+    && info "Spoke is reachable." \
+    || die "Cannot reach spoke on port $TUNNEL_PORT. Make sure the spoke tunnel is up."
+
+header "Generating Hub SSH Key"
+if [ -f "$KEY_PATH" ]; then
+    warn "Key $KEY_PATH already exists, skipping generation."
+else
+    ssh-keygen -t ed25519 -f "$KEY_PATH" -N ""
+    info "Key generated: $KEY_PATH"
+fi
+
+header "Copying Hub Key to Spoke"
+info "Running ssh-copy-id to armbian@localhost:$TUNNEL_PORT..."
+ssh-copy-id -i "$KEY_PATH.pub" -p "$TUNNEL_PORT" armbian@localhost
+info "Key copied."
+
+header "Testing Hub -> Spoke Key Auth"
+if ssh -i "$KEY_PATH" -o BatchMode=yes -o ConnectTimeout=10 -p "$TUNNEL_PORT" armbian@localhost exit 2>/dev/null; then
+    info "Key auth to spoke successful."
+else
+    die "Key auth failed. Check authorized_keys on the spoke."
+fi
+
+header "Adding rclone Remote"
+if grep -q "\[${SPOKE_NAME}-remote\]" "$RCLONE_CONF" 2>/dev/null; then
+    warn "Remote [${SPOKE_NAME}-remote] already exists in $RCLONE_CONF, skipping."
+else
+    cat >> "$RCLONE_CONF" <<EOF
+
+[${SPOKE_NAME}-remote]
+type = sftp
+host = localhost
+port = $TUNNEL_PORT
+key_file = $KEY_PATH
+shell_type = unix
+md5sum_command = md5sum
+sha1sum_command = sha1sum
+EOF
+    info "Remote [${SPOKE_NAME}-remote] added to $RCLONE_CONF."
+fi
+
+header "Testing rclone Connection"
+if rclone lsd "${SPOKE_NAME}-remote:" --config "$RCLONE_CONF" 2>/dev/null; then
+    info "rclone connection to $SPOKE_NAME successful."
+else
+    warn "rclone test failed. Check the remote config in $RCLONE_CONF."
+fi
+
+header "Onboarding Complete"
+echo -e "  Spoke:       ${GREEN}$SPOKE_NAME${NC}"
+echo -e "  Port:        ${GREEN}$TUNNEL_PORT${NC}"
+echo -e "  Hub key:     ${GREEN}$KEY_PATH${NC}"
+echo -e "  rclone:      ${GREEN}${SPOKE_NAME}-remote${NC}"
+echo ""
+echo -e "${YELLOW}To mount this spoke:${NC}"
+echo "  hubspoke-helper.sh hub start"
+echo ""