diff --git a/.drone.star b/.drone.star
index 72b7b5b..285f1af 100644
--- a/.drone.star
+++ b/.drone.star
@@ -151,7 +151,7 @@ def main(ctx):
           #build("guacamole-postgresql"),
           #build("ngrok-gitea"),
           #build("letsencrypt-nginx"),
-          #build("drone-starlark"),
+          build("drone-starlark"),
           #buildHome(),
           #buildNginx("blog"),
           #buildNginx("drone"),
diff --git a/drone-starlark/repos/deploy.star b/drone-starlark/repos/deploy.star
new file mode 100644
index 0000000..f2a2a64
--- /dev/null
+++ b/drone-starlark/repos/deploy.star
@@ -0,0 +1,34 @@
+load("@this//:from-secret.star", "fromSecret")
+load("@this//:map.star", "map")
+load("@this//:environment.star", "environment")
+load("@this//:export.star", "export")
+load("@this//:public-secrets.star", "publicSecrets")
+load("@this//:secret-secrets.star", "secretSecrets")
+
+def deploy(
+  filename,
+  folder,
+):
+  return {
+    "name": "deploy",
+    "image": "appleboy/drone-ssh",
+    "environment": environment(publicSecrets + secretSecrets),
+    "settings": {
+      "envs": [x.replace("-", "_") for x in publicSecrets + secretSecrets ],
+      "host": fromSecret("ssh-host"),
+      "port": fromSecret("ssh-port"),
+      "username": fromSecret("ssh-root-user"),
+      "password": fromSecret("ssh-root-password"),
+      "script": [
+        "set -e"
+      ] +
+      map(export, publicSecrets + secretSecrets) + 
+      [
+        "docker network prune -f",
+        "cd {folder}".format(folder=folder),
+        "docker stack rm gitea",
+        "sleep 30",
+        "docker stack deploy -c {filename} gitea".format(filename = filename),
+      ]
+    }
+  }
diff --git a/drone-starlark/repos/pull.star b/drone-starlark/repos/pull.star
new file mode 100644
index 0000000..2b74bdb
--- /dev/null
+++ b/drone-starlark/repos/pull.star
@@ -0,0 +1,26 @@
+load("@this//:from-secret.star", "fromSecret")
+load("@this//:map.star", "map")
+load("@this//:environment.star", "environment")
+load("@this//:export.star", "export")
+
+def pull(
+  images,
+):
+  secrets = [ "local-docker-registry"]
+  return {
+    "name": "pull",
+    "image": "appleboy/drone-ssh",
+    "environment": environment(secrets),
+    "settings": {
+      "envs": [x.replace("-", "_") for x in secrets ],
+      "host": fromSecret("ssh-host"),
+      "port": fromSecret("ssh-port"),
+      "username": fromSecret("ssh-root-user"),
+      "password": fromSecret("ssh-root-password"),
+      "script": [
+        "set -e"
+      ] +
+      map(export, secrets) + 
+      ["docker pull $${{LOCAL_DOCKER_REGISTRY}}{image}".format(image=image) for image in images ]
+    }
+  }