diff --git a/.drone/build.sh b/.drone/build.sh
new file mode 100644
index 0000000..c945482
--- /dev/null
+++ b/.drone/build.sh
@@ -0,0 +1 @@
+docker build ghost -t ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/ghost
diff --git a/deploy.sh b/.drone/deploy.sh
similarity index 100%
rename from deploy.sh
rename to .drone/deploy.sh
diff --git a/.drone/drone-home.jsonnet b/.drone/drone-home.jsonnet
new file mode 100644
index 0000000..1756f05
--- /dev/null
+++ b/.drone/drone-home.jsonnet
@@ -0,0 +1,31 @@
+
+local secretSecrets = import 'lib/secret-secrets.libsonnet';
+local publicSecrets = import 'lib/public-secrets.libsonnet';
+
+local deploy = import 'node_modules/@sigyl/jsonnet-drone/deploy.libsonnet';
+local register = import 'node_modules/@sigyl/jsonnet-drone/register.libsonnet';
+[
+  register,
+  deploy(
+    'ghost',
+    '/stack/',
+    [],
+    publicSecrets,
+    secretSecrets,
+    [
+      'DOMAIN',
+      'REGISTRY_DOMAIN',
+      'REGISTRY_PORT',
+      'REGISTRY_PASSWORD',
+    ],
+  ) {
+    trigger +: {
+      event +: [
+        'promote',
+      ],
+      target +: [
+        'production',
+      ],
+    },
+  }
+]
\ No newline at end of file
diff --git a/.drone/drone-home.yml b/.drone/drone-home.yml
new file mode 100644
index 0000000..72c0e81
--- /dev/null
+++ b/.drone/drone-home.yml
@@ -0,0 +1,161 @@
+---
+kind: pipeline
+type: docker
+name: register
+
+platform:
+  os: linux
+  arch: amd64
+
+clone:
+  disable: true
+
+trigger:
+  event:
+    exclude:
+    - promote
+
+---
+kind: pipeline
+type: docker
+name: deploy
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+- name: print env
+  image: appleboy/drone-ssh:1.6.2@sha256:b801dc2cd238c192b6e99acfa7bc3f5b9a03f312bd2feb1e10b3a7a28a1b80ea
+  settings:
+    envs:
+    - drone_tag
+    - drone_commit
+    - drone_build_number
+    - drone_repo_name
+    - drone_repo_namespace
+    - mail_service
+    - mail_user
+    - commento_origin
+    - mysql_root_password
+    host: ${SSH_HOST}
+    key: ${SSH_KEY}
+    passphrase: ${SSH_PASSPHRASE}
+    port: ${SSH_PORT}
+    script:
+    - rm -f env-ghost
+    - "echo \"export MAIL_SERVICE='$${MAIL_SERVICE}'\" >> env-ghost # \"mail-service\""
+    - "echo \"export MAIL_USER='$${MAIL_USER}'\" >> env-ghost # \"mail-user\""
+    - "echo \"export COMMENTO_ORIGIN='$${COMMENTO_ORIGIN}'\" >> env-ghost # \"commento-origin\""
+    - "echo \"export MYSQL_ROOT_PASSWORD='$${MYSQL_ROOT_PASSWORD}'\" >> env-ghost # \"mysql-root-password\""
+    username: ${SSH_USER}
+  environment:
+    COMMENTO_ORIGIN:
+      from_secret: commento-origin
+    MAIL_SERVICE:
+      from_secret: mail-service
+    MAIL_USER:
+      from_secret: mail-user
+    MYSQL_ROOT_PASSWORD:
+      from_secret: mysql-root-password
+
+- name: scp
+  image: appleboy/drone-scp:1.6.2@sha256:bd37a55f4b97e7742b0de7333669b96220b3cc422d366e1fa8c34059b736ab47
+  settings:
+    command_timeout: 2m
+    host: ${SSH_HOST}
+    key: ${SSH_KEY}
+    passphrase: ${SSH_PASSPHRASE}
+    port: ${SSH_PORT}
+    source:
+    - .
+    target: /stack/ghost
+    username: ${SSH_USER}
+
+- name: wait
+  image: alpine:3.12.0@sha256:90baa0922fe90624b05cb5766fa5da4e337921656c2f8e2b13bd3c052a0baac1
+  commands:
+  - sleep 15
+
+- name: "dockerbuild:"
+  image: docker:19.03.12-dind@sha256:8dded163e463f4a59bf305b3dca98e312b2cfb89a43da3872e48f95a7554c48f
+  commands:
+  - set -e
+  - sh .drone/login.sh
+  - sh .drone/build.sh
+  - sh .drone/push.sh
+  - sh .drone/logout.sh
+  volumes:
+  - name: dockersock
+    path: /var/run
+
+- name: deploy
+  image: appleboy/drone-ssh:1.6.2@sha256:b801dc2cd238c192b6e99acfa7bc3f5b9a03f312bd2feb1e10b3a7a28a1b80ea
+  settings:
+    envs:
+    - drone_tag
+    - drone_commit
+    - drone_build_number
+    - drone_repo_name
+    - drone_repo_namespace
+    - domain
+    - registry_domain
+    - registry_port
+    - registry_password
+    - mail_service
+    - mail_user
+    - commento_origin
+    - mysql_root_password
+    host: ${SSH_HOST}
+    key: ${SSH_KEY}
+    passphrase: ${SSH_PASSPHRASE}
+    port: ${SSH_PORT}
+    script:
+    - export MYSQL_ROOT_PASSWORD=$${MYSQL_ROOT_PASSWORD}
+    - export MAIL_SERVICE=$${MAIL_SERVICE}
+    - export MAIL_USER=$${MAIL_USER}
+    - export COMMENTO_ORIGIN=$${COMMENTO_ORIGIN}
+    - export DOMAIN=$${DOMAIN}
+    - export REGISTRY_DOMAIN=$${REGISTRY_DOMAIN}
+    - export REGISTRY_PORT=$${REGISTRY_PORT}
+    - export REGISTRY_PASSWORD=$${REGISTRY_PASSWORD}
+    - set -e
+    - cd /stack/ghost
+    - sh .drone/login.sh
+    - sh .drone/pull.sh
+    - sh .drone/deploy.sh
+    username: ${SSH_USER}
+  environment:
+    COMMENTO_ORIGIN:
+      from_secret: commento-origin
+    MAIL_SERVICE:
+      from_secret: mail-service
+    MAIL_USER:
+      from_secret: mail-user
+    MYSQL_ROOT_PASSWORD:
+      from_secret: mysql-root-password
+
+services:
+- name: docker
+  image: docker:19.03.12-dind@sha256:8dded163e463f4a59bf305b3dca98e312b2cfb89a43da3872e48f95a7554c48f
+  privileged: true
+  volumes:
+  - name: dockersock
+    path: /var/run
+  - name: ca
+    path: /etc/docker/certs.d
+
+volumes:
+- name: dockersock
+  temp: {}
+- name: ca
+  host:
+    path: /etc/docker/certs.d
+
+trigger:
+  event:
+  - promote
+  target:
+  - production
+
+...
diff --git a/.drone/lib/public-secrets.libsonnet b/.drone/lib/public-secrets.libsonnet
new file mode 100644
index 0000000..7c25816
--- /dev/null
+++ b/.drone/lib/public-secrets.libsonnet
@@ -0,0 +1,5 @@
+[
+  'mail-service',
+  'mail-user',
+  'commento-origin',
+]
diff --git a/.drone/lib/secret-secrets.libsonnet b/.drone/lib/secret-secrets.libsonnet
new file mode 100644
index 0000000..16cbf37
--- /dev/null
+++ b/.drone/lib/secret-secrets.libsonnet
@@ -0,0 +1,3 @@
+[
+  'mysql-root-password',
+]
diff --git a/.drone/login.sh b/.drone/login.sh
new file mode 100644
index 0000000..982ed2d
--- /dev/null
+++ b/.drone/login.sh
@@ -0,0 +1 @@
+docker login ${REGISTRY_DOMAIN}:${REGISTRY_PORT} --username client --password "${REGISTRY_PASSWORD}"
\ No newline at end of file
diff --git a/.drone/logout.sh b/.drone/logout.sh
new file mode 100644
index 0000000..2337c7c
--- /dev/null
+++ b/.drone/logout.sh
@@ -0,0 +1 @@
+docker logout ${REGISTRY_DOMAIN}:${REGISTRY_PORT}
\ No newline at end of file
diff --git a/.drone/package.json b/.drone/package.json
new file mode 100644
index 0000000..a484d06
--- /dev/null
+++ b/.drone/package.json
@@ -0,0 +1,6 @@
+{
+  "private": true,
+  "dependencies": {
+    "@sigyl/jsonnet-drone": "^0.1.0"
+  }
+}
diff --git a/.drone/pull.sh b/.drone/pull.sh
new file mode 100644
index 0000000..42d9cf5
--- /dev/null
+++ b/.drone/pull.sh
@@ -0,0 +1 @@
+docker pull ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/ghost
diff --git a/.drone/push.sh b/.drone/push.sh
new file mode 100644
index 0000000..45d0466
--- /dev/null
+++ b/.drone/push.sh
@@ -0,0 +1 @@
+docker push ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/ghost
diff --git a/.drone/yarn-error.log b/.drone/yarn-error.log
new file mode 100644
index 0000000..55c6505
--- /dev/null
+++ b/.drone/yarn-error.log
@@ -0,0 +1,37 @@
+Arguments: 
+  /usr/bin/node /home/giles/.yarn/bin/yarn.js
+
+PATH: 
+  /home/giles/.yarn/bin:/home/giles/.config/yarn/global/node_modules/.bin:/home/giles/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin
+
+Yarn version: 
+  1.22.4
+
+Node version: 
+  11.14.0
+
+Platform: 
+  linux x64
+
+Trace: 
+  Error: self signed certificate in certificate chain
+      at TLSSocket.onConnectSecure (_tls_wrap.js:1176:34)
+      at TLSSocket.emit (events.js:193:13)
+      at TLSSocket._finishInit (_tls_wrap.js:667:8)
+
+npm manifest: 
+  {
+    "private": true,
+    "scripts": {
+      "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
+    },
+    "dependencies": {
+      "@sigyl/jsonnet-compose": "^0.0.2"
+    }
+  }
+
+yarn manifest: 
+  No manifest
+
+Lockfile: 
+  No lockfile
diff --git a/.drone/yarn.lock b/.drone/yarn.lock
new file mode 100644
index 0000000..44ab354
--- /dev/null
+++ b/.drone/yarn.lock
@@ -0,0 +1,21 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"@sigyl/jsonnet-compose@^0.0.2":
+  version "0.0.2"
+  resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-compose/-/jsonnet-compose-0.0.2.tgz#8900a21e8cd8109929b6042703f8645aacb9bcda"
+  integrity sha512-wWS3CgPeNi/o1pcS6n/4pafxlMD0KC9/RKMZr/ySmzeGNRW++sPuKuxajYse2TNd47uNDdeUSnk4aEeEIKL0zA==
+
+"@sigyl/jsonnet-drone-environment@0.0.5":
+  version "0.0.5"
+  resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
+  integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==
+
+"@sigyl/jsonnet-drone@^0.1.0":
+  version "0.1.0"
+  resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone/-/jsonnet-drone-0.1.0.tgz#feda1797e8e9ef799cad72e65f7163ca26a9e3a5"
+  integrity sha512-QY/ngucxFOtLfL8Mt0f2bxN4fQDUOGOFtaRpSH2cNyg84xADkzehT0ORZtbLitr+AwhyF5KN/zAGvzkyNAoqPw==
+  dependencies:
+    "@sigyl/jsonnet-compose" "^0.0.2"
+    "@sigyl/jsonnet-drone-environment" "0.0.5"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 981c060..714ee78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,4 +2,8 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.3](https://sigyl.com///compare/v0.0.2...v0.0.3) "chore(release): 0.0.3" (2020-08-19)
+
+### [0.0.2](https://sigyl.com///compare/v0.0.1...v0.0.2) "chore(release): 0.0.2" (2020-08-19)
+
 ### 0.0.1 "chore(release): 0.0.1" (2020-08-12)
diff --git a/README.md b/README.md
index 48dba73..7be83b2 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,10 @@
 # ghost
 
 ## secrets
-* commento-origin
-* ghost-mail-password
-* ghost-mail-service
-* ghost-mail-user
-* ghost-mysql-root-password
-* git-domain
-* local-docker-registry
-* registry-password
 
+* commento-origin
+* mail-password
+* mail-service
+* mail-user
+* mysql-root-password
+* 
\ No newline at end of file
diff --git a/build.sh b/build.sh
deleted file mode 100644
index 923402e..0000000
--- a/build.sh
+++ /dev/null
@@ -1 +0,0 @@
-docker build ghost -t ${LOCAL_DOCKER_REGISTRY}ghost
diff --git a/docker-compose.yml b/docker-compose.yml
index fe89ed5..8460ee3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,7 @@ services:
       replicas: 1
       restart_policy:
         condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}ghost
+    image: ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/ghost
     volumes:
       - ghost-content-images:/var/lib/ghost/content/images
       - ghost-content-settings:/var/lib/ghost/content/settings
@@ -16,15 +16,15 @@ services:
       - ghost-content-data:/var/lib/ghost/content/data
       - ghost-content-logs:/var/lib/ghost/content/logs
     environment:
-      - GIT_DOMAIN=$GIT_DOMAIN
-      - GHOST-MAIL-SERVICE=$GHOST-MAIL-SERVICE
-      - GHOST-MAIL-USER=$GHOST-MAIL-USER
-      - GHOST-MAIL-PASSWORD=$GHOST-MAIL-PASSWORD
+      - DOMAIN=$DOMAIN
+      - MAIL-SERVICE=$MAIL-SERVICE
+      - MAIL-USER=$MAIL-USER
+      - MAIL-PASSWORD=$MAIL-PASSWORD
       - COMMENTO_ORIGIN=$COMMENTO_ORIGIN
       - database__client=mysql
       - database__connection__host=ghost-mysql
       - database__connection__user=root
-      - database__connection__password=$GHOST_MYSQL_ROOT_PASSWORD
+      - database__connection__password=$MYSQL_ROOT_PASSWORD
       - database__connection__database=ghost
       - database__pool__min=0 # https://github.com/knex/knex/issues/975
     networks:
@@ -41,7 +41,7 @@ services:
     volumes:
       - ghost-data:/var/lib/mysql
     environment:
-      MYSQL_ROOT_PASSWORD: $GHOST_MYSQL_ROOT_PASSWORD
+      MYSQL_ROOT_PASSWORD: $MYSQL_ROOT_PASSWORD
     networks:
       - appnet
 volumes:
diff --git a/ghost/config.production.json b/ghost/config.production.json
index 24798ce..8827144 100644
--- a/ghost/config.production.json
+++ b/ghost/config.production.json
@@ -1,5 +1,5 @@
 {
-  "url": "https://${GIT_DOMAIN}/",
+  "url": "https://${DOMAIN}/",
   "server": {
     "port": 2368,
     "host": "0.0.0.0"
@@ -13,10 +13,10 @@
   "mail": {
     "transport": "SMTP",
     "options": {
-      "service": "${GHOST_MAIL_SERVICE}",
+      "service": "${MAIL_SERVICE}",
       "auth": {
-        "user": "${GHOST_MAIL_USER}",
-        "pass": "${GHOST_MAIL_PASSWORD}"
+        "user": "${MAIL_USER}",
+        "pass": "${MAIL_PASSWORD}"
       }
     }
   },
diff --git a/git-hooks/pre-commit b/git-hooks/pre-commit
new file mode 100755
index 0000000..7161ae2
--- /dev/null
+++ b/git-hooks/pre-commit
@@ -0,0 +1,3 @@
+drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream \
+&& git add .drone/drone-home.yml \
+&& echo "jsonnet built"
\ No newline at end of file
diff --git a/package.json b/package.json
index 33fcbb6..0c77971 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "private": true,
   "name": "ghost",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "ghost blog",
   "scripts": {
     "deploy": "sh deploy.sh",