ci: deploy tracker to Pi at 2026.zea.lt

After pushing the image, SSH-deploy pulls and restarts the
homelab tracker compose service behind Traefik.

Co-authored-by: Cursor <cursoragent@cursor.com>

.drone.yml

@@ -6,7 +6,6 @@ platform:
   os: linux
   arch: amd64
 
-# Pi-hole on LAN so *.zea.lt hits Traefik (not public hairpin)
 dns:
   - 192.168.0.64
 
@@ -76,3 +75,69 @@ steps:
         - master
     depends_on:
       - build
+
+trigger:
+  event:
+    - push
+    - pull_request
+    - custom
+
+---
+kind: pipeline
+type: docker
+name: deploy
+
+platform:
+  os: linux
+  arch: amd64
+
+dns:
+  - 192.168.0.64
+
+depends_on:
+  - build-and-push
+
+clone:
+  disable: true
+
+concurrency:
+  limit: 1
+
+steps:
+  - name: ssh-deploy
+    image: appleboy/drone-ssh
+    pull: false
+    settings:
+      host:
+        from_secret: ssh_host
+      username:
+        from_secret: ssh_user
+      key:
+        from_secret: ssh_key
+      port:
+        from_secret: ssh_port
+      script_stop: true
+      envs:
+        - REGISTRY_USERNAME
+        - REGISTRY_PASSWORD
+      script:
+        - set -euo pipefail
+        - echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
+        - cd /home/miczek/homelab/tracker
+        - docker compose pull
+        - docker compose up -d --remove-orphans
+        - docker compose ps
+        - docker logout registry.zea.lt || true
+    environment:
+      REGISTRY_USERNAME:
+        from_secret: registry_username
+      REGISTRY_PASSWORD:
+        from_secret: registry_password
+
+trigger:
+  branch:
+    - master
+    - main
+  event:
+    - push
+    - custom