diff --git a/.drone.jsonnet b/.drone.jsonnet
new file mode 100644
index 0000000..4c97a33
--- /dev/null
+++ b/.drone.jsonnet
@@ -0,0 +1,119 @@
+// generate .drone.yaml, run:
+// drone jsonnet --format --stream
+
+
+local CreateRelease() = {
+  name: 'create release',
+  image: 'plugins/gitea-release',
+  settings: {
+    api_key: { from_secret: 'GITEA_API_KEY' },
+    base_url: 'https://git.unlock-music.dev',
+    files: 'dist/*',
+    checksum: 'sha256',
+    draft: true,
+    title: '${DRONE_TAG}',
+  },
+};
+
+
+local StepGoBuild(GOOS, GOARCH) = {
+  local filepath = 'dist/um-%s-%s.tar.gz' % [GOOS, GOARCH],
+
+  name: 'go build %s/%s' % [GOOS, GOARCH],
+  image: 'golang:1.19',
+  environment: {
+    GOOS: GOOS,
+    GOARCH: GOARCH,
+  },
+  commands: [
+    'DIST_DIR=$(mktemp -d)',
+    'go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags --always)" -o $DIST_DIR ./cmd/um',
+    'mkdir -p dist',
+    'tar cz -f %s -C $DIST_DIR .' % filepath,
+  ],
+};
+
+local StepUploadArtifact(GOOS, GOARCH) = {
+  local filename = 'um-%s-%s.tar.gz' % [GOOS, GOARCH],
+  local filepath = 'dist/%s' % filename,
+  local pkgname = '${DRONE_REPO_NAME}-build',
+
+  name: 'upload artifact',
+  image: 'golang:1.19',  // reuse golang:1.19 for curl
+  environment: {
+    DRONE_GITEA_SERVER: 'https://git.unlock-music.dev',
+    GITEA_API_KEY: { from_secret: 'GITEA_API_KEY' },
+  },
+  commands: [
+    'curl --fail --include --user "um-release-bot:$GITEA_API_KEY" ' +
+    '--upload-file "%s" ' % filepath +
+    '"$DRONE_GITEA_SERVER/api/packages/${DRONE_REPO_NAMESPACE}/generic/%s/${DRONE_BUILD_NUMBER}/%s"' % [pkgname, filename],
+    'sha256sum %s' % filepath,
+    'echo $DRONE_GITEA_SERVER/${DRONE_REPO_NAMESPACE}/-/packages/generic/%s/${DRONE_BUILD_NUMBER}' % pkgname,
+  ],
+};
+
+
+local PipelineBuild(GOOS, GOARCH, RUN_TEST) = {
+  name: 'build %s/%s' % [GOOS, GOARCH],
+  kind: 'pipeline',
+  type: 'docker',
+  steps: [
+           {
+             name: 'fetch tags',
+             image: 'alpine/git',
+             commands: ['git fetch --tags'],
+           },
+         ] +
+         (
+           if RUN_TEST then [{
+             name: 'go test',
+             image: 'golang:1.19',
+             commands: ['go test -v ./...'],
+           }] else []
+         )
+         +
+         [
+           StepGoBuild(GOOS, GOARCH),
+           StepUploadArtifact(GOOS, GOARCH),
+         ],
+  trigger: {
+    event: ['push', 'pull_request'],
+  },
+};
+
+local PipelineRelease() = {
+  name: 'release',
+  kind: 'pipeline',
+  type: 'docker',
+  steps: [
+    {
+      name: 'fetch tags',
+      image: 'alpine/git',
+      commands: ['git fetch --tags'],
+    },
+    {
+      name: 'go test',
+      image: 'golang:1.19',
+      commands: ['go test -v ./...'],
+    },
+    StepGoBuild('linux', 'amd64'),
+    StepGoBuild('linux', 'arm64'),
+    StepGoBuild('linux', '386'),
+    StepGoBuild('windows', 'amd64'),
+    StepGoBuild('windows', '386'),
+    StepGoBuild('darwin', 'amd64'),
+    StepGoBuild('darwin', 'arm64'),
+    CreateRelease(),
+  ],
+  trigger: {
+    event: ['tag'],
+  },
+};
+
+[
+  PipelineBuild('linux', 'amd64', true),
+  PipelineBuild('windows', 'amd64', false),
+  PipelineBuild('darwin', 'amd64', false),
+  PipelineRelease(),
+]
diff --git a/.drone.yml b/.drone.yml
new file mode 100644
index 0000000..f0ffa1a
--- /dev/null
+++ b/.drone.yml
@@ -0,0 +1,212 @@
+---
+kind: pipeline
+name: build linux/amd64
+steps:
+- commands:
+  - git fetch --tags
+  image: alpine/git
+  name: fetch tags
+- commands:
+  - go test -v ./...
+  image: golang:1.19
+  name: go test
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-linux-amd64.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: amd64
+    GOOS: linux
+  image: golang:1.19
+  name: go build linux/amd64
+- commands:
+  - curl --fail --include --user "um-release-bot:$GITEA_API_KEY" --upload-file "dist/um-linux-amd64.tar.gz"
+    "$DRONE_GITEA_SERVER/api/packages/${DRONE_REPO_NAMESPACE}/generic/${DRONE_REPO_NAME}-build/${DRONE_BUILD_NUMBER}/um-linux-amd64.tar.gz"
+  - sha256sum dist/um-linux-amd64.tar.gz
+  - echo $DRONE_GITEA_SERVER/${DRONE_REPO_NAMESPACE}/-/packages/generic/${DRONE_REPO_NAME}-build/${DRONE_BUILD_NUMBER}
+  environment:
+    DRONE_GITEA_SERVER: https://git.unlock-music.dev
+    GITEA_API_KEY:
+      from_secret: GITEA_API_KEY
+  image: golang:1.19
+  name: upload artifact
+trigger:
+  event:
+  - push
+  - pull_request
+type: docker
+---
+kind: pipeline
+name: build windows/amd64
+steps:
+- commands:
+  - git fetch --tags
+  image: alpine/git
+  name: fetch tags
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-windows-amd64.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: amd64
+    GOOS: windows
+  image: golang:1.19
+  name: go build windows/amd64
+- commands:
+  - curl --fail --include --user "um-release-bot:$GITEA_API_KEY" --upload-file "dist/um-windows-amd64.tar.gz"
+    "$DRONE_GITEA_SERVER/api/packages/${DRONE_REPO_NAMESPACE}/generic/${DRONE_REPO_NAME}-build/${DRONE_BUILD_NUMBER}/um-windows-amd64.tar.gz"
+  - sha256sum dist/um-windows-amd64.tar.gz
+  - echo $DRONE_GITEA_SERVER/${DRONE_REPO_NAMESPACE}/-/packages/generic/${DRONE_REPO_NAME}-build/${DRONE_BUILD_NUMBER}
+  environment:
+    DRONE_GITEA_SERVER: https://git.unlock-music.dev
+    GITEA_API_KEY:
+      from_secret: GITEA_API_KEY
+  image: golang:1.19
+  name: upload artifact
+trigger:
+  event:
+  - push
+  - pull_request
+type: docker
+---
+kind: pipeline
+name: build darwin/amd64
+steps:
+- commands:
+  - git fetch --tags
+  image: alpine/git
+  name: fetch tags
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-darwin-amd64.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: amd64
+    GOOS: darwin
+  image: golang:1.19
+  name: go build darwin/amd64
+- commands:
+  - curl --fail --include --user "um-release-bot:$GITEA_API_KEY" --upload-file "dist/um-darwin-amd64.tar.gz"
+    "$DRONE_GITEA_SERVER/api/packages/${DRONE_REPO_NAMESPACE}/generic/${DRONE_REPO_NAME}-build/${DRONE_BUILD_NUMBER}/um-darwin-amd64.tar.gz"
+  - sha256sum dist/um-darwin-amd64.tar.gz
+  - echo $DRONE_GITEA_SERVER/${DRONE_REPO_NAMESPACE}/-/packages/generic/${DRONE_REPO_NAME}-build/${DRONE_BUILD_NUMBER}
+  environment:
+    DRONE_GITEA_SERVER: https://git.unlock-music.dev
+    GITEA_API_KEY:
+      from_secret: GITEA_API_KEY
+  image: golang:1.19
+  name: upload artifact
+trigger:
+  event:
+  - push
+  - pull_request
+type: docker
+---
+kind: pipeline
+name: release
+steps:
+- commands:
+  - git fetch --tags
+  image: alpine/git
+  name: fetch tags
+- commands:
+  - go test -v ./...
+  image: golang:1.19
+  name: go test
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-linux-amd64.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: amd64
+    GOOS: linux
+  image: golang:1.19
+  name: go build linux/amd64
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-linux-arm64.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: arm64
+    GOOS: linux
+  image: golang:1.19
+  name: go build linux/arm64
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-linux-386.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: "386"
+    GOOS: linux
+  image: golang:1.19
+  name: go build linux/386
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-windows-amd64.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: amd64
+    GOOS: windows
+  image: golang:1.19
+  name: go build windows/amd64
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-windows-386.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: "386"
+    GOOS: windows
+  image: golang:1.19
+  name: go build windows/386
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-darwin-amd64.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: amd64
+    GOOS: darwin
+  image: golang:1.19
+  name: go build darwin/amd64
+- commands:
+  - DIST_DIR=$(mktemp -d)
+  - go build -v -trimpath -ldflags="-w -s -X main.AppVersion=$(git describe --tags
+    --always)" -o $DIST_DIR ./cmd/um
+  - mkdir -p dist
+  - tar cz -f dist/um-darwin-arm64.tar.gz -C $DIST_DIR .
+  environment:
+    GOARCH: arm64
+    GOOS: darwin
+  image: golang:1.19
+  name: go build darwin/arm64
+- image: plugins/gitea-release
+  name: create release
+  settings:
+    api_key:
+      from_secret: GITEA_API_KEY
+    base_url: https://git.unlock-music.dev
+    checksum: sha256
+    draft: true
+    files: dist/*
+    title: ${DRONE_TAG}
+trigger:
+  event:
+  - tag
+type: docker