diff --git a/deploy/openresty/account.svc.plus.conf b/deploy/openresty/account.svc.plus.conf
new file mode 100644
index 0000000..93c70d2
--- /dev/null
+++ b/deploy/openresty/account.svc.plus.conf
@@ -0,0 +1,40 @@
+server {
+  listen 80;
+  server_name account.svc.plus;
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  server_name account.svc.plus;
+
+  ssl_certificate     /etc/ssl/svc.plus.pem;
+  ssl_certificate_key /etc/ssl/svc.plus.rsa.key;
+  ssl_protocols       TLSv1.2 TLSv1.3;
+  ssl_ciphers         HIGH:!aNULL:!MD5;
+
+  location ^~ /api/auth/ {
+    proxy_pass http://127.0.0.1:8080;
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    add_header Access-Control-Allow-Origin $cors_origin always;
+    add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "Authorization, Content-Type, Cookie" always;
+    add_header Access-Control-Allow-Credentials "true" always;
+
+    if ($request_method = OPTIONS) {
+      return 204;
+    }
+
+    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate";
+    add_header Pragma "no-cache";
+    add_header Expires "0";
+
+    proxy_cookie_path / "/; Secure; HttpOnly; SameSite=None";
+  }
+}
diff --git a/deploy/openresty/frontend.dynamic.svc.plus.conf b/deploy/openresty/frontend.dynamic.svc.plus.conf
new file mode 100644
index 0000000..3ee1284
--- /dev/null
+++ b/deploy/openresty/frontend.dynamic.svc.plus.conf
@@ -0,0 +1,38 @@
+server {
+  listen 80;
+  server_name www.svc.plus frontend.svc.plus;
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  server_name www.svc.plus frontend.svc.plus;
+
+  ssl_certificate     /etc/ssl/svc.plus.pem;
+  ssl_certificate_key /etc/ssl/svc.plus.rsa.key;
+  ssl_protocols       TLSv1.2 TLSv1.3;
+  ssl_ciphers         HIGH:!aNULL:!MD5;
+
+  location ^~ /_next/ {
+    proxy_pass http://127.0.0.1:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+  }
+
+  location /favicon.ico {
+    proxy_pass http://127.0.0.1:3000;
+  }
+
+  location / {
+    proxy_pass http://127.0.0.1:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+
+  location ~ /\. {
+    deny all;
+  }
+}
diff --git a/deploy/openresty/cn-homepage-dynamic.svc.plus.conf b/deploy/openresty/rag-server.svc.plus.conf
similarity index 54%
rename from deploy/openresty/cn-homepage-dynamic.svc.plus.conf
rename to deploy/openresty/rag-server.svc.plus.conf
index 673e8e4..81ae889 100644
--- a/deploy/openresty/cn-homepage-dynamic.svc.plus.conf
+++ b/deploy/openresty/rag-server.svc.plus.conf
@@ -1,31 +1,39 @@
 server {
   listen 80;
-  server_name www.svc.plus cn-homepage.svc.plus;
+  server_name rag-server.svc.plus api.svc.plus;
   return 301 https://$host$request_uri;
 }
 
 server {
   listen 443 ssl;
-  server_name www.svc.plus cn-homepage.svc.plus;
+  server_name rag-server.svc.plus api.svc.plus;
 
   ssl_certificate     /etc/ssl/svc.plus.pem;
   ssl_certificate_key /etc/ssl/svc.plus.rsa.key;
   ssl_protocols       TLSv1.2 TLSv1.3;
   ssl_ciphers         HIGH:!aNULL:!MD5;
 
-  # =======================
-  # API 反向代理（保持原样）
-  # =======================
-  location /api/ {
-    proxy_pass http://127.0.0.1:8080;
+  location ^~ /api/ {
+    proxy_pass http://127.0.0.1:8090;
     proxy_http_version 1.1;
+
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+
+    add_header Access-Control-Allow-Origin $cors_origin always;
+    add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "Authorization, Content-Type, Cookie" always;
+    add_header Access-Control-Allow-Credentials "true" always;
+
+    if ($request_method = OPTIONS) {
+      return 204;
+    }
+
+    add_header Cache-Control "no-store";
   }
 
-  # /api/askai 接口限流（保持原样）
   location = /api/askai {
     access_by_lua_block {
       local redis = require "resty.redis"
@@ -51,45 +59,11 @@ server {
       end
     }
 
-    proxy_pass http://127.0.0.1:8080;
+    proxy_pass http://127.0.0.1:8090;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
   }
-
-  # =======================
-  # 页面请求：全部转发到 Next.js
-  # =======================
-
-  location ^~ /_next/ {
-    proxy_pass http://127.0.0.1:3000;
-    proxy_http_version 1.1;
-    proxy_set_header Host $host;
-  }
-
-  location /favicon.ico {
-    proxy_pass http://127.0.0.1:3000;
-  }
-  location / {
-    proxy_pass http://127.0.0.1:3000;
-    proxy_http_version 1.1;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-
-    # 若需要进一步省资源，可开启微缓存（可选）
-    # proxy_cache            ssr_cache;
-    # proxy_cache_key        $scheme$host$request_uri;
-    # proxy_cache_valid 200  5s;
-    # proxy_cache_valid 404  1s;
-    # add_header X-Cache $upstream_cache_status;
-  }
-
-  # 拒绝访问隐藏文件（如 .env）
-  location ~ /\. {
-    deny all;
-  }
 }