diff --git a/.env.sample b/.env.sample
index c4f0010..31d4595 100644
--- a/.env.sample
+++ b/.env.sample
@@ -4,9 +4,8 @@
 #############################################
 
 # ========== 1. 访问地址（部署时必改） ==========
-# 默认服务器 API 地址，云服务需修改为云端 IP 并放行对应端口
-NUXT_PUBLIC_BASE_APIURL=http://127.0.0.1:3001
-# 域名访问：NUXT_PUBLIC_BASE_APIURL=/api
+# 浏览器统一通过 Nginx 同源访问 API
+NUXT_PUBLIC_BASE_APIURL=/api
 
 # 后端生成文件、预签名地址和异步任务查询地址时使用的公开 API 根地址。
 # 留空时启动/升级脚本会根据本节已有配置初始化；手工维护时必须填写完整 http(s) URL。
@@ -15,23 +14,28 @@ CONFIG_PUBLIC_API_BASE_URL=
 # 示例：https://api.example.com:8443/api
 DEPLOY_PUBLIC_API_BASE_URL=
 
-# 默认 WebSocket 地址
-NUXT_PUBLIC_BASE_SOCKETURL=ws://127.0.0.1:3002
-# 域名访问：NUXT_PUBLIC_BASE_SOCKETURL=wss://yourwebsite.com/socket.io
+# 默认 WebSocket 地址；部署脚本会替换为 ws(s)://IP或域名/socket.io
+NUXT_PUBLIC_BASE_SOCKETURL=ws://127.0.0.1/socket.io
 
 # Agent 服务治理 API 地址，前端管理页面需要
-NUXT_PUBLIC_SG_APIURL=http://127.0.0.1:3003
-# 域名访问：NUXT_PUBLIC_SG_APIURL=/asg-api
+NUXT_PUBLIC_SG_APIURL=/asg-api
 
 # ========== 2. 服务端口 ==========
 WEB_PORT=3010
-# easyai-web 前端端口，访问地址 ip:3010，初始化管理员 admin/123456
+# easyai-web 上游端口，由 Nginx 在 80 端口统一代理
+
+EASYAI_PROXY_BIND_IP=127.0.0.1
+# Nginx 上游服务的宿主机绑定地址。Linux IP/域名部署保持回环。
+
+EASYAI_INFRA_BIND_IP=127.0.0.1
+# MongoDB、RabbitMQ、Dozzle、视频编辑、Agent Memory 等基础设施端口默认仅允许宿主机访问。
+# 仅在受控内网且有额外防火墙时才可显式改为其他地址，禁止使用 0.0.0.0 暴露到公网。
 
 SERVER_HTTP_PORT=3001
 # easyai-server 后端 HTTP 端口
 
 SERVER_HTTP_BIND_IP=127.0.0.1
-# easyai-server 宿主机绑定地址。域名/本机部署保持 127.0.0.1；仅 IP/LAN 直连模式使用 0.0.0.0
+# easyai-server 宿主机绑定地址。Linux IP/域名部署经 Nginx 访问，保持 127.0.0.1
 
 NODE_MAX_OLD_SPACE_SIZE=8192
 # easyai-server 的 Node.js V8 old-space 堆上限，单位 MiB
@@ -135,7 +139,7 @@ CONFIG_AUDIT_INTEGRITY_KEY=
 
 # 允许访问后端的浏览器 Origin，多个值用英文逗号分隔，生产环境禁止使用 *。
 # 域名部署示例：https://yourwebsite.com,https://www.yourwebsite.com
-CONFIG_SECURITY_ORIGIN=http://127.0.0.1:3010,http://localhost:3010
+CONFIG_SECURITY_ORIGIN=http://127.0.0.1,http://localhost
 
 # 可信反向代理 IP/CIDR，多个值用英文逗号分隔；未使用反向代理时保持为空。
 # 仅填写实际 Nginx/负载均衡地址，不要使用 0.0.0.0/0。
@@ -149,7 +153,8 @@ CONFIG_AUTH_UNIQUE_INDEXES_ENABLED=false
 # admin 创建后不再使用该值；修改 .env 或执行升级不会重置现有管理员密码。
 CONFIG_INITIAL_ADMIN_PASSWORD=
 
-CONFIG_TOKEN_SIGN_SK=easyai2025easyai
+# 海淀教育平台旧 SSO 专用密钥（必须为随机的 16 或 32 字节；不用该集成则保持为空）
+CONFIG_TOKEN_SIGN_SK=
 
 # ========== 9. 运维与调试 ==========
 CONFIG_INSTANCE_ID=2025
@@ -202,8 +207,8 @@ WS_GATEWAY_TCP_TIMEOUT_MS=1500
 # ========== 12. ws-gateway 转发客户端命令到 easyai-server（TCP） ==========
 # 拖动画布、协作 presence 等客户端命令由 ws-gateway 转发到 easyai-server 处理
 GATEWAY_INBOUND_ENABLED=true
-# easyai-server 监听地址；容器内应监听 0.0.0.0，供 ws-gateway 访问
-GATEWAY_INBOUND_TCP_LISTEN_HOST=0.0.0.0
+# easyai-server 只在主业务网络固定地址监听，避免 Sandbox 网络访问内部命令入口
+GATEWAY_INBOUND_TCP_LISTEN_HOST=172.21.0.6
 # ws-gateway 访问 easyai-server 的 TCP 地址；Docker 部署必须使用服务名，不能用 127.0.0.1
 GATEWAY_INBOUND_TCP_HOST=easyai-server
 # ws-gateway 到 easyai-server 的命令入口端口，对应主服务 HTTP 端口 3001
diff --git a/README.md b/README.md
index 62e60c9..228bf0e 100644
--- a/README.md
+++ b/README.md
@@ -19,6 +19,8 @@ DEPLOY_ACCESS=domain DEPLOY_DOMAIN=demo.example.com DEPLOY_HTTPS=false ./start.s
 DEPLOY_ACCESS=domain DEPLOY_DOMAIN=demo.example.com DEPLOY_HTTPS=true CERTBOT_EMAIL=ops@example.com ./start.sh
 ```
 
+Linux IP 模式会自动安装并配置 Nginx，浏览器统一访问 `http://IP`。公网只需放行 TCP 80；前端、API、WebSocket 和 ASG 分别通过 `/`、`/api`、`/socket.io`、`/asg-api` 反向代理，容器上游端口默认仅绑定 `127.0.0.1`。
+
 常用变量：
 
 | 变量 | 说明 |
@@ -61,7 +63,7 @@ DEPLOY_ACCESS=domain DEPLOY_DOMAIN=demo.example.com DEPLOY_HTTPS=true CERTBOT_EM
 2. 来自可信代理的当前请求地址（仅当请求来源命中 `CONFIG_TRUSTED_PROXY` 时读取转发 Header）。
 3. 当前请求的直接 `Host`。
 
-启动和升级脚本会在拉取镜像、重建服务之前校验并持久化 `CONFIG_PUBLIC_API_BASE_URL`：新 IP 部署使用 `http://IP:${SERVER_HTTP_PORT}`；域名部署中 `DEPLOY_HTTPS=false` 使用 `http/ws`，`DEPLOY_HTTPS=true` 使用 `https/wss`，API 路径均为 `/api`。旧环境缺少该配置时，会依次从绝对 `NUXT_PUBLIC_BASE_APIURL`、WebSocket origin、首个 `CONFIG_SECURITY_ORIGIN` 推导。已有合法值保持不变，非法或无法推导时脚本会终止并提示修复。
+启动和升级脚本会在拉取镜像、重建服务之前校验并持久化 `CONFIG_PUBLIC_API_BASE_URL`：新 IP 部署使用 `http://IP/api`；域名部署中 `DEPLOY_HTTPS=false` 使用 `http/ws`，`DEPLOY_HTTPS=true` 使用 `https/wss`。IP 与域名模式的浏览器接口路径统一为 `/api`、`/socket.io`、`/asg-api`，只由 Nginx 监听地址和公开协议决定 origin。旧环境缺少该配置时，会依次从绝对 `NUXT_PUBLIC_BASE_APIURL`、WebSocket origin、首个 `CONFIG_SECURITY_ORIGIN` 推导。已有合法值保持不变，非法或无法推导时脚本会终止并提示修复。
 
 已有外部 TLS、手工代理、自定义公开端口或特殊路径时，可在执行脚本前设置高级覆盖：
 
@@ -477,32 +479,15 @@ curl https://<你的域名>/asg-api/health
 SANDBOX_SERVICE_BASE_URL=  #脚本运行环境使用的服务地址，默认通过 Docker 内网访问 http://sandbox:8000，不需要配置
 ```
 
-> 安全默认值：Sandbox API 与 JupyterLab 不映射宿主机端口，Nginx 模板对 `/api/sandbox`、`/sandbox`、`/jupyterlab` 返回 404。不要在公网重新开放这些高权限入口。
+> 安全默认值：Sandbox API 与 JupyterLab 不映射宿主机端口，Nginx 模板对 `/api/sandbox`、`/sandbox`、`/jupyterlab` 返回 404。Sandbox 使用独立 Docker 网络，不能访问 MongoDB、Redis、RabbitMQ 与治理服务。不要在公网重新开放这些高权限入口，也不要把 Sandbox 接回主业务网络。
 
 
 ### 2025.1.29
 
 1. 优化日志管理功能，使用单独的容器和模块来进行管理，不占用主进程文件写入性能
-2. 更新步骤：
-- 本次`docker-compose.yml`新增dozzle容器，将`docker-compose.yml`文件更新到最新
-- 在nginx配置文件中（/etc/nginx/conf.d/easyai-proxy.conf）添加如下配置,具体添加位置参考`easyai-proxy.conf.sample`
-```nginx configuration
-    location /logs-web/ {
-        proxy_pass http://127.0.0.1:8080/logs-web/;
-        proxy_redirect off;
-        proxy_set_header X-Original-Prefix '/logs-web';
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host;
-    }
-```
-3. 默认不启用密码（有风险⚠️，别人可以任意访问你的应用日志）。如果启用密码，取消`docker-compose.yml`中的`DOZZLE_AUTH_PROVIDER: simple`的注释，默认密码为`123456`，用户名为`admin`。
-4. 修改默认密码，使用下面的命令生成密码：（替换admin和密码为实际的用户名和密码）
-```bash
-docker run -it --rm registry.cn-shanghai.aliyuncs.com/easyaigc/dozzle:latest generate admin --password 密码
-```
-5. 用生成的密码填入/data/users.yml中的password,并保存后，密码即刻生效
+2. Dozzle 端口默认绑定 `127.0.0.1`，Nginx 对 `/logs-web` 返回 404，禁止把容器日志查看器直接代理到公网。
+3. 需要查看日志时，在受信任终端建立 SSH 隧道后访问本机端口，或直接使用 `docker logs`。不要依赖 Dozzle 的无认证模式或默认口令。
+4. 日志下载功能默认关闭，避免容器日志被批量导出。
 
 
 ### 2025.12.27
@@ -598,22 +583,16 @@ git clone --depth 1 https://git.51easyai.com/wangbo/easyai.git
 cd easyai
 ```
 
-2. 去掉所有文件后缀的.sample后缀，修改env中环境变量，将下面两个环境变量修改为你的服务器的公网ip，本地局域网方式使用局域网IP
-```bash
-NUXT_PUBLIC_BASE_APIURL=http://<你的服务器公网IP或者局域网地址>:3001
-NUXT_PUBLIC_BASE_SOCKETURL=ws://<你的服务器公网IP或者局域网地址>:3002
-SERVER_HTTP_BIND_IP=0.0.0.0
-```
-3. 开放服务器的3001、3002和3010端口
-4. [首次执行，后续无需重复执行]添加脚本的执行权限，命令：
+2. 在安全组或防火墙中仅开放 TCP 80 端口。脚本会自动生成 `.env` 和完整 Nginx 配置，接口统一走 `/api`、`/socket.io`、`/asg-api`。
+3. [首次执行，后续无需重复执行]添加脚本的执行权限，命令：
 ```bash
 chmod +x start.sh
 ```
-5. 执行start.sh脚本，即可自动安装依赖和启动EasyAI应用
+4. 执行start.sh脚本，选择 IP 模式并输入服务器公网 IP，即可自动安装依赖、启动 EasyAI 并配置 Nginx
 ```bash
 ./start.sh
 ```
-6. 脚本运行完成无错误，并且提示`EasyAI应用启动成功`表示应用启动成功，打开浏览器输入服务器的公网ip：3010或者局域网IP：3010，即可访问EasyAI应用
+5. 脚本运行完成无错误后，打开浏览器访问 `http://服务器IP`。
 
 ## Windows 一键启动
 
diff --git a/demo.51easyai.com.conf b/demo.51easyai.com.conf
new file mode 100644
index 0000000..f92e0c2
--- /dev/null
+++ b/demo.51easyai.com.conf
@@ -0,0 +1,200 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+# www 域名重定向，使用二级域名注释掉此部分的域名重定向
+server {
+    listen 80;
+    listen [::]:80;
+    server_name www.demo.51easyai.com;
+
+    # 添加 HSTS 策略
+#     add_header Strict-Transport-Security "max-age=31536000" always;
+
+   # ssl 版本控制
+    ssl_protocols TLSv1.2 TLSv1.3;  # 只启用 TLS 1.2 和 TLS 1.3
+
+    # 用于 certbot 验证的配置
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        try_files $uri =404;
+    }
+
+    # 更严格的重定向规则
+    location / {
+        return 301 https://demo.51easyai.com$request_uri;
+    }
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name demo.51easyai.com;
+
+    # EasyAI response gzip: compress JSON/text API responses; SSE/WebSocket stay uncompressed by content type.
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_comp_level 4;
+    gzip_proxied any;
+    gzip_types
+        application/json
+        application/javascript
+        application/xml
+        text/css
+        text/plain
+        text/xml
+        image/svg+xml;
+
+       # ssl 版本控制
+        ssl_protocols TLSv1.2 TLSv1.3;  # 只启用 TLS 1.2 和 TLS 1.3
+        # 通用安全头部
+        add_header X-Content-Type-Options nosniff;
+        add_header X-Frame-Options "SAMEORIGIN";
+        add_header X-XSS-Protection "1; mode=block";
+    # 用于 certbot 验证的配置
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        try_files $uri =404;
+    }
+
+        # 专门处理企业微信验证文件的请求
+#         location = /WW_verify_9eWb5ozYfqE0Bb2i.txt {
+#             default_type text/plain;  # 设置正确的Content-Type
+#             return 200 '9eWb5ozYfqE0Bb2i';  # 直接返回验证内容
+#         }
+
+    location / {
+        proxy_pass http://127.0.0.1:3010/;
+        proxy_redirect off;  # 修改重定向处理
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+    }
+
+    location = /api/sandbox {
+        return 404;
+    }
+
+    location ^~ /api/sandbox/ {
+        return 404;
+    }
+
+    location = /api/integration/platform-api/execute {
+        return 404;
+    }
+
+    # 旧教育平台 SSO 仅在双方完成独立密钥配置后，才允许显式开启。
+    location = /api/auth/sign/token {
+        return 404;
+    }
+
+    location = /api/auth/verify/token {
+        return 404;
+    }
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:3001/;
+        proxy_read_timeout 1200s;  # 您已设置，适合长连接
+        client_max_body_size 100M;
+        proxy_redirect off;
+
+        # --- SSE 关键配置开始 ---
+        proxy_buffering off;            # 必须：关闭代理缓冲，数据会立即从后端发送到客户端
+        proxy_cache off;                # 必须：禁用缓存，SSE是动态内容
+        proxy_set_header Connection ''; # 清除 Connection header，有助于保持长连接
+        proxy_http_version 1.1;         # 推荐使用 HTTP/1.1
+        proxy_set_header Accept-Encoding ''; # 可选：防止上游压缩导致缓冲，如果后端有gzip等压缩，可能会影响流式输出
+        # --- SSE 关键配置结束 ---
+        proxy_set_header X-Original-Prefix '/api';
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+    }
+
+    location /asg-api/ {
+        proxy_pass http://127.0.0.1:3003/;
+        proxy_read_timeout 300s;
+        client_max_body_size 20M;
+        proxy_redirect off;
+        proxy_set_header X-Original-Prefix '/asg-api';
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+    }
+
+    # Agent 记忆服务 API（可选，用于健康检查或外部调用）
+    location /ams-api/ {
+        proxy_pass http://127.0.0.1:3004/;
+        proxy_read_timeout 300s;
+        client_max_body_size 20M;
+        proxy_redirect off;
+        proxy_set_header X-Original-Prefix '/ams-api';
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+    }
+
+    location /plugins/ {
+        proxy_pass http://127.0.0.1:3020/plugins/;
+        proxy_redirect off;
+        proxy_set_header X-Original-Prefix '/plugins';
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+    }
+    location = /logs-web {
+        return 404;
+    }
+
+    location ^~ /logs-web/ {
+        return 404;
+    }
+    location = /jupyterlab {
+        return 404;
+    }
+
+    location ^~ /jupyterlab/ {
+        return 404;
+    }
+    location /socket.io {
+        proxy_pass http://127.0.0.1:3002;
+        proxy_read_timeout 300s;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_buffering off;  # 对于 WebSocket 连接禁用缓冲
+    }
+    #  转发/mcp/messages 消息到3001
+    location /mcp {
+        proxy_pass http://127.0.0.1:3001/mcp;
+        proxy_read_timeout 300s;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_buffering off;  # 对于 WebSocket 连接禁用缓冲
+    }
+
+    location = /sandbox {
+        return 404;
+    }
+
+    location ^~ /sandbox/ {
+        return 404;
+    }
+
+}
diff --git a/design.md b/design.md
index 9c41cc9..e7ccae9 100644
--- a/design.md
+++ b/design.md
@@ -3,18 +3,18 @@
 
 1. 通过IP地址还是通过域名访问？
 
-2. （如果通过IP地址访问），输入服务器IP，并保证3001，3002，3003三个端口已经开放
+2. （如果通过IP地址访问），输入服务器 IP，并保证 80 端口已经开放
 
 3.  如果通过域名访问输入域名，不含https://的前缀，例如：51easyai.com
 
 3.1 是否启用https访问
 
-4. 对于IP地址访问的情形，复制`.env.sample`为`.env`,并将NUXT_PUBLIC_BASE_APIURL、NUXT_PUBLIC_BASE_SOCKETURL、NUXT_PUBLIC_SG_APIURL三个分别进行如下设置
+4. IP 与域名访问共用相同的 Nginx 接口路径，只根据公开地址选择 WebSocket 协议和 Host
 
 ```bash
-NUXT_PUBLIC_BASE_APIURL=http://<用户输入的IP地址>:3001 
-NUXT_PUBLIC_BASE_SOCKETURL=ws://<用户输入的IP地址>:3002
-NUXT_PUBLIC_SG_APIURL=http://<用户输入的IP地址>:3003
+NUXT_PUBLIC_BASE_APIURL=/api
+NUXT_PUBLIC_BASE_SOCKETURL=ws://<用户输入的IP地址>/socket.io
+NUXT_PUBLIC_SG_APIURL=/asg-api
 ```
 5. 对于使用域名的情况下情况，复制`.env.sampla`为`.env`,将上述3个变量设置为：
 ```bash
@@ -25,7 +25,7 @@ NUXT_PUBLIC_SG_APIURL=/asg-api
 
 6. 复制 `.env.tools.sample`为`.env.tools`，复制`.env.ASG.sample`为`.env.ASG.sample`
 
-7. 对于使用域名的情况下，将`easyai-proxy.conf.sample`复制为`easyai-proxy.conf`,并将文件名修改为`用户输入的域名.conf`，并将`51easyai.com`替换为用户的域名
+7. IP 与域名模式都从 `easyai-proxy.conf.sample` 生成完整 Nginx 配置；IP 模式监听对应 IP 的 HTTP 80，域名模式监听域名并按需启用 HTTPS
 
 8. 执行原来的start脚本内容，包括安装docker安装和部署
 
@@ -40,4 +40,4 @@ NUXT_PUBLIC_SG_APIURL=/asg-api
 
 ```
 bash -c https://git.51easyai.com/wangbo/easyai/src/branch/main/start.sh
-```
\ No newline at end of file
+```
diff --git a/docker-compose.yml b/docker-compose.yml
index 293ea83..7a35459 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,7 +10,7 @@ services:
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     ports:
-      - "${WEB_PORT}:3010"
+      - "${EASYAI_PROXY_BIND_IP:-127.0.0.1}:${WEB_PORT}:3010"
 #    read_only: true
     networks:
       easyai:
@@ -55,11 +55,12 @@ services:
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     ports:
-      - "${SERVER_HTTP_BIND_IP:-127.0.0.1}:${SERVER_HTTP_PORT}:3001"    # 域名/本机部署默认仅回环；IP/LAN 模式由启动脚本显式设为 0.0.0.0
+      - "${SERVER_HTTP_BIND_IP:-127.0.0.1}:${SERVER_HTTP_PORT}:3001"    # Linux Nginx 部署默认仅回环；Windows/LAN 直连由启动脚本显式覆盖
 #    read_only: true
     networks:
       easyai:
         ipv4_address: 172.21.0.6
+      sandbox-network:
     depends_on:
       - mongo
       - redis
@@ -120,7 +121,8 @@ services:
       - ASG_TCP_PORT=4003
       # ws-gateway 转发客户端命令到 easyai-server（画布协作等），对应主服务 3001
       - GATEWAY_INBOUND_ENABLED=${GATEWAY_INBOUND_ENABLED:-true}
-      - GATEWAY_INBOUND_TCP_LISTEN_HOST=${GATEWAY_INBOUND_TCP_LISTEN_HOST:-0.0.0.0}
+      # 仅监听主业务网络固定地址，避免沙箱网络访问内部 TCP 命令入口
+      - GATEWAY_INBOUND_TCP_LISTEN_HOST=${GATEWAY_INBOUND_TCP_LISTEN_HOST:-172.21.0.6}
       - GATEWAY_INBOUND_TCP_PORT=${GATEWAY_INBOUND_TCP_PORT:-4001}
       # Agent 记忆服务 TCP 连接（来自 .env）
       - MEMORY_TCP_HOST=${MEMORY_TCP_HOST:-agent-memory}
@@ -149,7 +151,7 @@ services:
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     ports:
-      - "${CONFIG_WS_PORT:-3002}:3002"    # ws-gateway WebSocket 对外端口映射
+      - "${EASYAI_PROXY_BIND_IP:-127.0.0.1}:${CONFIG_WS_PORT:-3002}:3002"    # Linux IP/域名模式默认仅供同机 Nginx 访问
     read_only: true
     networks:
       - easyai
@@ -195,10 +197,9 @@ services:
     image: ${MONGO_IMAGE:-registry.cn-shanghai.aliyuncs.com/comfy-ai/mongo-aliyun:latest}
     container_name: mongo
     restart: unless-stopped
-    privileged: true
     # 生产环境建议不要暴露
     ports:
-      - ${MONGO_PORT+${MONGO_PORT}:27017}
+      - "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${MONGO_PORT:-27017}:27017"
     networks:
       easyai:
         ipv4_address: 172.21.0.3
@@ -257,8 +258,8 @@ services:
       RABBITMQ_DEFAULT_USER: ${CONFIG_MQ_USER}        # 登录用户名
       RABBITMQ_DEFAULT_PASS: ${CONFIG_MQ_PASSWORD}    # 登录密码
     ports:
-      - "${CONFIG_MQ_PORT}:${CONFIG_MQ_PORT}"    # 应用连接端口 (AMQP)
-      - "${CONFIG_MQ_ADMIN_PORT}:15672"  # Web 管理界面
+      - "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${CONFIG_MQ_PORT}:${CONFIG_MQ_PORT}"    # 应用连接端口 (AMQP)
+      - "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${CONFIG_MQ_ADMIN_PORT}:15672"  # Web 管理界面
     volumes:
       - rabbitmq_data:/var/lib/rabbitmq  # 持久化数据
     networks:
@@ -268,10 +269,8 @@ services:
     image: registry.cn-shanghai.aliyuncs.com/comfy-ai/watchtower-aliyun:latest
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --debug --http-api-update
+    command: --debug
     restart: always
-    environment:
-      - WATCHTOWER_HTTP_API_TOKEN=sk-ofJoA4atj9dki6AvDtI1qwxdcejjDQ
     labels:
       - "com.centurylinklabs.watchtower.enable=false"
 #    ports:
@@ -295,7 +294,7 @@ services:
     volumes:
       - ./data/videoedit/temp:/app/temp
     ports:
-      - '${VIDEO_EDIT_PORT}:8000'
+      - '${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${VIDEO_EDIT_PORT}:8000'
     env_file:
       - .env.tools
     environment:
@@ -328,13 +327,12 @@ services:
     image: registry.cn-shanghai.aliyuncs.com/easyaigc/dozzle:latest
     environment:
       DOZZLE_BASE: /logs-web
-#      DOZZLE_AUTH_PROVIDER: simple
-      DOZZLE_AUTH_TTL: 72h
+      DOZZLE_ENABLE_DOWNLOAD: "false"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data:/data
     ports:
-      - "${DOZZLE_PORT:-8080}:8080"
+      - "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${DOZZLE_PORT:-8080}:8080"
     restart: unless-stopped
     logging:
       driver: "json-file"
@@ -345,7 +343,7 @@ services:
     image: registry.cn-shanghai.aliyuncs.com/easyaigc/sandbox:latest
     container_name: sandbox
     networks:
-      - easyai
+      - sandbox-network
     # 不映射宿主机端口，仅允许 Docker 内网中的 easyai-server 访问
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
@@ -422,7 +420,7 @@ services:
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     ports:
-      - "${ASG_PORT:-3003}:3003"
+      - "${EASYAI_PROXY_BIND_IP:-127.0.0.1}:${ASG_PORT:-3003}:3003"
     networks:
       easyai:
         ipv4_address: 172.21.0.14
@@ -453,7 +451,7 @@ services:
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     ports:
-      - "${AMS_PORT:-3004}:3004"
+      - "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${AMS_PORT:-3004}:3004"
     environment:
       - MEMORY_DATABASE_URL=${MEMORY_DATABASE_URL:-postgresql://easyai:easyai2025@easyai-pgvector:5432/easyai_memory}
     networks:
@@ -530,3 +528,7 @@ networks:
       config:
         - subnet: 172.21.0.0/16
           gateway: 172.21.0.1
+  # 仅 easyai-server 与 sandbox 共享，阻断沙箱横向访问数据库、缓存、MQ 与治理服务。
+  # 保持普通 bridge 以允许用户脚本按业务需要访问外网。
+  sandbox-network:
+    driver: bridge
diff --git a/easyai-proxy.conf.sample b/easyai-proxy.conf.sample
index f9b3482..baefec4 100644
--- a/easyai-proxy.conf.sample
+++ b/easyai-proxy.conf.sample
@@ -9,7 +9,8 @@ map $http_host $easyai_forwarded_host {
     ''      $host;
 }
 
-# www 域名重定向，使用二级域名注释掉此部分的域名重定向
+# EASYAI_WWW_REDIRECT_BEGIN
+# www 域名重定向；IP 模式生成配置时会删除整个区块。
 server {
     listen 80;
     listen [::]:80;
@@ -32,6 +33,7 @@ server {
         return 301 https://51easyai.com$request_uri;
     }
 }
+# EASYAI_WWW_REDIRECT_END
 
 server {
     listen 80;
@@ -104,6 +106,20 @@ server {
         return 404;
     }
 
+    # 废弃的服务端任意 HTTP 调试入口不得对公网开放。
+    location = /api/integration/platform-api/execute {
+        return 404;
+    }
+
+    # 旧教育平台 SSO 必须先配置双方独立密钥，默认不对公网开放。
+    location = /api/auth/sign/token {
+        return 404;
+    }
+
+    location = /api/auth/verify/token {
+        return 404;
+    }
+
     location /api/ {
         proxy_pass http://127.0.0.1:3001/;
         proxy_read_timeout 1200s;  # 您已设置，适合长连接
@@ -160,14 +176,14 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header Host $host;
     }
-    location /logs-web/ {
-        proxy_pass http://127.0.0.1:8080/logs-web/;
-        proxy_redirect off;
-        proxy_set_header X-Original-Prefix '/logs-web';
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host;
+    # Dozzle 直接暴露会泄露全部容器日志、环境与下载入口。
+    # 如需排障，请通过服务器本机或 SSH 隧道访问回环端口，不允许公网代理。
+    location = /logs-web {
+        return 404;
+    }
+
+    location ^~ /logs-web/ {
+        return 404;
     }
     location = /jupyterlab {
         return 404;
diff --git a/scripts/test-deployment-public-url.sh b/scripts/test-deployment-public-url.sh
index 28e6414..f25c05f 100755
--- a/scripts/test-deployment-public-url.sh
+++ b/scripts/test-deployment-public-url.sh
@@ -32,6 +32,7 @@ reset_case() {
         .env.ASG \
         .env.AMS \
         easyai-proxy.conf \
+        10.0.0.8.conf \
         demo.example.com.conf
 }
 
@@ -63,18 +64,37 @@ assert_sandbox_public_access_disabled() {
     fi
 }
 
+assert_high_risk_public_access_disabled() {
+    local config_file="$1"
+    grep -q '^    location = /api/integration/platform-api/execute {' "$config_file"
+    grep -q '^    location = /api/auth/sign/token {' "$config_file"
+    grep -q '^    location = /api/auth/verify/token {' "$config_file"
+    grep -q '^    location = /logs-web {' "$config_file"
+    grep -q '^    location \^~ /logs-web/ {' "$config_file"
+    if grep -Eq 'proxy_pass .*(:8080|platform-api/execute|auth/(sign|verify)/token)' "$config_file"; then
+        echo "Unexpected high-risk public proxy in $config_file" >&2
+        return 1
+    fi
+}
+
 assert_compose_exposure() {
     local expected_server_host_ip="$1"
+    local expected_proxy_host_ip="$2"
     docker compose config --format json | python3 -c '
 import json, sys
-expected = sys.argv[1]
+expected_server = sys.argv[1]
+expected_proxy = sys.argv[2]
 config = json.load(sys.stdin)
 sandbox_ports = config["services"]["sandbox"].get("ports") or []
 assert sandbox_ports == [], f"sandbox ports published: {sandbox_ports}"
 server_ports = config["services"]["easyai-server"].get("ports") or []
 assert len(server_ports) == 1, server_ports
-assert server_ports[0].get("host_ip") == expected, server_ports
-' "$expected_server_host_ip"
+assert server_ports[0].get("host_ip") == expected_server, server_ports
+for service in ("easyai-web", "ws-gateway", "easyai-asg"):
+    ports = config["services"][service].get("ports") or []
+    assert len(ports) == 1, (service, ports)
+    assert ports[0].get("host_ip") == expected_proxy, (service, ports)
+' "$expected_server_host_ip" "$expected_proxy_host_ip"
 }
 
 assert_canvas_ws_auth_config() {
@@ -92,6 +112,29 @@ assert "ws_ticket" in methods, f"ws-gateway does not advertise ws_ticket: {sorte
 '
 }
 
+assert_compose_security() {
+    docker compose config --format json | python3 -c '
+import json, sys
+config = json.load(sys.stdin)
+services = config["services"]
+
+assert set(services["sandbox"]["networks"]) == {"sandbox-network"}, services["sandbox"]["networks"]
+assert {"easyai", "sandbox-network"}.issubset(services["easyai-server"]["networks"]), services["easyai-server"]["networks"]
+assert services["easyai-server"]["environment"]["GATEWAY_INBOUND_TCP_LISTEN_HOST"] == "172.21.0.6", services["easyai-server"]["environment"]["GATEWAY_INBOUND_TCP_LISTEN_HOST"]
+assert services["mongo"].get("privileged") is not True, services["mongo"].get("privileged")
+
+for service in ("mongo", "rabbitmq", "video-edit", "dozzle", "agent-memory"):
+    for port in services[service].get("ports") or []:
+        assert port.get("host_ip") == "127.0.0.1", (service, port)
+
+watchtower = services["watchtower"]
+command = " ".join(watchtower.get("command") or [])
+assert "http-api-update" not in command, command
+assert "WATCHTOWER_HTTP_API_TOKEN" not in (watchtower.get("environment") or {}), watchtower.get("environment")
+assert services["dozzle"]["environment"]["DOZZLE_ENABLE_DOWNLOAD"] == "false", services["dozzle"]["environment"]
+'
+}
+
 sed -i.bak 's/^SERVER_HTTP_PORT=.*/SERVER_HTTP_PORT=4100/' .env.sample
 rm -f .env.sample.bak
 DEPLOY_NON_INTERACTIVE=1 \
@@ -99,9 +142,29 @@ DEPLOY_NON_INTERACTIVE=1 \
     DEPLOY_ACCESS=ip \
     DEPLOY_IP=10.0.0.8 \
     bash start.sh > "$TMP_DIR/first-install.log"
-grep -qx 'NUXT_PUBLIC_BASE_APIURL=http://10.0.0.8:4100' .env
-grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://10.0.0.8:4100' .env
-grep -qx 'SERVER_HTTP_BIND_IP=0.0.0.0' .env
+grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
+grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=ws://10.0.0.8/socket.io' .env
+grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
+grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://10.0.0.8/api' .env
+grep -qx 'CONFIG_SECURITY_ORIGIN=http://10.0.0.8' .env
+grep -qx 'EASYAI_PROXY_BIND_IP=127.0.0.1' .env
+grep -qx 'EASYAI_INFRA_BIND_IP=127.0.0.1' .env
+grep -qx 'GATEWAY_INBOUND_TCP_LISTEN_HOST=172.21.0.6' .env
+grep -qx 'SERVER_HTTP_BIND_IP=127.0.0.1' .env
+grep -q 'server_name 10.0.0.8;' 10.0.0.8.conf
+if grep -q 'www.10.0.0.8' 10.0.0.8.conf; then
+    echo "IP proxy config must not contain the domain-only www redirect" >&2
+    exit 1
+fi
+grep -q 'proxy_pass http://127.0.0.1:3010/;' 10.0.0.8.conf
+grep -q 'proxy_pass http://127.0.0.1:4100/;' 10.0.0.8.conf
+grep -q 'proxy_pass http://127.0.0.1:3002;' 10.0.0.8.conf
+grep -q 'proxy_pass http://127.0.0.1:3003/;' 10.0.0.8.conf
+grep -q 'location /socket.io {' 10.0.0.8.conf
+assert_compression_config 10.0.0.8.conf
+assert_sandbox_public_access_disabled 10.0.0.8.conf
+assert_high_risk_public_access_disabled 10.0.0.8.conf
+grep -Fq '访问地址: http://10.0.0.8' "$TMP_DIR/first-install.log"
 initial_admin_password="$(awk -F= '$1 == "CONFIG_INITIAL_ADMIN_PASSWORD" { print $2; exit }' .env)"
 [ "${#initial_admin_password}" -ge 12 ] || {
     echo "Initial admin password was not generated" >&2
@@ -122,8 +185,9 @@ if grep -Fq "登录密码: ${initial_admin_password}" "$TMP_DIR/existing-env.log
     exit 1
 fi
 if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
-    assert_compose_exposure 0.0.0.0
+    assert_compose_exposure 127.0.0.1 127.0.0.1
     assert_canvas_ws_auth_config
+    assert_compose_security
 fi
 
 reset_case
@@ -133,7 +197,9 @@ DEPLOY_NON_INTERACTIVE=1 \
     DEPLOY_DOMAIN=demo.example.com \
     DEPLOY_HTTPS=false \
     bash start.sh >/dev/null
+grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
 grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=ws://demo.example.com/socket.io' .env
+grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
 grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://demo.example.com/api' .env
 grep -q 'proxy_set_header X-Forwarded-Host $easyai_forwarded_host;' demo.example.com.conf
 grep -q 'proxy_set_header X-Forwarded-Port $server_port;' demo.example.com.conf
@@ -141,9 +207,14 @@ grep -q "proxy_set_header X-Original-Prefix '/api';" demo.example.com.conf
 grep -q 'location = /api {' demo.example.com.conf
 assert_compression_config demo.example.com.conf
 assert_sandbox_public_access_disabled demo.example.com.conf
+assert_high_risk_public_access_disabled demo.example.com.conf
 grep -qx 'SERVER_HTTP_BIND_IP=127.0.0.1' .env
+grep -qx 'EASYAI_PROXY_BIND_IP=127.0.0.1' .env
+grep -qx 'EASYAI_INFRA_BIND_IP=127.0.0.1' .env
+grep -qx 'GATEWAY_INBOUND_TCP_LISTEN_HOST=172.21.0.6' .env
 if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
-    assert_compose_exposure 127.0.0.1
+    assert_compose_exposure 127.0.0.1 127.0.0.1
+    assert_compose_security
 fi
 
 # 直接验证 https.sh 的缺省配置生成函数会采用完整模板，而不是只代理 3010。
@@ -161,6 +232,7 @@ grep -q 'location /socket.io {' easyai-proxy.conf
 grep -q 'proxy_set_header X-Forwarded-Host $easyai_forwarded_host;' easyai-proxy.conf
 assert_compression_config easyai-proxy.conf
 assert_sandbox_public_access_disabled easyai-proxy.conf
+assert_high_risk_public_access_disabled easyai-proxy.conf
 
 reset_case
 DEPLOY_NON_INTERACTIVE=1 \
@@ -169,7 +241,9 @@ DEPLOY_NON_INTERACTIVE=1 \
     DEPLOY_DOMAIN=demo.example.com \
     DEPLOY_HTTPS=true \
     bash start.sh >/dev/null
+grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
 grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=wss://demo.example.com/socket.io' .env
+grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
 grep -qx 'CONFIG_PUBLIC_API_BASE_URL=https://demo.example.com/api' .env
 
 reset_case
diff --git a/start.ps1 b/start.ps1
index ad05e9c..7984cf8 100644
--- a/start.ps1
+++ b/start.ps1
@@ -175,6 +175,8 @@ function Setup-EnvFiles {
     $content = Upsert-Env $content "NUXT_PUBLIC_SG_APIURL" "http://$($script:DeployIP):3003"
     $serverBindIp = if ($script:DeployIP -eq "127.0.0.1" -or $script:DeployIP -eq "localhost") { "127.0.0.1" } else { "0.0.0.0" }
     $content = Upsert-Env $content "SERVER_HTTP_BIND_IP" $serverBindIp
+    # Windows 当前仍使用 Docker Desktop 直连端口；显式覆盖 Linux Nginx 模式的回环默认值。
+    $content = Upsert-Env $content "EASYAI_PROXY_BIND_IP" $serverBindIp
     $webPortMatch = [regex]::Match($content, '(?m)^WEB_PORT=(\d+)$')
     $webPort = if ($webPortMatch.Success) { $webPortMatch.Groups[1].Value } else { "3010" }
     $content = Upsert-Env $content "CONFIG_SECURITY_ORIGIN" "http://$($script:DeployIP):$webPort"
diff --git a/start.sh b/start.sh
index 6a7e304..c6c85ac 100755
--- a/start.sh
+++ b/start.sh
@@ -31,6 +31,7 @@ DEPLOY_HTTPS_ENV="${DEPLOY_HTTPS_INPUT:-${DEPLOY_HTTPS:-}}"
 DEPLOY_HTTPS=false
 SECURITY_ENV_MODE="upgrade"
 PUBLIC_API_BASE_URL_CANDIDATE=""
+PROXY_CONF=""
 
 is_non_interactive() {
     [ "${DEPLOY_NON_INTERACTIVE:-0}" = "1" ] || [ "${CI:-}" = "true" ] || [ ! -t 0 ]
@@ -58,6 +59,17 @@ normalize_bool() {
     esac
 }
 
+upsert_env_value() {
+    local file=$1
+    local key=$2
+    local value=$3
+    if grep -q "^${key}=" "$file"; then
+        sed -i.bak "s|^${key}=.*|${key}=${value}|" "$file"
+    else
+        printf '\n%s=%s\n' "$key" "$value" >> "$file"
+    fi
+}
+
 set_deploy_https_from_env_or_default() {
     local normalized
     if ! normalized="$(normalize_bool "${DEPLOY_HTTPS_ENV:-false}")"; then
@@ -162,7 +174,7 @@ run_deploy_questions() {
     if [ -z "$DEPLOY_ACCESS" ]; then
         require_interactive "DEPLOY_ACCESS=ip DEPLOY_IP=<服务器IP> 或 DEPLOY_ACCESS=domain DEPLOY_DOMAIN=<域名>"
         echo "1. 通过 IP 地址还是域名访问？"
-        echo "   [1] IP 地址（需开放 3001、3002、3003 端口）"
+        echo "   [1] IP 地址（仅需开放 80 端口，由 Nginx 统一反向代理）"
         echo "   [2] 域名"
         read -r -p "请选择 [1/2]: " choice
         case "$choice" in
@@ -181,7 +193,7 @@ run_deploy_questions() {
             echo "❌ IP 不能为空"
             exit 1
         fi
-        echo "   请确保防火墙已放行 3001、3002、3003 端口"
+        echo "   请确保防火墙已放行 80 端口"
     else
         # 3. 输入域名
         prompt_or_env DEPLOY_DOMAIN "3. 请输入域名（不含 https:// 前缀，如 51easyai.com）" "DEPLOY_DOMAIN" ""
@@ -238,34 +250,63 @@ setup_env_files() {
         SECURITY_ENV_MODE="new"
     fi
 
-    local web_port server_port public_scheme socket_scheme
+    local web_port server_port ws_port asg_port public_scheme socket_scheme public_host security_origins
     web_port="$(awk -F= '$1 == "WEB_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
     web_port="${web_port:-3010}"
     server_port="$(awk -F= '$1 == "SERVER_HTTP_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
     server_port="${server_port:-3001}"
+    ws_port="$(awk -F= '$1 == "CONFIG_WS_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
+    ws_port="${ws_port:-3002}"
+    asg_port="$(awk -F= '$1 == "ASG_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
+    asg_port="${asg_port:-3003}"
 
+    public_scheme="http"
+    socket_scheme="ws"
     if [ "$DEPLOY_MODE" = "ip" ]; then
-        # IP 模式
-        sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=http://${DEPLOY_IP}:${server_port}|" .env
-        sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=ws://${DEPLOY_IP}:3002|" .env
-        sed -i.bak "s|^NUXT_PUBLIC_SG_APIURL=.*|NUXT_PUBLIC_SG_APIURL=http://${DEPLOY_IP}:3003|" .env
-        sed -i.bak "s|^CONFIG_SECURITY_ORIGIN=.*|CONFIG_SECURITY_ORIGIN=http://${DEPLOY_IP}:${web_port}|" .env
-        PUBLIC_API_BASE_URL_CANDIDATE="${DEPLOY_PUBLIC_API_BASE_URL:-http://${DEPLOY_IP}:${server_port}}"
-        echo "   ✓ .env 已配置为 IP 模式 (${DEPLOY_IP})"
+        public_host="$DEPLOY_IP"
+        security_origins="http://${DEPLOY_IP}"
     else
-        # 域名模式
-        public_scheme="http"
-        socket_scheme="ws"
+        public_host="$DEPLOY_DOMAIN"
+        security_origins="https://${DEPLOY_DOMAIN},http://${DEPLOY_DOMAIN}"
         if [ "$DEPLOY_HTTPS" = true ]; then
             public_scheme="https"
             socket_scheme="wss"
         fi
-        sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=/api|" .env
-        sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=${socket_scheme}://${DEPLOY_DOMAIN}/socket.io|" .env
-        sed -i.bak "s|^NUXT_PUBLIC_SG_APIURL=.*|NUXT_PUBLIC_SG_APIURL=/asg-api|" .env
-        # 域名模式同时允许同域 HTTP/HTTPS，兼容首次签证书和复用既有证书两种流程。
-        sed -i.bak "s|^CONFIG_SECURITY_ORIGIN=.*|CONFIG_SECURITY_ORIGIN=https://${DEPLOY_DOMAIN},http://${DEPLOY_DOMAIN}|" .env
-        PUBLIC_API_BASE_URL_CANDIDATE="${DEPLOY_PUBLIC_API_BASE_URL:-${public_scheme}://${DEPLOY_DOMAIN}/api}"
+    fi
+
+    # IP 与域名模式共用同一组 Nginx 路径，只由公开 origin 决定 Host 与协议。
+    upsert_env_value .env NUXT_PUBLIC_BASE_APIURL "/api"
+    upsert_env_value .env NUXT_PUBLIC_BASE_SOCKETURL "${socket_scheme}://${public_host}/socket.io"
+    upsert_env_value .env NUXT_PUBLIC_SG_APIURL "/asg-api"
+    upsert_env_value .env CONFIG_SECURITY_ORIGIN "$security_origins"
+    upsert_env_value .env EASYAI_PROXY_BIND_IP "127.0.0.1"
+    upsert_env_value .env EASYAI_INFRA_BIND_IP "127.0.0.1"
+    upsert_env_value .env GATEWAY_INBOUND_TCP_LISTEN_HOST "172.21.0.6"
+    PUBLIC_API_BASE_URL_CANDIDATE="${DEPLOY_PUBLIC_API_BASE_URL:-${public_scheme}://${public_host}/api}"
+
+    if [ "$DEPLOY_MODE" = "ip" ]; then
+        echo "   ✓ .env 已配置为 IP + Nginx 模式 (${DEPLOY_IP})"
+
+        # 生成包含前端、API、WebSocket 与 ASG 的完整 IP 代理配置。
+        PROXY_CONF="${DEPLOY_IP}.conf"
+        if [ ! -f "$PROXY_CONF" ]; then
+            local proxy_template="easyai-proxy.conf.sample"
+            if [ ! -f "$proxy_template" ]; then
+                echo "❌ 未找到 Nginx 配置模板: easyai-proxy.conf.sample"
+                echo "   请确认仓库文件完整后重试"
+                exit 1
+            fi
+            sed \
+                -e '/^# EASYAI_WWW_REDIRECT_BEGIN$/,/^# EASYAI_WWW_REDIRECT_END$/d' \
+                -e "s/51easyai\.com/${DEPLOY_IP}/g" \
+                -e "s|127\.0\.0\.1:3010|127.0.0.1:${web_port}|g" \
+                -e "s|127\.0\.0\.1:3001|127.0.0.1:${server_port}|g" \
+                -e "s|127\.0\.0\.1:3002|127.0.0.1:${ws_port}|g" \
+                -e "s|127\.0\.0\.1:3003|127.0.0.1:${asg_port}|g" \
+                "$proxy_template" > "$PROXY_CONF"
+            echo "   ✓ Nginx IP 配置已生成: $PROXY_CONF"
+        fi
+    else
         echo "   ✓ .env 已配置为域名模式 (${DEPLOY_DOMAIN})"
 
         # 7. Nginx 配置（域名模式）
@@ -277,7 +318,13 @@ setup_env_files() {
                 echo "   请确认仓库文件完整后重试"
                 exit 1
             fi
-            sed "s/51easyai.com/${DEPLOY_DOMAIN}/g" "$proxy_template" > "$PROXY_CONF"
+            sed \
+                -e "s/51easyai\.com/${DEPLOY_DOMAIN}/g" \
+                -e "s|127\.0\.0\.1:3010|127.0.0.1:${web_port}|g" \
+                -e "s|127\.0\.0\.1:3001|127.0.0.1:${server_port}|g" \
+                -e "s|127\.0\.0\.1:3002|127.0.0.1:${ws_port}|g" \
+                -e "s|127\.0\.0\.1:3003|127.0.0.1:${asg_port}|g" \
+                "$proxy_template" > "$PROXY_CONF"
             echo "   ✓ Nginx 配置已生成: $PROXY_CONF"
         fi
     fi
@@ -430,6 +477,72 @@ install_docker() {
     fi
 }
 
+# ==================== 配置 HTTP Nginx 入口 ====================
+configure_http_nginx_proxy() {
+    case "$DEPLOY_MODE" in
+        ip|domain) ;;
+        *) return 0 ;;
+    esac
+    # HTTPS 域名由 https.sh 安装配置并签发证书；IP 与纯 HTTP 域名走这里。
+    if [ "$DEPLOY_MODE" = "domain" ] && [ "$DEPLOY_HTTPS" = true ]; then
+        return 0
+    fi
+    if [ -z "$PROXY_CONF" ] || [ ! -f "$PROXY_CONF" ]; then
+        echo "❌ 缺少 Nginx 配置文件: ${PROXY_CONF:-未生成}"
+        return 1
+    fi
+
+    echo ""
+    echo "🌐 配置 Nginx 统一入口（HTTP 80）..."
+    if ! command -v nginx &>/dev/null; then
+        if command -v apt-get &>/dev/null; then
+            sudo apt-get update -y
+            sudo apt-get install -y nginx
+        elif command -v dnf &>/dev/null; then
+            sudo dnf install -y nginx
+        elif command -v yum &>/dev/null; then
+            sudo yum install -y nginx
+        else
+            echo "❌ 未找到受支持的 Nginx 包管理器（apt-get/dnf/yum）"
+            return 1
+        fi
+    fi
+
+    local nginx_conf_dir="/etc/nginx/conf.d"
+    local nginx_target="${nginx_conf_dir}/easyai-proxy.conf"
+    local nginx_backup=""
+    sudo install -d -m 0755 "$nginx_conf_dir"
+    if sudo test -f "$nginx_target"; then
+        nginx_backup="${nginx_target}.pre-ip-proxy-$(date +%Y%m%dT%H%M%S)"
+        sudo cp -a "$nginx_target" "$nginx_backup"
+        echo "   ✓ 已备份现有配置: $nginx_backup"
+    fi
+    sudo install -m 0644 "$PROXY_CONF" "$nginx_target"
+
+    if ! sudo nginx -t; then
+        echo "❌ Nginx 配置校验失败，正在恢复原配置"
+        if [ -n "$nginx_backup" ]; then
+            sudo cp -a "$nginx_backup" "$nginx_target"
+        else
+            sudo rm -f "$nginx_target"
+        fi
+        sudo nginx -t || true
+        return 1
+    fi
+
+    if command -v systemctl &>/dev/null; then
+        sudo systemctl enable nginx >/dev/null
+        if sudo systemctl is-active --quiet nginx; then
+            sudo systemctl reload nginx
+        else
+            sudo systemctl start nginx
+        fi
+    else
+        sudo nginx -s reload 2>/dev/null || sudo nginx
+    fi
+    echo "   ✓ Nginx 已监听 80，统一代理前端、API、WebSocket 与 ASG"
+}
+
 # ==================== 启动服务 ====================
 start_services() {
     echo ""
@@ -521,17 +634,14 @@ main() {
         fi
     fi
 
-    # 域名和本机部署默认仅绑定回环；只有明确的 IP/LAN 直连模式才开放后端宿主机端口。
+    # Linux 的 IP/域名模式都经由同机 Nginx 代理，后端宿主机端口保持回环绑定。
     # shellcheck source=scripts/init-server-http-bind-ip.sh
     . ./scripts/init-server-http-bind-ip.sh
     local server_bind_override=""
     if [ "$DEPLOY_MODE" = "domain" ]; then
         server_bind_override="127.0.0.1"
     elif [ "$DEPLOY_MODE" = "ip" ]; then
-        case "$DEPLOY_IP" in
-            127.0.0.1|localhost) server_bind_override="127.0.0.1" ;;
-            *) server_bind_override="0.0.0.0" ;;
-        esac
+        server_bind_override="127.0.0.1"
     fi
     init_server_http_bind_ip .env "$server_bind_override"
 
@@ -557,6 +667,7 @@ main() {
     else
         install_docker
         start_services
+        configure_http_nginx_proxy
         export DEPLOY_DOMAIN
         run_https_setup
     fi
@@ -566,12 +677,12 @@ main() {
     echo "  部署完成"
     echo "================================"
     if [ "$DEPLOY_MODE" = "ip" ] && [ -n "$DEPLOY_IP" ]; then
-        echo "访问地址: http://${DEPLOY_IP}:3010"
+        echo "访问地址: http://${DEPLOY_IP}"
     elif [ "$DEPLOY_MODE" = "domain" ] && [ -n "$DEPLOY_DOMAIN" ]; then
         if [ "$DEPLOY_HTTPS" = true ]; then
             echo "访问地址: https://${DEPLOY_DOMAIN}"
         else
-            echo "访问地址: http://${DEPLOY_DOMAIN} (配置 Nginx 后)"
+            echo "访问地址: http://${DEPLOY_DOMAIN}"
         fi
         if [ "$DEPLOY_HTTPS" = true ]; then
             echo "HTTPS 已启用"