diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index bc8a4ee..49bd6e0 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -16,7 +16,7 @@ jobs:
       SOURCE_REPOSITORY: ${{ gitea.repository }}
       SOURCE_REVISION: ${{ gitea.sha }}
       DEPLOY_PORT: ${{ vars.DEPLOY_PORT || '3000' }}
-      API_BASE_URL: ${{ vars.API_BASE_URL || 'http://47.83.180.156:18082' }}
+      API_BASE_URL: ${{ vars.API_BASE_URL }}
     steps:
       - name: Fetch exact revision
         env: { SOURCE_TOKEN: "${{ secrets.GITEA_TOKEN || gitea.token }}" }
@@ -41,8 +41,9 @@ jobs:
         if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
         run: |
           set -eu
+          docker network inspect pk-lab-public >/dev/null 2>&1 || docker network create pk-lab-public
           docker rm -f pk-lab-xhs-preview 2>/dev/null || true
-          docker run -d --name pk-lab-xhs-preview --restart unless-stopped --read-only --tmpfs /tmp --tmpfs /var/cache/nginx --tmpfs /var/run -e API_BASE_URL="$API_BASE_URL" -p "$DEPLOY_PORT:8080" "pk-lab-xhs:$SOURCE_REVISION"
+          docker run -d --name pk-lab-xhs-preview --restart unless-stopped --network pk-lab-public --read-only --tmpfs /tmp --tmpfs /var/cache/nginx --tmpfs /var/run -e API_BASE_URL="$API_BASE_URL" -p "$DEPLOY_PORT:8080" "pk-lab-xhs:$SOURCE_REVISION"
           for i in 1 2 3 4 5 6 7 8 9 10; do
             status="$(docker inspect --format '{{.State.Health.Status}}' pk-lab-xhs-preview)"
             [ "$status" = healthy ] && exit 0
diff --git a/Dockerfile b/Dockerfile
index 62e0033..dcea66c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 FROM nginx:1.27-alpine
 COPY web /usr/share/nginx/html
-RUN printf 'server { listen 8080; server_name _; root /usr/share/nginx/html; location = /runtime-env.js { alias /tmp/runtime-env.js; } location / { try_files $uri $uri/ /index.html; } location = /health { access_log off; return 200 "ok\\n"; add_header Content-Type text/plain; } }' > /etc/nginx/conf.d/default.conf
+COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 8080
 HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=5 CMD wget -q -O- http://127.0.0.1:8080/health || exit 1
 CMD ["/bin/sh", "-c", "envsubst '$API_BASE_URL' < /usr/share/nginx/html/runtime-env.js > /tmp/runtime-env.js && exec nginx -g 'daemon off;'"]
diff --git a/README.md b/README.md
index c3b9832..7d04585 100644
--- a/README.md
+++ b/README.md
@@ -9,4 +9,4 @@
 3. 用小红书开发者工具打开仓库根目录，绑定综合版 App ID。
 4. 后端配置同一 App ID/Secret 后重新部署。
 
-CI 默认把公网预览持续部署到宿主机 `3000` 端口；配置变量 `DEPLOY_PORT` 可覆盖，`API_BASE_URL` 指向后端。预览使用后端显式开启的 `TEST_AUTH_ENABLED` 测试身份，正式小程序使用 `xhs.login()`。
+CI 默认把公网预览持续部署到宿主机 `3000` 端口，并加入 `pk-lab-public` Docker 网络。浏览器同源请求 `/api`，Nginx 转发给网络内的 `pk-lab-api:8000`，不需要写死服务器 IP，也不需要暴露后端端口。只有跨域或独立 API 域名部署时才需配置可选变量 `API_BASE_URL`。预览使用后端显式开启的 `TEST_AUTH_ENABLED` 测试身份，正式小程序使用 `xhs.login()`。
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..2683f53
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,31 @@
+server {
+    listen 8080;
+    server_name _;
+    root /usr/share/nginx/html;
+
+    location = /runtime-env.js {
+        alias /tmp/runtime-env.js;
+        add_header Cache-Control "no-store";
+    }
+
+    location /api/ {
+        resolver 127.0.0.11 valid=10s ipv6=off;
+        set $api_upstream http://pk-lab-api:8000;
+        proxy_pass $api_upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location = /health {
+        access_log off;
+        return 200 "ok\n";
+        add_header Content-Type text/plain;
+    }
+}