diff --git a/docker-compose.yml b/docker-compose.yml
index a118678..a6a2841 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,14 +1,8 @@
 # AI Knowledge Link — Docker Compose (生产)
 #
-# 用法：
-#   1. 把代码上传到服务器
-#   2. cp .env.example .env && 修改 SECRET_KEY
-#   3. docker compose up -d --build
-#   4. docker compose exec backend alembic upgrade head  (首次)
-#   5. 访问 http://服务器IP
+# 用宝塔 Nginx 反代，不启动容器内 Nginx
 #
-# 更新部署：
-#   git pull && docker compose up -d --build
+# 更新：git pull && bash update.sh
 
 services:
   # ---------- MySQL ----------
@@ -23,17 +17,11 @@ services:
     command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
     volumes:
       - mysql_data:/var/lib/mysql
-    # 不暴露端口到宿主机，backend 通过 Docker 内部网络连接
-    # 如需外部访问（Navicat），取消下面注释：
-    # ports:
-    #   - "33306:3306"
-    healthcheck:
-      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+    dns:
+      - 223.5.5.5
+      - 223.6.6.6
 
-  # ---------- 后端 ----------
+  # ---------- 后端（暴露 8000 给宝塔 Nginx 反代）----------
   backend:
     build:
       context: ./backend
@@ -44,7 +32,7 @@ services:
     environment:
       ENVIRONMENT: production
       SECRET_KEY: ${SECRET_KEY:-change-me-to-a-real-secret-key}
-      DATABASE_URL: mysql+pymysql://amb:${MYSQL_PASSWORD:-Lzcc6-01}@mysql:3306/amb_rag?charset=utf8mb4  # 容器内用 3306，外部访问用 33306
+      DATABASE_URL: mysql+pymysql://amb:${MYSQL_PASSWORD:-Lzcc6-01}@mysql:3306/amb_rag?charset=utf8mb4
       STORAGE_ROOT: /app/data
       DEFAULT_STORAGE_QUOTA: "104857600"
       DEFAULT_MAX_FILE_SIZE: "20971520"
@@ -53,8 +41,8 @@ services:
       FRONTEND_ORIGIN: http://localhost
     volumes:
       - app_data:/app/data
-    expose:
-      - "8000"
+    ports:
+      - "8000:8000"
     depends_on:
       mysql:
         condition: service_healthy
@@ -64,7 +52,9 @@ services:
       timeout: 5s
       retries: 5
 
-  # ---------- 前端 ----------
+  # ---------- 前端（构建后由宝塔 Nginx 直接 serve 静态文件）----------
+  # 不需要运行容器，构建完把 dist 目录复制到服务器即可
+  # 或者用下面的容器暴露 5173 端口
   frontend:
     build:
       context: ./frontend
@@ -72,22 +62,8 @@ services:
     dns:
       - 223.5.5.5
       - 223.6.6.6
-    expose:
-      - "80"
-
-  # ---------- Nginx ----------
-  nginx:
-    image: nginx:1.27-alpine
-    restart: unless-stopped
     ports:
-      - "80:80"
-    volumes:
-      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
-    depends_on:
-      backend:
-        condition: service_healthy
-      frontend:
-        condition: service_started
+      - "5173:80"
 
 volumes:
   mysql_data: