diff --git a/.dockerignore b/.dockerignore
index 7e770bc..b57aa85 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,7 +1,10 @@
 .env
 .git
-library/
 .superpowers/
+deploy/logs/
+deploy/nginx/
+deploy/redis/
+deploy/api/storage/
 backend/booklib*
 web/node_modules
 web/dist
diff --git a/.env.example b/.env.example
deleted file mode 100644
index 95ccbac..0000000
--- a/.env.example
+++ /dev/null
@@ -1,4 +0,0 @@
-JWT_SECRET=change-me-openssl-rand-hex-32
-ADMIN_USER=admin
-ADMIN_PASSWORD=change-me-min-8
-SCAN_INTERVAL_SEC=60
diff --git a/.gitignore b/.gitignore
index 1a2c612..b297d3c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,8 @@
 .env
-library/
 .superpowers/
 backend/server
+deploy/nginx/
+deploy/redis/redis.conf
+deploy/logs/
+deploy/api/storage/*
+!deploy/api/storage/.gitkeep
diff --git a/deploy/.env.example b/deploy/.env.example
new file mode 100644
index 0000000..2433e04
--- /dev/null
+++ b/deploy/.env.example
@@ -0,0 +1,11 @@
+JWT_SECRET=change-me-openssl-rand-hex-32
+ADMIN_USER=admin
+ADMIN_PASSWORD=change-me-min-8
+SCAN_INTERVAL_SEC=60
+
+# ---- 部署参数(deploy/prepare.sh 渲染模板 / compose 插值用) ----
+WEB_PORT=8080
+NGINX_CLIENT_MAX_BODY_SIZE=200m
+REDIS_MAXMEMORY=128mb
+REDIS_MAXMEMORY_POLICY=allkeys-lru
+DELVE_PORT=2345
diff --git a/deploy/api/storage/.gitkeep b/deploy/api/storage/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/deploy/prepare.sh b/deploy/prepare.sh
new file mode 100755
index 0000000..593ddaa
--- /dev/null
+++ b/deploy/prepare.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# 渲染 deploy/templates/*.tpl → deploy/nginx、deploy/redis,并创建运行所需目录。
+# 约定:每次 up 之前(或改模板/.env 后)必须重跑本脚本。幂等,可反复执行。
+set -eu
+cd "$(dirname "$0")"
+
+if [ -f .env ]; then
+  set -a; . ./.env; set +a
+fi
+
+NGINX_CLIENT_MAX_BODY_SIZE=${NGINX_CLIENT_MAX_BODY_SIZE:-200m}
+REDIS_MAXMEMORY=${REDIS_MAXMEMORY:-128mb}
+REDIS_MAXMEMORY_POLICY=${REDIS_MAXMEMORY_POLICY:-allkeys-lru}
+
+for t in templates/nginx.conf.tpl templates/default.conf.tpl templates/redis.conf.tpl; do
+  [ -f "$t" ] || { echo "prepare.sh: missing template $t" >&2; exit 1; }
+done
+
+mkdir -p nginx/conf.d redis logs/nginx api/storage
+
+sed -e "s|{{NGINX_CLIENT_MAX_BODY_SIZE}}|${NGINX_CLIENT_MAX_BODY_SIZE}|g" \
+  templates/nginx.conf.tpl > nginx/nginx.conf
+sed -e "s|{{NGINX_CLIENT_MAX_BODY_SIZE}}|${NGINX_CLIENT_MAX_BODY_SIZE}|g" \
+  templates/default.conf.tpl > nginx/conf.d/default.conf
+sed -e "s|{{REDIS_MAXMEMORY}}|${REDIS_MAXMEMORY}|g" \
+  -e "s|{{REDIS_MAXMEMORY_POLICY}}|${REDIS_MAXMEMORY_POLICY}|g" \
+  templates/redis.conf.tpl > redis/redis.conf
+
+echo "prepare.sh: rendered nginx($(pwd)/nginx), redis($(pwd)/redis), logs($(pwd)/logs/nginx), storage($(pwd)/api/storage)"
diff --git a/deploy/templates/default.conf.tpl b/deploy/templates/default.conf.tpl
new file mode 100644
index 0000000..c22c5d5
--- /dev/null
+++ b/deploy/templates/default.conf.tpl
@@ -0,0 +1,23 @@
+server {
+  listen 80;
+  client_max_body_size {{NGINX_CLIENT_MAX_BODY_SIZE}};
+  # 地址为占位默认值(127.0.0.11=Docker 内嵌 DNS);容器 entrypoint 启动时会按
+  # /etc/resolv.conf 的首个 nameserver 重写本行,兼容 podman aardvark-dns。
+  resolver 127.0.0.11 valid=10s;
+
+  # spec §7 风险接受所假设的 CSP:全部同源,blob:/data: 供 SW/reader 用
+  add_header Content-Security-Policy "default-src 'self'; img-src 'self' blob: data:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' blob: data:; object-src 'none'; frame-src 'self' blob:" always;
+
+  location /api/ {
+    set $api_upstream http://api:8080;   # 变量式 → 每次按 DNS 解析,scale 后轮询到新副本(spec §11)
+    proxy_pass $api_upstream;            # 无 URI 部分:保留 /api 前缀转发
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+
+  location / {
+    root /usr/share/nginx/html;
+    try_files $uri /index.html;
+  }
+}
diff --git a/deploy/templates/nginx.conf.tpl b/deploy/templates/nginx.conf.tpl
new file mode 100644
index 0000000..fed2474
--- /dev/null
+++ b/deploy/templates/nginx.conf.tpl
@@ -0,0 +1,24 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    access_log  /var/log/nginx/access.log;
+
+    sendfile        on;
+    keepalive_timeout  65;
+
+    gzip  on;
+    gzip_types text/css application/javascript application/json image/svg+xml;
+
+    include /etc/nginx/conf.d/*.conf;
+}
diff --git a/deploy/templates/redis.conf.tpl b/deploy/templates/redis.conf.tpl
new file mode 100644
index 0000000..d91fa80
--- /dev/null
+++ b/deploy/templates/redis.conf.tpl
@@ -0,0 +1,4 @@
+# booklib redis 配置 — 由 deploy/prepare.sh 从 templates/redis.conf.tpl 渲染,勿直接编辑产物
+maxmemory {{REDIS_MAXMEMORY}}
+maxmemory-policy {{REDIS_MAXMEMORY_POLICY}}
+dir /data
diff --git a/scripts/smoke-web.sh b/scripts/smoke-web.sh
index 0250535..f884af0 100755
--- a/scripts/smoke-web.sh
+++ b/scripts/smoke-web.sh
@@ -3,7 +3,10 @@
 # 前提:.env 里有 JWT_SECRET/ADMIN_USER/ADMIN_PASSWORD;宿主 :8080 空闲。
 set -euo pipefail
 BASE=${BASE:-http://localhost:8080}
-[ -f .env ] && set -a && . ./.env && set +a
+ENV_FILE=${ENV_FILE:-deploy/.env}
+[ -f "$ENV_FILE" ] || ENV_FILE=.env
+[ -f "$ENV_FILE" ] && set -a && . "./$ENV_FILE" && set +a
+export COMPOSE_FILE=${COMPOSE_FILE:-deploy/docker-compose.yml}
 : "${JWT_SECRET:?JWT_SECRET 未设置}"; : "${ADMIN_USER:?ADMIN_USER 未设置}"; : "${ADMIN_PASSWORD:?ADMIN_PASSWORD 未设置}"
 
 say(){ echo "smoke-web: $1"; }
diff --git a/scripts/smoke.sh b/scripts/smoke.sh
index 9989064..f7e9e35 100755
--- a/scripts/smoke.sh
+++ b/scripts/smoke.sh
@@ -3,7 +3,9 @@ set -euo pipefail
 BASE=${BASE:-http://localhost:8080}
 API=$BASE/api
 J=(-H 'content-type: application/json')
-[ -f .env ] && set -a && . ./.env && set +a
+ENV_FILE=${ENV_FILE:-deploy/.env}
+[ -f "$ENV_FILE" ] || ENV_FILE=.env
+[ -f "$ENV_FILE" ] && set -a && . "./$ENV_FILE" && set +a
 WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
 
 say(){ echo "smoke: $1"; }
@@ -25,7 +27,7 @@ code=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$API/users" "${J[@]}" -H
 [ "$code" = 403 ] || die "member write not blocked ($code)"
 
 say "library + bad-ext upload rejected + good upload + scan"
-mkdir -p library/smoke-books
+mkdir -p deploy/api/storage/smoke-books
 LID=$(curl -fsS "$API/libraries" "${J[@]}" -H "$AUTH" -d '{"name":"smoke","root_path":"/data/books/smoke-books"}' | sed -E 's/.*"id":([0-9]+).*/\1/')
 printf 'x' > "$WORK/f"
 curl -fsS -o /dev/null "$API/libraries/$LID/upload" -H "$AUTH" -F "file=@$WORK/f;filename=virus.exe" && die "bad ext upload must fail" || true
@@ -52,6 +54,6 @@ curl -fsS -o /dev/null -D - "$BASE$COVER" -H "$AUTH" | grep -qi 'cache-control:.
 
 say "delete book → file gone from host dir"
 curl -fsS -o /dev/null -X DELETE "$API/books/$BID" -H "$AUTH" || die "delete"
-[ ! -f library/smoke-books/note.txt ] || die "file survived delete"
+[ ! -f deploy/api/storage/smoke-books/note.txt ] || die "file survived delete"
 
 say "ALL SMOKE TESTS PASSED"