diff --git a/.gitignore b/.gitignore
index 20e3370..3b1f96a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,6 +35,10 @@ serverdata/redis-data/
 serverdata/emqx-data/
 serverdata/emqx-log/
 data/users.json
+
+# nginx 部署目录：私钥与运行日志绝不入库；仅提交 conf 配置（证书链可选）
+nginx/nginx/ssl/*.key
+nginx/nginx/logs/
 data/tokens.json
 data/agents.json
 
diff --git a/nginx/nginx/conf.d/opc.pinesound.cn.conf b/nginx/nginx/conf.d/opc.pinesound.cn.conf
new file mode 100644
index 0000000..930bfd0
--- /dev/null
+++ b/nginx/nginx/conf.d/opc.pinesound.cn.conf
@@ -0,0 +1,56 @@
+# ============================================================
+# opc.pinesound.cn 反向代理 —— Docker 内网容器名反代
+#
+# 拓扑：
+#   公网 → nginx(80/443) → opc-server:8090（唯一对外入口，dispatcher）
+#         → /park、/api/*、/im/ws 等均由 opc-server 内部路由
+#
+# 前提（关键）：
+#   1. nginx 容器必须加入业务网络，才能解析容器名：
+#        docker network connect opc-network nginx
+#      （若 nginx 由 compose 管理，则在 nginx 服务下声明 networks: [opc-network]）
+#   2. 禁止再用公网 IP/宿主机回环反代（此前 47.108.226.213:8090 为已废弃旧服务器，
+#      请求连到错误主机导致 502 upstream prematurely closed）。
+# ============================================================
+
+server {
+    listen 80;
+    server_name opc.pinesound.cn;
+
+    # HTTP 强制跳转 HTTPS
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name opc.pinesound.cn;
+
+    ssl_certificate     /data/nginx/ssl/opc.pinesound.cn_bundle.crt;
+    ssl_certificate_key /data/nginx/ssl/opc.pinesound.cn.key;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    client_max_body_size 100m;
+
+    access_log /var/log/nginx/opc.pinesound.cn.access.log;
+    error_log  /var/log/nginx/opc.pinesound.cn.error.log;
+
+    location / {
+        # 容器名反代：opc-server 与 nginx 同属 opc-network
+        proxy_pass http://opc-server:8090;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket（/im/ws 等）长连接支持
+        proxy_set_header Upgrade           $http_upgrade;
+        proxy_set_header Connection        "upgrade";
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_connect_timeout 10s;
+    }
+}