diff --git a/conf.d/assets-ai.conf b/conf.d/assets-ai.conf
index ae0fb06..448c59e 100644
--- a/conf.d/assets-ai.conf
+++ b/conf.d/assets-ai.conf
@@ -5,10 +5,18 @@ server {
     ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
 
+    location /_next/static/ {
+        proxy_pass http://assets-ai:3000;
+        proxy_set_header Host $host;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
     location / {
         proxy_pass http://assets-ai:3000;
         proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto https;
     }
 }
diff --git a/conf.d/cloud-ai.conf b/conf.d/cloud-ai.conf
index f4c9bf8..f3d74c3 100644
--- a/conf.d/cloud-ai.conf
+++ b/conf.d/cloud-ai.conf
@@ -2,11 +2,13 @@ server {
     listen 443 ssl;
     server_name cloud.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     location / {
-        proxy_pass http://cloud-ai;
+        resolver 127.0.0.11 valid=30s;
+        set $upstream cloud-ai;
+        proxy_pass http://$upstream;
         proxy_set_header Host $host;
     }
 }
diff --git a/conf.d/issue-ai.conf b/conf.d/issue-ai.conf
index 8392ff4..e2c9023 100644
--- a/conf.d/issue-ai.conf
+++ b/conf.d/issue-ai.conf
@@ -5,10 +5,19 @@ server {
     ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
 
+    location /_next/static/ {
+        proxy_pass http://issue-ai:3000;
+        proxy_set_header Host $host;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
     location / {
         proxy_pass http://issue-ai:3000;
         proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto https;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
     }
 }
diff --git a/conf.d/monitor-ai.conf b/conf.d/monitor-ai.conf
new file mode 100644
index 0000000..c86ae7a
--- /dev/null
+++ b/conf.d/monitor-ai.conf
@@ -0,0 +1,28 @@
+server {
+    listen 443 ssl;
+    server_name monitor.tlyq.ai;
+
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
+
+    location /_next/static/ {
+        resolver 127.0.0.11 valid=30s;
+        set $upstream monitor-ai:3000;
+        proxy_pass http://$upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto https;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    location / {
+        resolver 127.0.0.11 valid=30s;
+        set $upstream monitor-ai:3000;
+        proxy_pass http://$upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto https;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+    }
+}
diff --git a/conf.d/sso-ai.conf b/conf.d/sso-ai.conf
index d4b367d..0ac91f3 100644
--- a/conf.d/sso-ai.conf
+++ b/conf.d/sso-ai.conf
@@ -2,11 +2,14 @@ server {
     listen 443 ssl;
     server_name sso.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai-0001/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai-0001/privkey.pem;
 
     location / {
-        proxy_pass http://authelia:9091;
+        resolver 127.0.0.11 valid=30s;
+        set $upstream authelia:9091;
+        proxy_pass https://$upstream;
+        proxy_ssl_verify off;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
diff --git a/conf.d/token-ai.conf b/conf.d/token-ai.conf
index ed0129e..1e0f317 100644
--- a/conf.d/token-ai.conf
+++ b/conf.d/token-ai.conf
@@ -2,11 +2,13 @@ server {
     listen 443 ssl;
     server_name token.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     location / {
-        proxy_pass http://token-ai;
+        resolver 127.0.0.11 valid=30s;
+        set $upstream token-ai;
+        proxy_pass http://$upstream;
         proxy_set_header Host $host;
     }
 }
diff --git a/conf.d/www-ai.conf b/conf.d/www-ai.conf
index dde8f3b..c7878d8 100644
--- a/conf.d/www-ai.conf
+++ b/conf.d/www-ai.conf
@@ -5,10 +5,20 @@ server {
     ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
 
+    location /_next/static/ {
+        resolver 127.0.0.11 valid=30s;
+        set $upstream www-ai;
+        proxy_pass http://$upstream;
+        proxy_set_header Host $host;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
     location / {
         resolver 127.0.0.11 valid=30s;
         set $upstream www-ai;
         proxy_pass http://$upstream;
         proxy_set_header Host $host;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
     }
 }
diff --git a/nginx.conf b/nginx.conf
index 6914273..7a40a86 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -1,13 +1,63 @@
-events {}
+events {
+    worker_connections 1024;
+}
 
 http {
+    # --- 基础 IO 优化 ---
+    sendfile        on;
+    tcp_nopush      on;
+    tcp_nodelay     on;
+
+    # --- Keepalive ---
+    keepalive_timeout  65;
+    keepalive_requests 1000;
+
+    # --- 客户端超时（防慢连接拖死 worker）---
+    client_max_body_size      16m;
+    client_body_buffer_size   128k;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 8k;
+    client_body_timeout       30s;
+    client_header_timeout     30s;
+    send_timeout              30s;
+
+    # --- 反代默认参数（各 conf.d 可按需覆盖）---
+    proxy_http_version 1.1;
+    proxy_set_header   Host $host;
+    proxy_set_header   X-Real-IP $remote_addr;
+    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Forwarded-Proto $scheme;
+    proxy_set_header   Connection "";
+    proxy_connect_timeout 3s;
+    proxy_send_timeout    30s;
+    proxy_read_timeout    30s;
+    proxy_buffer_size          16k;
+    proxy_buffers              8 16k;
+    proxy_busy_buffers_size    32k;
+
+    # --- Gzip 压缩 ---
+    gzip on;
+    gzip_min_length 1k;
+    gzip_comp_level 5;
+    gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml;
+    gzip_proxied any;
+    gzip_vary on;
+
+    # --- SSL 会话缓存 ---
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets on;
+
+    # --- 关闭版本号 ---
+    server_tokens off;
+
     include /etc/nginx/conf.d/*.conf;
 
     # 所有 HTTP 自动跳 HTTPS
     server {
         listen 80 default_server;
         server_name _;
-        
+
         location / {
             return 301 https://$host$request_uri;
         }