diff --git a/README.md b/README.md
index 1819220..f265723 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,8 @@
 Kubernetes 部署清单，按环境隔离。
 
 ```
-lpt-infra/
+├── traefik/
+│   └── dynamic.yml
 ├── dev/
 │   ├── deployment-lpt-fe.yaml
 │   ├── deployment-lpt-be.yaml
@@ -73,9 +74,29 @@ kubectl apply -f dev/
 kubectl apply -f prod/
 ```
 
-## CI/CD
 
-各服务仓库的 Gitea Actions 负责 build + push 镜像，并通过 `kubectl set image` 更新 Deployment。`regcred` 由 workflow 自动 create/update，`lpt-secrets` 需手动创建一次后保持不变。
+## Traefik
+
+Traefik 以 Docker 容器运行在宿主机，通过 file provider 加载路由规则，转发到 K8s NodePort。
+
+### 更新路由
+
+```bash
+# 将最新配置复制到 Traefik 挂载目录
+sudo cp traefik/dynamic.yml /etc/traefik/dynamic/k8s-lpt.yml
+
+# Traefik 自动检测文件变更，无需重启
+# 或手动验证
+sudo docker exec traefik cat /etc/traefik/dynamic/k8s-lpt.yml
+```
+
+### 端口对照
+
+| 服务 | dev NodePort | prod NodePort |
+|------|-------------|---------------|
+| lpt-fe | 30080 | 30180 |
+| lpt-be (api) | 30082 | 30182 |
+| lpt-ai | ClusterIP | ClusterIP |
 
 ## 验证
 ```bash
diff --git a/traefik/dynamic.yml b/traefik/dynamic.yml
new file mode 100644
index 0000000..99e716f
--- /dev/null
+++ b/traefik/dynamic.yml
@@ -0,0 +1,54 @@
+http:
+  routers:
+    lpt-fe-dev:
+      rule: "Host(`lpt-dev.cat-shark.xyz`)"
+      entrypoints: websecure
+      tls:
+        certResolver: le
+      service: lpt-fe-dev
+    lpt-api-dev:
+      rule: "Host(`lpt-dev.cat-shark.xyz`) && PathPrefix(`/api`)"
+      entrypoints: websecure
+      tls:
+        certResolver: le
+      middlewares:
+        - strip-api-prefix
+      service: lpt-api-dev
+    lpt-fe-prod:
+      rule: "Host(`lpt.cat-shark.xyz`)"
+      entrypoints: websecure
+      tls:
+        certResolver: le
+      service: lpt-fe-prod
+    lpt-api-prod:
+      rule: "Host(`lpt.cat-shark.xyz`) && PathPrefix(`/api`)"
+      entrypoints: websecure
+      tls:
+        certResolver: le
+      middlewares:
+        - strip-api-prefix
+      service: lpt-api-prod
+
+  middlewares:
+    strip-api-prefix:
+      stripPrefix:
+        prefixes:
+          - "/api"
+
+  services:
+    lpt-fe-dev:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.123.199:30080"
+    lpt-api-dev:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.123.199:30082"
+    lpt-fe-prod:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.123.199:30180"
+    lpt-api-prod:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.123.199:30182"