diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 64565ce..7855118 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -61,7 +61,7 @@ jobs:
           esac
 
   # ============================================================
-  # Job 2: 并行矩阵构建 5 个服务镜像 - 💥 重点修改这里 💥
+  # Job 2: 并行矩阵构建 6 个服务镜像 - 💥 重点修改这里 💥
   # ============================================================
   build:
     runs-on: zero-ppanel-server
@@ -72,6 +72,9 @@ jobs:
       fail-fast: false
       matrix:
         service:
+          - name: rpc-core
+            dockerfile: deploy/Dockerfile.rpc-core
+            image_name: ppanel-rpc-core
           - name: api
             dockerfile: deploy/Dockerfile.api
             image_name: ppanel-api
@@ -162,7 +165,7 @@ jobs:
           username: ${{ env.SSH_USER }}
           password: ${{ env.SSH_PASSWORD }}
           port: ${{ env.SSH_PORT }}
-          source: "deploy/docker-compose.cloud.yml"
+          source: "deploy/docker-compose.cloud.yml,deploy/etc,deploy/.env.example"
           target: "${{ needs.prepare.outputs.deploy_path }}/"
           strip_components: 1
 
@@ -186,18 +189,21 @@ jobs:
 
             cd ${DEPLOY_PATH}
 
-            # 写入环境变量供 docker-compose 使用
-            cat > .env <<EOF
-            PPANEL_TAG=${DOCKER_TAG}
-            PPANEL_REPO=${REPO}
-            EOF
+            # 保留已有业务配置，仅更新镜像仓库和标签
+            touch .env
+            grep -q '^PPANEL_TAG=' .env \
+              && sed -i "s|^PPANEL_TAG=.*|PPANEL_TAG=${DOCKER_TAG}|" .env \
+              || echo "PPANEL_TAG=${DOCKER_TAG}" >> .env
+            grep -q '^PPANEL_REPO=' .env \
+              && sed -i "s|^PPANEL_REPO=.*|PPANEL_REPO=${REPO}|" .env \
+              || echo "PPANEL_REPO=${REPO}" >> .env
 
             # 拉取所有服务的最新镜像
             docker-compose -f docker-compose.cloud.yml pull
 
             # 滚动更新所有 ppanel 服务
             docker-compose -f docker-compose.cloud.yml up -d \
-              ppanel-api ppanel-admin ppanel-node ppanel-queue ppanel-scheduler
+              ppanel-rpc-core ppanel-api ppanel-admin ppanel-node ppanel-queue ppanel-scheduler
 
             # 清理旧镜像
             docker image prune -f || true
diff --git a/deploy/.env.example b/deploy/.env.example
index a85e4aa..84d832b 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -1,5 +1,9 @@
-MYSQL_DSN=root:pavR2$mX7*tQ@tcp(127.0.0.1:3306)/ppanel?charset=utf8mb4&parseTime=true
-REDIS_HOST=127.0.0.1:6379
+PPANEL_REPO=registry.kxsw.us/vpn-server
+PPANEL_TAG=latest
+
+# 如果密码包含 $，请写成 $$，避免被 docker compose 当成变量展开
+MYSQL_DSN=root:replace-with-db-password@tcp(mysql:3306)/ppanel?charset=utf8mb4&parseTime=true
+REDIS_HOST=redis:6379
 REDIS_PASS=
 
 JWT_SECRET=replace-with-strong-secret
@@ -8,4 +12,4 @@ APP_SECRET=replace-with-strong-secret
 SECURITY_SECRET=replace-with-strong-secret
 NODE_SECRET=replace-with-strong-secret
 
-CORE_RPC_TARGET=127.0.0.1:8083
+CORE_RPC_TARGET=ppanel-rpc-core:8083
diff --git a/deploy/Dockerfile.rpc-core b/deploy/Dockerfile.rpc-core
new file mode 100644
index 0000000..260c368
--- /dev/null
+++ b/deploy/Dockerfile.rpc-core
@@ -0,0 +1,20 @@
+FROM golang:1.24-alpine AS builder
+
+WORKDIR /app
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY apps/rpc ./apps/rpc
+COPY pkg ./pkg
+RUN CGO_ENABLED=0 go build -trimpath -o /ppanel-rpc-core ./apps/rpc/core/core.go
+
+FROM alpine:3.19
+RUN apk add --no-cache ca-certificates tzdata
+ENV TZ=Asia/Shanghai
+
+WORKDIR /app
+COPY --from=builder /ppanel-rpc-core .
+COPY apps/rpc/core/etc /app/etc
+
+EXPOSE 8083
+CMD ["./ppanel-rpc-core", "-f", "etc/core.yaml"]
diff --git a/deploy/docker-compose.cloud.yml b/deploy/docker-compose.cloud.yml
index ded36ef..1d9ef6f 100644
--- a/deploy/docker-compose.cloud.yml
+++ b/deploy/docker-compose.cloud.yml
@@ -2,12 +2,27 @@
 # 镜像由 CI 预先构建并推送到镜像仓库
 # 本地基础设施 (mysql/redis) 需提前独立部署
 
-version: '3.8'
-
 services:
+  ppanel-rpc-core:
+    image: ${PPANEL_REPO}/ppanel-rpc-core:${PPANEL_TAG:-latest}
+    restart: unless-stopped
+    env_file:
+      - ./.env
+    ports:
+      - "8083:8083"
+    volumes:
+      - ./etc/core:/app/etc
+    logging:
+      driver: json-file
+      options:
+        max-size: "50m"
+        max-file: "3"
+
   ppanel-api:
     image: ${PPANEL_REPO}/ppanel-api:${PPANEL_TAG:-latest}
     restart: unless-stopped
+    depends_on:
+      - ppanel-rpc-core
     env_file:
       - ./.env
     ports:
diff --git a/deploy/etc/core/core.yaml b/deploy/etc/core/core.yaml
new file mode 100644
index 0000000..2a19c4c
--- /dev/null
+++ b/deploy/etc/core/core.yaml
@@ -0,0 +1,31 @@
+Name: core.rpc
+ListenOn: 0.0.0.0:8083
+Mode: pro
+
+Log:
+  Mode: file
+  Encoding: json
+  Level: info
+  Path: /var/log/zero-ppanel/rpc-core
+  KeepDays: 15
+  Rotation: daily
+
+Telemetry:
+  Name: core.rpc
+  Endpoint: http://jaeger:4318/v1/traces
+  Sampler: 0.1
+  Batcher: otlphttp
+
+DevServer:
+  Enabled: true
+  Port: 6163
+  EnableMetrics: true
+  EnablePprof: false
+
+MySQL:
+  DataSource: "${MYSQL_DSN}"
+
+CacheRedis:
+  Host: "${REDIS_HOST}"
+  Type: node
+  Pass: "${REDIS_PASS}"