diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..0373b23
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,63 @@
+# deployed by gitea act_runner (push to main/dev triggers this)
+name: Build and Deploy (service.xpcool.com)
+
+on:
+  push:
+    branches: [main, dev]
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install git & docker CLI
+        run: |
+          sed -i 's|deb.debian.org|mirrors.cloud.tencent.com|g; s|security.debian.org|mirrors.cloud.tencent.com|g' /etc/apt/sources.list 2>/dev/null || true
+          sed -i 's|deb.debian.org|mirrors.cloud.tencent.com|g; s|security.debian.org|mirrors.cloud.tencent.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || true
+          apt-get update
+          apt-get install -y git docker.io
+
+      - name: Checkout (local Gitea)
+        run: |
+          git clone --depth 1 --branch "${{ github.ref_name }}" https://oauth2:${{ github.token }}@git.xpcool.com/${{ github.repository }}.git .
+          git checkout ${{ github.sha }}
+
+      - name: Install Go 1.23
+        run: |
+          curl -fsSL https://mirrors.aliyun.com/golang/go1.23.0.linux-amd64.tar.gz -o /tmp/go.tgz
+          rm -rf /usr/local/go && tar -C /usr/local -xzf /tmp/go.tgz
+          /usr/local/go/bin/go version
+
+      - name: Build (linux/amd64)
+        env:
+          GOPROXY: https://goproxy.cn,direct
+        run: |
+          export PATH=$PATH:/usr/local/go/bin
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o temp/linux_amd64/main .
+
+      - name: Docker build & deploy
+        run: |
+          docker build -f manifest/docker/Dockerfile -t service.xpcool.com:latest .
+          docker rm -f service.xpcool.com 2>/dev/null || true
+          docker run -d \
+            --name service.xpcool.com \
+            --restart unless-stopped \
+            --network xpcool-net \
+            -p 127.0.0.1:8000:8000 \
+            -e DB_DSN="${{ secrets.DB_DSN }}" \
+            -e JWT_SECRET="${{ secrets.JWT_SECRET }}" \
+            service.xpcool.com:latest
+
+      - name: Notify success (PushPlus)
+        if: success()
+        run: |
+          curl -s -X POST "https://www.pushplus.plus/send" \
+            -H "Content-Type: application/json" \
+            -d '{"token":"${{ secrets.PUSHPLUS_TOKEN }}","title":"✅ 部署成功 service.xpcool.com","content":"仓库: ${{ github.repository }}<br>分支: ${{ github.ref_name }}<br>提交: ${{ github.sha }}<br>触发人: ${{ github.actor }}<br>状态: 编译打包部署成功<br>访问: https://service.xpcool.com","template":"html"}'
+
+      - name: Notify failure (PushPlus)
+        if: failure()
+        run: |
+          curl -s -X POST "https://www.pushplus.plus/send" \
+            -H "Content-Type: application/json" \
+            -d '{"token":"${{ secrets.PUSHPLUS_TOKEN }}","title":"❌ 部署失败 service.xpcool.com","content":"仓库: ${{ github.repository }}<br>分支: ${{ github.ref_name }}<br>提交: ${{ github.sha }}<br>触发人: ${{ github.actor }}<br>状态: 构建或部署失败<br>日志: https://git.xpcool.com/${{ github.repository }}/actions","template":"html"}'