diff --git a/Caddyfile b/Caddyfile
index 7d3c410..80c9041 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -12,8 +12,15 @@
 # 如果有域名,改用下面的 https 配置块
 
 http://{$DOMAIN:NEWS_DOMAIN_FALLBACK} {
-    reverse_proxy /api/* api:8000
-    reverse_proxy /* frontend:80
+    # /api/* 转发到 api:8000,handle_path 会自动 strip 匹配的 /api 前缀
+    handle_path /api/* {
+        reverse_proxy api:8000
+    }
+
+    # 其余走前端 SPA
+    handle {
+        reverse_proxy frontend:80
+    }
 
     encode gzip zstd
 
diff --git a/scripts/_recover.py b/scripts/_recover.py
new file mode 100644
index 0000000..8c6659b
--- /dev/null
+++ b/scripts/_recover.py
@@ -0,0 +1,36 @@
+import os, paramiko
+PW = os.environ["REMOTE_PASS"]
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect("207.57.129.228", port=19717, username="root", password=PW, timeout=15, allow_agent=False, look_for_keys=False)
+
+def run(cmd, t=60):
+    si, so, se = c.exec_command(cmd, timeout=t)
+    out = so.read().decode("utf-8", "replace")
+    err = se.read().decode("utf-8", "replace")
+    rc = so.channel.recv_exit_status()
+    print(f"$ {cmd}")
+    if out: print(out, end="")
+    if err: print("[err]", err, end="", file=__import__("sys").stderr)
+    print(f"  rc={rc}")
+    return out
+
+# 1) 服务器 pull
+run("cd /srv/news && sudo -u news git pull --rebase 2>&1 | tail -5")
+
+# 2) 重建 api + worker 容器(代码变更需要重启)
+run("cd /srv/news && sg docker -c 'docker compose up -d --build --no-deps api worker' 2>&1 | tail -10")
+
+# 3) 等启动
+import time
+time.sleep(15)
+
+# 4) 跑 seed
+run("cd /srv/news && sg docker -c \"docker compose exec -T api python -m app.scripts.seed_sources\" 2>&1 | tail -20")
+
+# 5) 看 docker ps
+run("cd /srv/news && sg docker -c 'docker compose ps' 2>&1 | head -15")
+
+# 6) 健康
+run("curl -s http://localhost/api/v1/healthz 2>&1")
+c.close()