diff --git a/deploy/production/README.md b/deploy/production/README.md
new file mode 100644
index 00000000..ba4b226c
--- /dev/null
+++ b/deploy/production/README.md
@@ -0,0 +1,29 @@
+# 生产环境部署方案（Issue #91）
+
+## 架构
+
+```
+公网 443 → Nginx(TLS终结/限流/HSTS) → 127.0.0.1:8000 app(FastAPI, 非root, read_only)
+                                      → postgres(数据卷 pgdata)
+```
+
+## 步骤
+
+1. **服务器初始化**：`sudo bash deploy/production/server-setup.sh`
+   （系统更新、Docker、防火墙仅 22/80/443、SSH 禁 root/密码登录、部署用户 deploy）
+2. **域名与证书**：将 `wms.xayunmei.com` A 记录指向服务器，证书放入
+   `deploy/production/certs/`（wms.crt / wms.key）。
+3. **启动**：`REGISTRY=... IMAGE_TAG=<commit> docker compose \
+   -f docker-compose.yml -f deploy/production/docker-compose.override.yml up -d`
+4. **日常部署**：`bash scripts/deploy.sh <commit_sha>`（自动拉取/滚动更新/健康检查/回滚）。
+
+## 备份策略
+
+- `deploy/production/backup.sh`：pg_dump 每日全量 + sha256 校验，保留 30 天，
+  可选 rsync 异地同步（`BACKUP_REMOTE` 环境变量）。建议 crontab：`0 2 * * * /opt/wms/deploy/production/backup.sh`
+
+## 安全基线
+
+- 容器非 root + 只读文件系统 + 资源限额（2C/2G）+ json-file 日志轮转
+- 应用端口仅绑定 127.0.0.1，对外仅 443；HTTP 强制跳转 HTTPS；TLS1.2+；HSTS
+- API 限流 20r/s（burst 40），安全响应头齐全
diff --git a/deploy/production/backup.sh b/deploy/production/backup.sh
new file mode 100644
index 00000000..e60d0c02
--- /dev/null
+++ b/deploy/production/backup.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# 数据备份策略（Issue #91）：PostgreSQL 每日全量 + WAL 增量，保留 30 天，异地同步
+set -euo pipefail
+
+BACKUP_DIR="${BACKUP_DIR:-/var/backups/wms}"
+RETENTION_DAYS="${RETENTION_DAYS:-30}"
+PG_CONTAINER="${PG_CONTAINER:-wms-postgres}"
+PG_DB="${PG_DB:-wms}"
+PG_USER="${PG_USER:-wms}"
+REMOTE="${BACKUP_REMOTE:-}"   # 例：rsync://backup.xayunmei.local/wms
+
+ts="$(date +%F_%H%M%S)"
+mkdir -p "$BACKUP_DIR"
+file="$BACKUP_DIR/pg_${PG_DB}_${ts}.sql.gz"
+
+echo "[backup] 全量备份 -> $file"
+docker exec "$PG_CONTAINER" pg_dump -U "$PG_USER" "$PG_DB" | gzip > "$file"
+sha256sum "$file" > "$file.sha256"
+
+echo "[backup] 清理 ${RETENTION_DAYS} 天前的备份"
+find "$BACKUP_DIR" -name 'pg_*.sql.gz*' -mtime +"$RETENTION_DAYS" -delete
+
+if [ -n "$REMOTE" ]; then
+  echo "[backup] 异地同步 -> $REMOTE"
+  rsync -az "$BACKUP_DIR/" "$REMOTE/"
+fi
+
+echo "[backup] 完成"
diff --git a/deploy/production/docker-compose.override.yml b/deploy/production/docker-compose.override.yml
new file mode 100644
index 00000000..47849655
--- /dev/null
+++ b/deploy/production/docker-compose.override.yml
@@ -0,0 +1,52 @@
+# 生产环境覆盖配置（Issue #91）
+# 用法：docker compose -f docker-compose.yml -f deploy/production/docker-compose.override.yml up -d
+services:
+  app:
+    image: ${REGISTRY:-registry.xayunmei.local}/water-management-system:${IMAGE_TAG:-latest}
+    restart: always
+    read_only: true
+    user: "10001:10001"
+    tmpfs:
+      - /tmp
+    deploy:
+      resources:
+        limits:
+          cpus: "2.0"
+          memory: 2G
+        reservations:
+          memory: 512M
+    logging:
+      driver: json-file
+      options:
+        max-size: "50m"
+        max-file: "5"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    ports:
+      - "127.0.0.1:8000:8000"   # 仅绑定回环，由 Nginx 反向代理对外
+    environment:
+      - TZ=Asia/Shanghai
+      - APP_ENV=production
+
+  postgres:
+    restart: always
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    logging:
+      driver: json-file
+      options: { max-size: "20m", max-file: "3" }
+
+  nginx:
+    restart: always
+    ports:
+      - "443:443"
+      - "80:80"
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./certs:/etc/nginx/certs:ro
+
+volumes:
+  pgdata:
diff --git a/deploy/production/nginx.conf b/deploy/production/nginx.conf
new file mode 100644
index 00000000..3ee13da5
--- /dev/null
+++ b/deploy/production/nginx.conf
@@ -0,0 +1,69 @@
+# 生产 Nginx：HTTPS + HTTP2 + HSTS + 限流 + WebSocket（Issue #91）
+user nginx;
+worker_processes auto;
+events { worker_connections 2048; }
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    sendfile on;
+    gzip on;
+    server_tokens off;
+
+    limit_req_zone $binary_remote_addr zone=api:10m rate=20r/s;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    # HTTP 强制跳转 HTTPS
+    server {
+        listen 80;
+        server_name wms.xayunmei.com;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name wms.xayunmei.com;
+
+        ssl_certificate     /etc/nginx/certs/wms.crt;
+        ssl_certificate_key /etc/nginx/certs/wms.key;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+        ssl_session_cache   shared:SSL:10m;
+        ssl_session_timeout 1d;
+
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header X-Frame-Options DENY always;
+        add_header X-Content-Type-Options nosniff always;
+        add_header Referrer-Policy no-referrer always;
+
+        client_max_body_size 50m;
+
+        location /api/ {
+            limit_req zone=api burst=40 nodelay;
+            proxy_pass http://127.0.0.1:8000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto https;
+        }
+
+        location /ws/ {
+            proxy_pass http://127.0.0.1:8000;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+
+        location / {
+            proxy_pass http://127.0.0.1:8000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+    }
+}
diff --git a/deploy/production/server-setup.sh b/deploy/production/server-setup.sh
new file mode 100644
index 00000000..668080e9
--- /dev/null
+++ b/deploy/production/server-setup.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# 生产服务器初始化（Issue #91）：系统更新 / Docker / 防火墙 / SSH 加固 / 部署用户
+set -euo pipefail
+
+log() { echo "[setup] $*"; }
+
+log "系统更新"
+apt-get update && apt-get -y upgrade
+
+log "安装 Docker 与 compose 插件"
+if ! command -v docker >/dev/null; then
+  curl -fsSL https://get.docker.com | sh
+  systemctl enable --now docker
+fi
+
+log "创建部署用户 deploy（非 root 运行）"
+id -u deploy >/dev/null 2>&1 || useradd -m -s /bin/bash deploy
+usermod -aG docker deploy
+mkdir -p /opt/wms && chown deploy:deploy /opt/wms
+
+log "防火墙：仅放行 22/80/443"
+if command -v ufw >/dev/null; then
+  ufw default deny incoming
+  ufw default allow outgoing
+  ufw allow 22/tcp
+  ufw allow 80/tcp
+  ufw allow 443/tcp
+  ufw --force enable
+fi
+
+log "SSH 加固"
+sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+systemctl reload sshd || true
+
+log "时间同步"
+timedatectl set-timezone Asia/Shanghai
+
+log "完成。请将 TLS 证书放入 /opt/wms/deploy/production/certs/ 后执行 scripts/deploy.sh"