diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..6e397c0
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,71 @@
+name: ci-userbase-service
+
+# 后端标准化 CI：maven 构建 jar -> docker build -> 推 Nexus docker-hosted
+# 触发：push 到 main（仅 service 或本文件变更）/ 手动 Run workflow
+# 依赖仓库 Actions Secrets：NEXUS_USER / NEXUS_PASSWORD（ci-docker 账号，仅 docker-hosted 推送权）
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'service/**'
+      - '.gitea/workflows/ci.yml'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'image tag (default = short sha)'
+        required: false
+        default: 'auto'
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    # docker:24 自带 docker CLI，复用宿主 docker daemon（act_runner 默认挂入 docker.sock）
+    container:
+      image: docker:24
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+    steps:
+      # docker:24 基于 alpine，默认无 git；先装 git 再手动 clone 本仓库
+      - name: Install git (alpine)
+        run: apk add --no-cache git
+
+      # 内网 Gitea 无法访问 github.com 拉取 actions/checkout，改为直接 clone 本仓库
+      - name: Checkout (manual, internal Gitea)
+        run: |
+          git clone --depth 1 --branch main http://192.168.10.160:3000/${GITHUB_REPOSITORY}.git /tmp/src
+          cp -a /tmp/src/. .
+          rm -rf /tmp/src
+
+      - name: Compute image tag
+        id: meta
+        run: |
+          if [ "${{ inputs.tag }}" = "auto" ] || [ -z "${{ inputs.tag }}" ]; then
+            echo "tag=$(echo ${GITHUB_SHA} | cut -c1-7)" >> $GITHUB_OUTPUT
+          else
+            echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build jar with Maven
+        run: |
+          # nexus.yunhaixingtong.com 仅在用户本机 hosts 中指向 160 的 nexus 容器；
+          # 160 上该域名不可解析，故在 maven 容器内用 --add-host 映射到宿主(Caddy:80)，
+          # 由 Caddy 反代到 nexus:8081 的 maven-public（匿名可读，已验证 200）。
+          # 等真实域名就绪、公网可解析后，删除下面 --add-host 这一行即可。
+          docker run --rm \
+            --add-host=nexus.yunhaixingtong.com:host-gateway \
+            -v /opt/docker/ubs-m2:/root/.m2 \
+            -v $PWD:/build -w /build/service \
+            maven:3.6.3-jdk-8 \
+            mvn -B -DskipTests clean package
+
+      - name: Login to Nexus docker registry
+        run: echo "${{ secrets.NEXUS_PASSWORD }}" | docker login nexus:8083 -u ${{ secrets.NEXUS_USER }}
+
+      - name: Build image
+        run: docker build -t nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }} -f service/docker/Dockerfile service
+
+      - name: Push image
+        run: docker push nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }}
+
+      - name: Report
+        run: echo "pushed nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }}"