diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..8c84bd1
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,47 @@
+name: deploy-userbase-service
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build-deploy:
+    runs-on: ubuntu-latest
+    # docker:24 自带 docker CLI；宿主 docker.sock 默认挂入 job 容器，
+    # 因此 docker build/push/run 实际都在宿主守护进程上执行。
+    container:
+      image: docker:24
+    steps:
+      - name: Install git (alpine)
+        run: apk add --no-cache git
+
+      - name: Checkout (manual, internal Gitea)
+        run: |
+          git clone --depth 1 --branch main http://192.168.10.160:3000/${GITHUB_REPOSITORY}.git /tmp/src
+          cp -a /tmp/src/. .
+          rm -rf .git .gitea
+          rm -rf /tmp/src
+
+      # 用宿主 docker 守护进程跑 maven（--network=host 走宿主外网拉依赖），
+      # 产出 target/userbase.jar 落到工作区。
+      - name: Build jar (maven, host network)
+        run: docker run --rm --network=host -v $PWD:/build -w /build maven:3.9-eclipse-temurin-8 mvn -B -DskipTests package
+
+      - name: Login to Nexus docker registry
+        # 单引号包裹 secret，避免密码中的 $ 被 shell 展开
+        run: echo '${{ secrets.NEXUS_PASSWORD }}' | docker login -u '${{ secrets.NEXUS_USER }}' --password-stdin nexus:8083
+
+      - name: Build image
+        run: docker build -f docker/Dockerfile -t nexus:8083/docker-hosted/userbase-service:latest .
+
+      - name: Push image
+        run: docker push nexus:8083/docker-hosted/userbase-service:latest
+
+      - name: Deploy on host (infra-infra-net)
+        run: |
+          docker rm -f userbase-service 2>/dev/null || true
+          docker run -d --name userbase-service --network infra-infra-net -p 8060:8060 --restart unless-stopped nexus:8083/docker-hosted/userbase-service:latest
+
+      - name: Done
+        run: 'echo "UserBaseService deployed -> http://192.168.10.160:8060/userbase"'