diff --git a/docker/application-prod.yml b/docker/application-prod.yml
new file mode 100644
index 0000000..414d5d3
--- /dev/null
+++ b/docker/application-prod.yml
@@ -0,0 +1,93 @@
+# BschClass 生产配置（线上以 nacos 的 bschclassmanage-prod.yaml 为准，本文件是 nacos 不可达时的兜底）
+server:
+  port: 8087
+  # 无 context-path：经 caddy 暴露为 http://base.yunhaixingtong.com/bschclass，caddy 已剥离 /bschclass 前缀
+
+spring:
+  mvc:
+    date-format: yyyy-MM-dd HH:mm:ss
+  servlet:
+    multipart:
+      max-file-size: 50MB
+      max-request-size: 200MB
+  jackson:
+    time-zone: GMT+8
+    date-format: yyyy-MM-dd HH:mm:ss
+
+  redis:
+    host: redis-server
+    port: 6379
+    database: 0
+    # 生产由 nacos application-infra.yaml 注入；此处仅作 nacos 不可达时的兜底，
+    # 密码不写死，运行时由容器环境变量 REDIS_PASSWORD 注入（值来自 Gitea Secrets，不入镜像）
+    password: ${REDIS_PASSWORD}
+    timeout: 2000ms
+  data:
+    redis:
+      repositories:
+        enabled: false
+
+  # datasource:
+  #   url: jdbc:mysql://mysql8:3306/dbschoolclass?useUnicode=true&characterEncoding=utf-8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
+  #   username: root
+  #   # 生产由 nacos application-infra.yaml 注入；兜底密码运行时由 DB_PASSWORD 环境变量注入（来自 Gitea Secrets）
+  #   password: ${DB_PASSWORD}
+  #   driver-class-name: com.mysql.cj.jdbc.Driver
+  #   min-idle: 30
+  #   max-active: 30
+  #   hikari:
+  #     minimum-idle: 20
+  #     maximum-pool-size: 500
+  #     connection-timeout: 600000
+  #     idle-timeout: 120000
+  #     leakDetectionThreshold: 300000
+  #     auto-commit: true
+  #     max-lifetime: 1800000
+  #     validation-timeout: 3000
+  #     connection-test-query: SELECT 1 FROM DUAL
+  #     connection-init-sql: SET NAMES utf8mb4
+
+  jpa:
+    database: MySQL
+    show-sql: false
+    hibernate:
+      ddl-auto: update
+    database-platform: org.hibernate.dialect.MySQL5InnoDBDialect
+    properties:
+      hibernate.order_by.default_null_ordering: last
+      hibernate:
+        dialect: org.hibernate.dialect.MySQL5InnoDBDialect
+      open-in-view: true
+
+  rabbitmq:
+    host: rabbitmq
+    port: 5672
+    username: admin
+    # 生产由 nacos application-infra.yaml 注入；兜底密码运行时由 RABBITMQ_PASSWORD 环境变量注入（来自 Gitea Secrets）
+    password: ${RABBITMQ_PASSWORD}
+    listener:
+      direct:
+        auto-startup: false
+      simple:
+        auto-startup: false
+
+# 单点登录 / 应用间签名鉴权（基础平台 yh-auth / yh-app-auth）
+yh:
+  sso:
+    server-url-prefix: http://sso.yunhaixingtong.com/cas/
+    client-host-url: http://base.yunhaixingtong.com/bschclass
+    allow-headers: all
+    allow-origins: all
+    url-pattern: /api/*
+    mobi-api-pattern: /mobiapi/*
+  app-auth:
+    enabled: true
+
+# 上传文件落容器卷（docker 内 /data/upload）
+FILE_PATH: /data/upload
+FILE_WEB_PATH: http://base.yunhaixingtong.com/bschclass/upload/
+UPLOAD_WEB_PATH_HTTP: http://base.yunhaixingtong.com/bschclass/upload/file/
+
+logging:
+  level:
+    root: INFO