diff --git a/.gitignore b/.gitignore
index c035a23..2668f49 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,4 +7,8 @@
 .DS_Store
 
 picture/
-images/
\ No newline at end of file
+images/
+
+# k8s 真实密钥文件不入库，仓库里只放 secret.example.yaml 模板
+k8s/backend/secret.yaml
+k8s/postgres/secret.yaml
diff --git a/k8s/backend/deployment.yaml b/k8s/backend/deployment.yaml
index 345eb90..e302c2a 100644
--- a/k8s/backend/deployment.yaml
+++ b/k8s/backend/deployment.yaml
@@ -57,9 +57,9 @@ spec:
                   name: backend-secret
                   key: github-admin-id
             - name: APP_URL
-              value: "https://your-domain.com"
+              value: "https://blog.zhaoxi.net.cn"
             - name: FRONTEND_URL
-              value: "https://your-domain.com"
+              value: "https://blog.zhaoxi.net.cn"
             # MOCK_OAUTH 生产环境绝不开启，缺省即关闭
             - name: S3_ENDPOINT
               valueFrom:
diff --git a/k8s/backend/secret.example.yaml b/k8s/backend/secret.example.yaml
new file mode 100644
index 0000000..2a0248e
--- /dev/null
+++ b/k8s/backend/secret.example.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: backend-secret
+  namespace: blog
+type: Opaque
+stringData:
+  database-url: "postgres://blog:CHANGE_ME@postgres:5432/blog"
+  jwt-secret: "CHANGE_ME_random_base64"
+  github-client-id: ""
+  github-client-secret: ""
+  github-admin-id: ""
+  s3-endpoint: ""
+  s3-region: "us-east-1"
+  s3-bucket: ""
+  s3-access-key: ""
+  s3-secret-key: ""
+  s3-public-url: ""
diff --git a/k8s/backend/secret.yaml b/k8s/backend/secret.yaml
deleted file mode 100644
index 1196224..0000000
--- a/k8s/backend/secret.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: backend-secret
-  namespace: blog
-type: Opaque
-stringData:
-  database-url: "postgres://blog:change-me-in-production@postgres:5432/blog"
-  jwt-secret: "change-me-in-production"
-  github-client-id: "your-github-client-id"
-  github-client-secret: "your-github-client-secret"
-  github-admin-id: "your-github-user-id"
-  # S3 兼容对象存储，留空表示关闭上传功能
-  s3-endpoint: ""
-  s3-region: "us-east-1"
-  s3-bucket: ""
-  s3-access-key: ""
-  s3-secret-key: ""
-  s3-public-url: ""
diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml
index 975f08c..6a32998 100644
--- a/k8s/ingress.yaml
+++ b/k8s/ingress.yaml
@@ -7,7 +7,7 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: web
 spec:
   rules:
-    - host: your-domain.com
+    - host: blog.zhaoxi.net.cn
       http:
         paths:
           # 前端静态文件由外部 Caddy 直接托管，集群内只暴露 API
diff --git a/k8s/postgres/secret.yaml b/k8s/postgres/secret.example.yaml
similarity index 73%
rename from k8s/postgres/secret.yaml
rename to k8s/postgres/secret.example.yaml
index fadec80..e29b248 100644
--- a/k8s/postgres/secret.yaml
+++ b/k8s/postgres/secret.example.yaml
@@ -5,4 +5,4 @@ metadata:
   namespace: blog
 type: Opaque
 stringData:
-  password: "change-me-in-production"
+  password: "CHANGE_ME"