diff --git a/Dockerfile b/Dockerfile
index f4f2cb4..e9fa048 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,14 +46,11 @@ RUN pnpm install --prod --frozen-lockfile || pnpm install --prod
 COPY --from=builder /app/dist ./dist
 
 # 暴露端口
-EXPOSE 3000
+EXPOSE 80
 
 # 健康检查
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:3000/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
+  CMD node -e "require('http').get('http://localhost:80/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
 
-# 使用非 root 用户运行
-USER node
-
-# 启动命令
+# 启动命令（监听 80 端口需要 root 权限）
 CMD ["node", "dist/index.js"]
diff --git a/src/deploy.ts b/src/deploy.ts
index 3fb978b..ba699ef 100644
--- a/src/deploy.ts
+++ b/src/deploy.ts
@@ -12,7 +12,7 @@ import { K8sClient, V1Deployment, V1Ingress, V1IngressRule, V1ServicePort } from
 const K8S_API_URL = process.env.K8S_API_URL || '';
 const K8S_API_TOKEN = process.env.K8S_API_TOKEN || '';
 const DEV_HOST = process.env.DEV_HOST || 'dev.d8d.fun';
-const TLS_SECRET_NAME = process.env.TLS_SECRET_NAME || 'd8d-tls';
+const TLS_SECRET_NAME = process.env.DEV_TLS_SECRET_NAME || 'd8d-proxy-tls';
 
 // 专用命名空间
 const NAMESPACE = 'd8d-proxy';
diff --git a/src/index.ts b/src/index.ts
index ded002f..342b07a 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -4,7 +4,7 @@ import { proxyHandler } from './proxy.js';
 import { healthHandler } from './health.js';
 
 const app = express();
-const PORT = parseInt(process.env.PORT || '3000', 10);
+const PORT = parseInt(process.env.PORT || '80', 10);
 
 // 解析 JSON 请求体，设置较大的限制以支持大请求
 app.use(express.json({ limit: '50mb' }));