diff --git a/k8s/deploy.sh b/k8s/deploy.sh
index 78234e9..03b4a5f 100755
--- a/k8s/deploy.sh
+++ b/k8s/deploy.sh
@@ -111,8 +111,34 @@ done
 log "Setting up nginx..."
 
 setup_nginx() {
-  local domain="$1" frontend_ip="$2" backend_ip="$3"
-  cat > "/etc/nginx/conf.d/${domain}.conf" << NGINX
+  local domain="$1" frontend_ip="$2" backend_ip="$3" backend_only="${4:-false}"
+  if [ "$backend_only" = "true" ]; then
+    cat > "/etc/nginx/conf.d/${domain}.conf" << NGINX
+server {
+    listen 443 ssl;
+    server_name ${domain};
+    ssl_certificate     /etc/letsencrypt/live/plfai.cn/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/plfai.cn/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    location / {
+        proxy_pass http://${backend_ip}:8000;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_read_timeout 120s;
+        proxy_buffering off;
+    }
+}
+server {
+    listen 80;
+    server_name ${domain};
+    return 301 https://\$server_name\$request_uri;
+}
+NGINX
+  else
+    cat > "/etc/nginx/conf.d/${domain}.conf" << NGINX
 server {
     listen 443 ssl;
     server_name ${domain};
@@ -144,6 +170,7 @@ server {
     return 301 https://\$server_name\$request_uri;
 }
 NGINX
+  fi
   ok "nginx: ${domain}"
 }
 
@@ -153,9 +180,9 @@ PROD_FE=$($KUBECTL get svc frontend -n graphrag-prod -o jsonpath='{.spec.cluster
 PROD_BE=$($KUBECTL get svc backend  -n graphrag-prod -o jsonpath='{.spec.clusterIP}')
 
 setup_nginx "test-graphrag.plfai.cn"          "$TEST_FE" "$TEST_BE"
-setup_nginx "test-graphrag-backend.plfai.cn"  "$TEST_BE" "$TEST_BE"
+setup_nginx "test-graphrag-backend.plfai.cn"  "$TEST_BE" "$TEST_BE" true
 setup_nginx "graphrag.plfai.cn"               "$PROD_FE" "$PROD_BE"
-setup_nginx "graphrag-backend.plfai.cn"       "$PROD_BE" "$PROD_BE"
+setup_nginx "graphrag-backend.plfai.cn"       "$PROD_BE" "$PROD_BE" true
 
 nginx -t >/dev/null 2>&1 && nginx -s reload >/dev/null 2>&1
 ok "nginx reloaded"