diff --git a/deploy/0.2.1/.env.example b/deploy/0.2.1/.env.example
index 6a6e0c1..11a8879 100644
--- a/deploy/0.2.1/.env.example
+++ b/deploy/0.2.1/.env.example
@@ -7,5 +7,5 @@ PS_STORAGE_PASSWORD=change-me
 JWT_SECRET_021=change-me
 POWERSYNC_JWT_SECRET=change-me
 POWERSYNC_JWT_KEY_B64=change-me
-POWERSYNC_URL=http://bh.vps.honor3.com:13002
+POWERSYNC_URL=https://bh.vps.honor3.com:13443
 OTA_PUBLIC_BASE=http://bh.vps.honor3.com:13001
diff --git a/deploy/0.2.1/README.md b/deploy/0.2.1/README.md
index 417be30..aad14ac 100644
--- a/deploy/0.2.1/README.md
+++ b/deploy/0.2.1/README.md
@@ -1,6 +1,9 @@
 # 0.2.1 独立验证部署 (baihu /app/iboard-0.2.1)
 
-与现网 `/app/iboard`(3001/宿主 MySQL) 完全隔离：本栈使用独立 PG 容器、端口 13001/13002，不写原库。
+与现网 `/app/iboard`(3001/宿主 MySQL) 完全隔离：本栈使用独立 PG 容器、端口 13443/13001/13002，不写原库。
+
+**浏览器入口: `https://bh.vps.honor3.com:13443`**（自签证书，首次访问需在浏览器"高级→继续访问"接受一次；PowerSync 网页端必须运行在安全上下文，http://13001 入口仅供接口调试，任务模块会报 Navigator locks 错误）。
+正式启用需替换受信证书：把 `bh.pem/bh.key` 换成受信证书后 `docker compose restart tls-front`（例如 Let's Encrypt DNS-01，80/443 已被 gateway 占用无法 HTTP-01）。
 
 ## 栈
 
diff --git a/deploy/0.2.1/docker-compose.yml b/deploy/0.2.1/docker-compose.yml
index 0f598bf..c3c805b 100644
--- a/deploy/0.2.1/docker-compose.yml
+++ b/deploy/0.2.1/docker-compose.yml
@@ -50,6 +50,20 @@ services:
       retries: 5
       start_period: 20s
 
+  # TLS 前置 (自签证书): PowerSync 网页端必须在安全上下文运行 (navigator.locks),
+  # 因此浏览器入口统一走 https://bh.vps.honor3.com:13443 (证书接受一次即可, app+sync 同源同证书)
+  tls-front:
+    image: nginx:alpine
+    restart: unless-stopped
+    depends_on:
+      - app
+      - powersync
+    volumes:
+      - ./tls/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./data/tls:/etc/nginx/certs:ro
+    ports:
+      - "13443:443"
+
   powersync:
     image: journeyapps/powersync-service:latest
     restart: unless-stopped
diff --git a/deploy/0.2.1/tls/nginx.conf b/deploy/0.2.1/tls/nginx.conf
new file mode 100644
index 0000000..22f61e1
--- /dev/null
+++ b/deploy/0.2.1/tls/nginx.conf
@@ -0,0 +1,37 @@
+# 0.2.1 TLS 前置: 单端口 13443, 按路径分流 (自签证书, 见 README)
+# PowerSync 页面必须在安全上下文运行 (navigator.locks 仅 HTTPS/localhost), 故 app 与 sync 统一走 TLS
+server {
+    listen 443 ssl;
+    server_name bh.vps.honor3.com;
+
+    ssl_certificate     /etc/nginx/certs/bh.pem;
+    ssl_certificate_key /etc/nginx/certs/bh.key;
+
+    # PowerSync (HTTP 流式 + WebSocket 兜底)
+    location /sync/ {
+        proxy_pass http://powersync:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Connection '';
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+    location /socket/ {
+        proxy_pass http://powersync:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 3600s;
+    }
+    location /health {
+        proxy_pass http://powersync:8080;
+    }
+
+    # 应用 (静态前端 + API)
+    location / {
+        proxy_pass http://app:13001;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+    }
+}