diff --git a/deploy/collabora-proxy/README.md b/deploy/collabora-proxy/README.md
new file mode 100644
index 0000000..69062d4
--- /dev/null
+++ b/deploy/collabora-proxy/README.md
@@ -0,0 +1,82 @@
+# Collabora Proxy
+
+这个目录单独承载 Collabora 反向代理，不和前后端业务代码混放。
+
+目标：
+
+- 把内网 Collabora `http://10.79.97.17:9980`
+- 暴露成浏览器可访问的统一入口
+- 供前端配置为 `http://nas.7bm.co/collabora`
+
+## 目录说明
+
+- `docker-compose.yml`：启动 nginx 代理容器
+- `nginx.conf`：nginx 主配置
+- `conf.d/collabora.conf`：Collabora 反向代理规则
+- `logs/`：nginx 日志目录
+
+## 默认代理关系
+
+- 浏览器入口：`http://nas.7bm.co/collabora`
+- 代理目标：`http://10.79.97.17:9980`
+
+## 启动
+
+```bash
+cd /home/wren-dev/Porject/leaudit-platform/deploy/collabora-proxy
+mkdir -p logs
+docker compose up -d
+```
+
+## 验证
+
+先验证代理容器：
+
+```bash
+curl http://127.0.0.1:9981/
+```
+
+应返回：
+
+```text
+collabora-proxy ok
+```
+
+再验证 Collabora 页面是否被代理出来：
+
+```bash
+curl -I http://127.0.0.1:9981/collabora/browser/dist/cool.html
+```
+
+如果这一步通了，再让上层网关或宿主 nginx 把：
+
+- `http://nas.7bm.co/collabora`
+
+转发到：
+
+- `http://<部署该容器的主机>:9981/collabora`
+
+## 前端联动配置
+
+代理接通后，前端 `.env` 里应改成：
+
+```env
+COLLABORA_URL=http://nas.7bm.co/collabora
+APP_URL=http://nas.7bm.co:5173
+DOCUMENT_URL=http://nas.7bm.co:8096/docauditai/
+```
+
+改完后重启前端：
+
+```bash
+cd /home/wren-dev/Porject/leaudit-platform/legal-platform-frontend
+npm run dev:5173
+```
+
+## 运维补充
+
+如果 Collabora 服务端启用了域名白名单、`aliasgroup` 或 WOPI 主机限制，还需要同步把：
+
+- `nas.7bm.co`
+
+加入允许名单，否则页面可能仍然只转圈不进文档。
diff --git a/deploy/collabora-proxy/conf.d/collabora.conf b/deploy/collabora-proxy/conf.d/collabora.conf
new file mode 100644
index 0000000..02ed81b
--- /dev/null
+++ b/deploy/collabora-proxy/conf.d/collabora.conf
@@ -0,0 +1,32 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen 80;
+    server_name _;
+
+    # Expose Collabora behind /collabora so the browser no longer calls
+    # a private IP directly from the public frontend page.
+    location /collabora/ {
+        proxy_pass http://10.79.97.17:9980/;
+
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+        proxy_connect_timeout 60s;
+    }
+
+    location = / {
+        return 200 'collabora-proxy ok';
+        add_header Content-Type text/plain;
+    }
+}
diff --git a/deploy/collabora-proxy/docker-compose.yml b/deploy/collabora-proxy/docker-compose.yml
new file mode 100644
index 0000000..50d788f
--- /dev/null
+++ b/deploy/collabora-proxy/docker-compose.yml
@@ -0,0 +1,17 @@
+services:
+  collabora-proxy:
+    image: nginx:1.27-alpine
+    container_name: leaudit-collabora-proxy
+    restart: unless-stopped
+    ports:
+      - "9981:80"
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./conf.d:/etc/nginx/conf.d:ro
+      - ./logs:/var/log/nginx
+    networks:
+      - collabora-proxy
+
+networks:
+  collabora-proxy:
+    driver: bridge
diff --git a/deploy/collabora-proxy/nginx.conf b/deploy/collabora-proxy/nginx.conf
new file mode 100644
index 0000000..e0a7275
--- /dev/null
+++ b/deploy/collabora-proxy/nginx.conf
@@ -0,0 +1,27 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    tcp_nopush      on;
+    keepalive_timeout  65;
+    client_max_body_size 200m;
+
+    include /etc/nginx/conf.d/*.conf;
+}