diff --git a/deploy/a-stock-timeline.service b/deploy/a-stock-timeline.service
index b50f2d8..0d67a48 100644
--- a/deploy/a-stock-timeline.service
+++ b/deploy/a-stock-timeline.service
@@ -10,7 +10,8 @@ WorkingDirectory=/opt/a_stock_timeline
 ExecStart=/opt/a_stock_timeline/venv/bin/python -m src.web.server
 Restart=always
 RestartSec=5
-User=www-data
+# 内部单机部署以 root 运行；生产建议改为专用低权限用户并收紧数据目录权限
+User=root
 Environment=PORT=8100
 # 日志进 journald：journalctl -u a-stock-timeline -f
 
diff --git a/deploy/probe_server.py b/deploy/probe_server.py
new file mode 100644
index 0000000..0b0e0d5
--- /dev/null
+++ b/deploy/probe_server.py
@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*-
+"""探测目标服务器环境（SSH 只读探测，不做变更）"""
+import paramiko
+
+HOST, USER, PWD = '10.20.226.110', 'root', 'tzt123@123'
+
+cli = paramiko.SSHClient()
+cli.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+cli.connect(HOST, username=USER, password=PWD, timeout=10)
+
+CMDS = [
+    ('系统', 'cat /etc/os-release 2>/dev/null | head -2 || uname -a'),
+    ('内核', 'uname -r'),
+    ('python3', 'python3 --version 2>&1; which python3'),
+    ('git', 'git --version 2>&1'),
+    ('venv模块', 'python3 -m venv --help >/dev/null 2>&1 && echo venv-ok || echo venv-missing'),
+    ('防火墙', 'systemctl is-active firewalld 2>/dev/null; systemctl is-active ufw 2>/dev/null; iptables -L INPUT -n 2>/dev/null | head -3'),
+    ('8100占用', 'ss -tlnp 2>/dev/null | grep 8100 || echo 空闲'),
+    ('/opt可写', 'test -d /opt && echo opt-exists; touch /opt/.wtest 2>/dev/null && rm /opt/.wtest && echo opt-writable'),
+    ('外网(pypi)', 'curl -s -o /dev/null -w "%{http_code}" --max-time 8 https://pypi.tuna.tsinghua.edu.cn/simple/ || echo unreachable'),
+]
+for label, cmd in CMDS:
+    _, out, err = cli.exec_command(cmd, timeout=20)
+    o = out.read().decode('utf-8', 'ignore').strip()
+    e = err.read().decode('utf-8', 'ignore').strip()
+    print('【{}】{}'.format(label, o or e or '(空)'))
+
+cli.close()