diff --git a/infra/deploy/compose.local.yaml b/infra/deploy/compose.local.yaml
index 2a9d9ef..0c49fd1 100644
--- a/infra/deploy/compose.local.yaml
+++ b/infra/deploy/compose.local.yaml
@@ -10,8 +10,6 @@ services:
       MYSQL_ROOT_PASSWORD: root-lehuo-2026
       MYSQL_USER: lehuo
       TZ: Asia/Shanghai
-    ports:
-      - '3306:3306'
     volumes:
       - mysql-data:/var/lib/mysql
     healthcheck:
@@ -27,8 +25,6 @@ services:
     image: redis:7.4-alpine
     restart: unless-stopped
     command: ['redis-server', '--appendonly', 'yes']
-    ports:
-      - '6379:6379'
     volumes:
       - redis-data:/data
     healthcheck:
diff --git a/infra/monitoring/alert-rules.yml b/infra/monitoring/alert-rules.yml
index d368ced..7df49bf 100644
--- a/infra/monitoring/alert-rules.yml
+++ b/infra/monitoring/alert-rules.yml
@@ -21,3 +21,13 @@ groups:
         for: 10m
         labels: { severity: critical }
         annotations: { summary: '超过 26 小时无成功数据库备份' }
+      - alert: FailedLoginSpike
+        expr: rate(lehuo_auth_failed_login_total[5m]) > 10
+        for: 5m
+        labels: { severity: warning }
+        annotations: { summary: '检测到异常登录失败 spike (>10次/分钟)' }
+      - alert: BruteForceAttempt
+        expr: rate(lehuo_auth_failed_login_total{actor_role="SUPER_ADMIN"}[10m]) > 5
+        for: 5m
+        labels: { severity: critical }
+        annotations: { summary: '管理员账号疑似暴力破解 (>5次失败/分钟)' }
diff --git a/scripts/db-backup.sh b/scripts/db-backup.sh
new file mode 100755
index 0000000..ae671b3
--- /dev/null
+++ b/scripts/db-backup.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+set -e
+BACKUP_DIR="/home/climber/backups/lehuo"
+DATE=$(date +%Y%m%d_%H%M%S)
+mkdir -p $BACKUP_DIR
+
+# 使用lehuo用户备份（不需要密码）
+docker exec lehuo-local-mysql-1 mysqldump -ulehuo -pchange-me-local-only lehuo > "$BACKUP_DIR/lehuo_$DATE.sql" 2>/dev/null
+gzip "$BACKUP_DIR/lehuo_$DATE.sql"
+echo "[$DATE] 数据库备份完成: lehuo_$DATE.sql.gz ($(du -sh $BACKUP_DIR/lehuo_$DATE.sql.gz | cut -f1))"
+
+# 清理30天前的备份
+find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete
+
+# 备份SSL密钥
+if [ -d /home/climber/lehuo/ssl ]; then
+    tar czf "$BACKUP_DIR/ssl_keys_$DATE.tar.gz" -C /home/climber/lehuo ssl/ 2>/dev/null || true
+    find $BACKUP_DIR -name "ssl_keys_*.tar.gz" -mtime +30 -delete
+    echo "[$DATE] SSL密钥备份完成"
+fi
+
+echo "[$DATE] 备份任务完成"