diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..68a979e
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "frontend"]
+	path = frontend
+	url = http://103.236.53.208:3000/juwan/juwan-frontend.git
diff --git a/deploy/dev/build.py b/deploy/dev/build.py
index 442c914..296f8f0 100644
--- a/deploy/dev/build.py
+++ b/deploy/dev/build.py
@@ -91,9 +91,23 @@ def discover_targets():
     return targets
 
 
+def frontend_target():
+    frontend_root = ROOT_DIR / "frontend"
+    if not (frontend_root / "Dockerfile").exists():
+        return None
+    return {
+        "context": "frontend",
+        "dockerfile": "Dockerfile",
+        "tags": [f"{IMAGE_PREFIX}/frontend:{IMAGE_TAG}"],
+    }
+
+
 def main():
     os.chdir(ROOT_DIR)
     targets = discover_targets()
+    ft = frontend_target()
+    if ft is not None:
+        targets["frontend"] = ft
     if not targets:
         print("No targets found")
         sys.exit(1)
diff --git a/deploy/dev/docker-compose.yml b/deploy/dev/docker-compose.yml
index 8fbd4b2..8d40101 100644
--- a/deploy/dev/docker-compose.yml
+++ b/deploy/dev/docker-compose.yml
@@ -291,6 +291,14 @@ services:
       rl-redis:
         condition: service_started
 
+  frontend:
+    image: juwan/frontend:dev
+    container_name: juwan-frontend
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      PORT: "3000"
+
   # ==================== RPC 层 ====================
   user-rpc:
     image: juwan/users-rpc:dev
diff --git a/deploy/dev/envoy.yaml b/deploy/dev/envoy.yaml
index 6d3ed90..8e43de7 100644
--- a/deploy/dev/envoy.yaml
+++ b/deploy/dev/envoy.yaml
@@ -427,10 +427,13 @@ static_resources:
 
                         - match:
                             prefix: /
-                          direct_response:
-                            status: 404
-                            body:
-                              inline_string: gateway route not found
+                          route:
+                            cluster: frontend_cluster
+                            timeout: 30s
+                          typed_per_filter_config:
+                            envoy.filters.http.ext_authz:
+                              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
+                              disabled: true
 
                 access_log:
                   - name: envoy.access_loggers.stdout
@@ -975,6 +978,20 @@ static_resources:
                       address: ratelimit
                       port_value: 8081
 
+    - name: frontend_cluster
+      connect_timeout: 2s
+      type: STRICT_DNS
+      lb_policy: ROUND_ROBIN
+      load_assignment:
+        cluster_name: frontend_cluster
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: frontend
+                      port_value: 3000
+
 admin:
   access_log_path: /tmp/admin.log
   address:
diff --git a/frontend b/frontend
new file mode 160000
index 0000000..4f87834
--- /dev/null
+++ b/frontend
@@ -0,0 +1 @@
+Subproject commit 4f878340e60e5cabeed135abce77845934180df2