diff --git a/infra/README.md b/infra/README.md
index 67f0a0a..39cc800 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -5,6 +5,7 @@
 - `caddy/Caddyfile`：测试机 IP 的内部 CA HTTPS、Web/API 反向代理。
 - `systemd/kaotings-api.service`：FastAPI 自动重启服务。
 - `systemd/kaotings-web.service`：Next.js 自动重启服务。
+- Phase 2 发布包必须保留仓库目录结构；Web 使用发布根目录，API 使用其中的 `services/api`，虚拟环境单独放在 `/home/flym/kaotings-api-venv`。
 
 数据库账号密码、`CSRF_SECRET` 和 Caddy 私有 CA 不进入 Git。服务器上的 `/etc/kaotings/api.env` 必须由 root 拥有且权限为 `0600`。
 
diff --git a/infra/scripts/provision-phase2-db.sh b/infra/scripts/provision-phase2-db.sh
new file mode 100644
index 0000000..45fdf22
--- /dev/null
+++ b/infra/scripts/provision-phase2-db.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "run as root" >&2
+  exit 1
+fi
+
+db_name="kaotings"
+db_role="kaotings_app"
+db_password="$(openssl rand -hex 32)"
+csrf_secret="$(openssl rand -hex 32)"
+
+if runuser -u postgres -- psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${db_role}'" | grep -q 1; then
+  printf "ALTER ROLE %s PASSWORD '%s';\n" "$db_role" "$db_password" | runuser -u postgres -- psql -v ON_ERROR_STOP=1 >/dev/null
+else
+  printf "CREATE ROLE %s LOGIN PASSWORD '%s';\n" "$db_role" "$db_password" | runuser -u postgres -- psql -v ON_ERROR_STOP=1 >/dev/null
+fi
+
+if ! runuser -u postgres -- psql -tAc "SELECT 1 FROM pg_database WHERE datname='${db_name}'" | grep -q 1; then
+  runuser -u postgres -- createdb -O "$db_role" "$db_name"
+fi
+
+install -d -m 700 /etc/kaotings
+umask 077
+cat > /etc/kaotings/api.env <<EOF
+DATABASE_URL=postgresql://${db_role}:${db_password}@127.0.0.1:5432/${db_name}
+APP_ENV=test
+ALLOWED_ORIGINS=https://192.168.199.22,http://192.168.199.22:3000
+SESSION_COOKIE_NAME=kaotings_session
+SESSION_COOKIE_SECURE=true
+SESSION_TTL_SECONDS=2592000
+CSRF_SECRET=${csrf_secret}
+EMAIL_VERIFICATION_ENABLED=false
+PHONE_VERIFICATION_ENABLED=false
+TEST_FREE_PERIOD_LIMIT=10000
+TEST_VIP_PERIOD_LIMIT=100000
+EOF
+chmod 600 /etc/kaotings/api.env
+echo "database and API environment provisioned"
diff --git a/infra/systemd/kaotings-api.service b/infra/systemd/kaotings-api.service
index 17edde1..2048d4d 100644
--- a/infra/systemd/kaotings-api.service
+++ b/infra/systemd/kaotings-api.service
@@ -9,7 +9,7 @@ User=flym
 Group=flym
 WorkingDirectory=/home/flym/kaotings-api
 EnvironmentFile=/etc/kaotings/api.env
-ExecStart=/home/flym/kaotings-api/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000
+ExecStart=/home/flym/kaotings-api-venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000
 Restart=always
 RestartSec=3
 NoNewPrivileges=true