diff --git a/deploy/k3s/README.md b/deploy/k3s/README.md
index a9194ed..7970011 100644
--- a/deploy/k3s/README.md
+++ b/deploy/k3s/README.md
@@ -63,6 +63,22 @@ kubectl apply -k deploy/k3s
 
 ## 4. 访问
 
+k3s 默认同时支持两种访问方式。
+
+### 4.1 直接用节点 IP + 端口
+
+`frontend` 和 `ops-web` 已固定为 NodePort：
+
+- tenant admin: `http://<node-ip>:30080`
+- ops admin: `http://<node-ip>:30081`
+
+例如 NAS IP 是 `192.168.100.19`：
+
+- tenant admin: `http://192.168.100.19:30080`
+- ops admin: `http://192.168.100.19:30081`
+
+### 4.2 用域名 Ingress
+
 k3s 默认 Traefik 会接管 Ingress。先把域名指到 k3s 节点 IP：
 
 ```text
@@ -75,7 +91,7 @@ k3s 默认 Traefik 会接管 Ingress。先把域名指到 k3s 节点 IP：
 - tenant admin: `http://geo-rankly.local`
 - ops admin: `http://ops.geo-rankly.local`
 
-不改 hosts 时可用端口转发：
+临时调试时也可用端口转发：
 
 ```bash
 kubectl -n geo-rankly port-forward svc/frontend 8088:80
diff --git a/deploy/k3s/apps.yaml b/deploy/k3s/apps.yaml
index 336e505..61c6ea7 100644
--- a/deploy/k3s/apps.yaml
+++ b/deploy/k3s/apps.yaml
@@ -440,12 +440,14 @@ metadata:
   labels:
     app.kubernetes.io/name: frontend
 spec:
+  type: NodePort
   selector:
     app.kubernetes.io/name: frontend
   ports:
     - name: http
       port: 80
       targetPort: http
+      nodePort: 30080
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -497,12 +499,14 @@ metadata:
   labels:
     app.kubernetes.io/name: ops-web
 spec:
+  type: NodePort
   selector:
     app.kubernetes.io/name: ops-web
   ports:
     - name: http
       port: 80
       targetPort: http
+      nodePort: 30081
 ---
 apiVersion: apps/v1
 kind: Deployment