diff --git a/.env.example b/.env.example
index ada34f7..c65ca99 100644
--- a/.env.example
+++ b/.env.example
@@ -49,4 +49,4 @@ PGID=1000
 # 실제 KIS API 호출 및 AI 분석은 Windows PC에서 수행됩니다.
 
 # Windows AI Server (NAS 입장에서 바라본 Windows PC IP)
-WINDOWS_AI_SERVER_URL=http://192.168.0.5:8000
\ No newline at end of file
+WINDOWS_AI_SERVER_URL=http://192.168.45.59:8000
diff --git a/deployer/Dockerfile b/deployer/Dockerfile
index dad993c..bda16d3 100644
--- a/deployer/Dockerfile
+++ b/deployer/Dockerfile
@@ -5,12 +5,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     docker.io \
     && rm -rf /var/lib/apt/lists/*
 
+RUN groupadd -g 100 nasusers 2>/dev/null || true \
+    && groupadd -g 65540 dockerhost \
+    && useradd -u 1026 -g 100 -G 65540 -m deployer
+
 WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 COPY app.py /app/app.py
 
+USER deployer
+
 ENV PYTHONUNBUFFERED=1
 EXPOSE 9000
 CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "9000"]
diff --git a/nginx/default.conf b/nginx/default.conf
index 305c529..8631f11 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -119,6 +119,41 @@ server {
     proxy_pass http://backend:8000;
   }
 
+  # Fear & Greed Index (CNN 공개 API)
+  # 프로덕션 nginx에서는 아래 proxy_pass 추가 필요:
+  location /ext/feargreed {
+    proxy_pass https://production.dataviz.cnn.io/index/fearandgreed/graphdata;
+    proxy_set_header Host production.dataviz.cnn.io;
+  }
+
+  # VIX (CBOE 변동성 지수) — Yahoo Finance 공개 API
+  # 프로덕션 nginx에서는 아래 proxy_pass 추가 필요:
+  location /ext/vix {
+    proxy_pass https://query1.finance.yahoo.com/v8/finance/chart/%5EVIX?interval=1d&range=1d;
+    proxy_set_header Host query1.finance.yahoo.com;
+  }
+
+  # 미국 10년물 국채 금리 (^TNX) — Yahoo Finance
+  # 프로덕션 nginx 설정 필요:
+  location /ext/treasury {
+    proxy_pass https://query1.finance.yahoo.com/v8/finance/chart/%5ETNX?interval=1d&range=1d;
+    proxy_set_header Host query1.finance.yahoo.com;
+  }
+
+  # WTI 원유 선물 (CL=F) — Yahoo Finance
+  # 프로덕션 nginx 설정 필요:
+  location /ext/wti {
+    proxy_pass https://query1.finance.yahoo.com/v8/finance/chart/CL%3DF?interval=1d&range=1d;
+    proxy_set_header Host query1.finance.yahoo.com;
+  }
+
+  # Brent 원유 선물 (BZ=F) — Yahoo Finance
+  # 프로덕션 nginx 설정 필요:
+  location /ext/brent {
+    proxy_pass https://query1.finance.yahoo.com/v8/finance/chart/BZ%3DF?interval=1d&range=1d;
+    proxy_set_header Host query1.finance.yahoo.com;
+  }
+
   # webhook receiver (handle both /webhook and /webhook/)
   location = /webhook {
     proxy_http_version 1.1;
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 7e7c666..8b3068a 100644
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -44,21 +44,7 @@ rsync -a --delete \
 bash "$SRC/scripts/deploy-nas.sh"
 
 cd "$DST"
-docker-compose up -d --build backend travel-proxy stock-lab frontend
-
-# [Permission Fix]
-# deployer가 root로 돌면서 생성한 파일들의 소유권을 호스트 사용자로 변경
-# .env에 정의된 PUID:PGID가 있으면 사용, 없으면 1000:1000
-TARGET_UID=$(grep PUID .env | cut -d '=' -f2 || echo 1000)
-TARGET_GID=$(grep PGID .env | cut -d '=' -f2 || echo 1000)
-
-echo "Fixing permissions to $TARGET_UID:$TARGET_GID ..."
-chown -R "$TARGET_UID:$TARGET_GID" "$DST" || true
-chmod -R 755 "$DST" || true
-# Repo 쪽도 혹시 모르니
-if [ "$SRC" != "$DST" ]; then
-  chown -R "$TARGET_UID:$TARGET_GID" "$SRC" || true
-  chmod -R 755 "$SRC" || true
-fi
+docker-compose up -d --build backend travel-proxy stock-lab frontend deployer
+docker exec lotto-frontend nginx -s reload 2>/dev/null || true
 
 echo "DEPLOY_OK $TAG"