diff --git a/k8s/kevisual.cn/ingress/apps-ingressroute.yaml b/k8s/kevisual.cn/ingress/apps-ingressroute.yaml
index 5c60aeb..05ead58 100644
--- a/k8s/kevisual.cn/ingress/apps-ingressroute.yaml
+++ b/k8s/kevisual.cn/ingress/apps-ingressroute.yaml
@@ -68,4 +68,24 @@ spec:
         - name: websocket-headers
   tls:
     certResolver: letsencrypt
----
\ No newline at end of file
+---
+# 通配符子域名支持 *.kevisual.cn (兜底规则)
+# apiVersion: traefik.io/v1alpha1
+# kind: IngressRoute
+# metadata:
+#   name: wildcard-kevisual-https
+#   namespace: default
+# spec:
+#   entryPoints:
+#     - websecure
+#   routes:
+#     - match: HostRegexp(`^[a-zA-Z0-9-]+\.kevisual\.cn$`)
+#       kind: Rule
+#       services:
+#         - name: kevisual-external
+#           port: 3005
+#           serversTransport: websocket-transport
+#       middlewares:
+#         - name: websocket-headers
+#   tls:
+#     certResolver: letsencrypt
\ No newline at end of file
diff --git a/k8s/kevisual.cn/ingress/match-kevisual.yaml b/k8s/kevisual.cn/ingress/match-kevisual.yaml
new file mode 100644
index 0000000..9db22a4
--- /dev/null
+++ b/k8s/kevisual.cn/ingress/match-kevisual.yaml
@@ -0,0 +1,20 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nfc-kevisual-https
+  namespace: default
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nfc.kevisual.cn`)
+      kind: Rule
+      services:
+        - name: kevisual-external
+          port: 3005
+          serversTransport: websocket-transport
+      middlewares:
+        - name: websocket-headers
+  tls:
+    certResolver: letsencrypt
+---
\ No newline at end of file