diff --git a/install.sh b/install.sh
index 06ee50e..579512c 100644
--- a/install.sh
+++ b/install.sh
@@ -131,9 +131,30 @@ deploy_files() {
     cp -rf "${BUILD_DIR}/templates" "${INSTALL_DIR}/templates"
     cp -rf "${BUILD_DIR}/static" "${INSTALL_DIR}/static"
 
-    # 复制配置文件（仅当配置目录下不存在时）
+    # 复制配置文件（仅当配置目录下不存在时预生成）
     if [[ ! -f "${CONFIG_DIR}/config.toml" ]]; then
-        info "配置文件不存在，程序首次启动将自动生成默认配置"
+        info "预生成默认配置文件 ..."
+        cat > "${CONFIG_DIR}/config.toml" <<TMPL
+[data]
+dir = '${DATA_DIR}'
+
+[database]
+type = 'sqlite'
+path = 'portal.db'
+
+[database.mysql]
+host = '127.0.0.1'
+port = 3306
+user = 'root'
+password = ''
+dbname = 'portal_page'
+
+[server]
+addr = ':8080'
+unix = '${INSTALL_DIR}/server.sock'
+TMPL
+        chown "${SERVICE_USER}:${SERVICE_USER}" "${CONFIG_DIR}/config.toml"
+        ok "默认配置文件已生成: ${CONFIG_DIR}/config.toml"
     else
         info "保留现有配置文件: ${CONFIG_DIR}/config.toml"
     fi
@@ -172,9 +193,9 @@ SyslogIdentifier=${SERVICE_NAME}
 
 # 安全加固
 NoNewPrivileges=true
-ProtectSystem=strict
+ProtectSystem=full
 ProtectHome=true
-ReadWritePaths=${DATA_DIR} ${CONFIG_DIR} ${LOG_DIR} ${PID_DIR} ${INSTALL_DIR}/templates ${INSTALL_DIR}/static
+ReadWritePaths=${DATA_DIR} ${CONFIG_DIR} ${LOG_DIR} ${PID_DIR} ${INSTALL_DIR}
 
 # 环境变量
 Environment=GIN_MODE=release