diff --git a/backend/controllers/setup.go b/backend/controllers/setup.go
index 75190cd..fcb1b78 100644
--- a/backend/controllers/setup.go
+++ b/backend/controllers/setup.go
@@ -11,6 +11,7 @@ import (
 	"github.com/spf13/cast"
 	"io"
 	"net/http"
+	"strconv"
 	"strings"
 )
 
@@ -166,15 +167,26 @@ func Setup(ctx *context.Context, w http.ResponseWriter, req *http.Request) {
 			return
 		}
 		response.NewSuccessResponse(map[string]any{
-			"smtp_domain": smtpDomain,
-			"web_domain":  webDomain,
-			"domains":     domains,
+			"smtp_domain":       smtpDomain,
+			"web_domain":        webDomain,
+			"domains":           domains,
+			"public_https_port": config.ResolvePublicHTTPSPort(config.CurrentHTTPConfig()),
 		}).FPrint(w)
 		return
 	}
 
 	if reqData["step"] == "domain" && reqData["action"] == "set" {
-		err := setup.SetDomainSettings(cast.ToString(reqData["smtp_domain"]), cast.ToString(reqData["web_domain"]), reqData["multi_domain"])
+		var err error
+		if value := strings.TrimSpace(reqData["public_https_port"]); value != "" {
+			port, parseErr := strconv.Atoi(value)
+			if parseErr != nil || port < 1 || port > 65535 {
+				response.NewErrorResponse(response.ParamsError, "公网 HTTPS 端口必须是 1 到 65535 的整数", "").FPrint(w)
+				return
+			}
+			err = setup.SetDomainSettingsWithPublicHTTPSPort(reqData["smtp_domain"], reqData["web_domain"], reqData["multi_domain"], port)
+		} else {
+			err = setup.SetDomainSettings(reqData["smtp_domain"], reqData["web_domain"], reqData["multi_domain"])
+		}
 		if err != nil {
 			writeSetupError(ctx, w, err)
 			return
diff --git a/backend/services/setup/domain.go b/backend/services/setup/domain.go
index 4ad289e..173d01b 100644
--- a/backend/services/setup/domain.go
+++ b/backend/services/setup/domain.go
@@ -1,6 +1,8 @@
 package setup
 
 import (
+	"fmt"
+
 	"git.pcux.cn/xuans/Smail/config"
 	"git.pcux.cn/xuans/Smail/utils/array"
 	"git.pcux.cn/xuans/Smail/utils/errors"
@@ -17,6 +19,18 @@ func GetDomainSettings() (string, string, []string, error) {
 }
 
 func SetDomainSettings(smtpDomain, webDomain, multiDomains string) error {
+	return setDomainSettings(smtpDomain, webDomain, multiDomains, nil)
+}
+
+// SetDomainSettingsWithPublicHTTPSPort 同时保存公网入口端口，不改变内部监听端口。
+func SetDomainSettingsWithPublicHTTPSPort(smtpDomain, webDomain, multiDomains string, publicHTTPSPort int) error {
+	if publicHTTPSPort < 1 || publicHTTPSPort > 65535 {
+		return fmt.Errorf("公网 HTTPS 端口必须是 1 到 65535 的整数")
+	}
+	return setDomainSettings(smtpDomain, webDomain, multiDomains, &publicHTTPSPort)
+}
+
+func setDomainSettings(smtpDomain, webDomain, multiDomains string, publicHTTPSPort *int) error {
 	configData, err := config.ReadConfig()
 	if err != nil {
 		return errors.Wrap(err)
@@ -43,6 +57,9 @@ func SetDomainSettings(smtpDomain, webDomain, multiDomains string) error {
 
 	configData.Domain = smtpDomain
 	configData.WebDomain = webDomain
+	if publicHTTPSPort != nil {
+		configData.PublicHTTPSPort = *publicHTTPSPort
+	}
 
 	// 检查域名是否指向本机 todo
 
diff --git a/frontend/src/views/Setup/Setup.js b/frontend/src/views/Setup/Setup.js
index 62b1036..ece9f8a 100644
--- a/frontend/src/views/Setup/Setup.js
+++ b/frontend/src/views/Setup/Setup.js
@@ -86,6 +86,7 @@ export function usePage() {
   const domainSettings = reactive({
     "web_domain": "",
     "smtp_domain": "",
+    "public_https_port": "",
     "multi_domain": []
   })
 
@@ -208,6 +209,7 @@ export function usePage() {
       assertSetupSuccess(res)
       domainSettings.web_domain = res.data.web_domain;
       domainSettings.smtp_domain = res.data.smtp_domain;
+      domainSettings.public_https_port = String(res.data.public_https_port || "")
       domainSettings.multi_domain = Array.isArray(res.data.domains) ? res.data.domains : []
       return res
     }).catch((error) => {
@@ -512,10 +514,16 @@ export function usePage() {
   }
 
   const setDomainConfig = () => {
+    const publicHTTPSPort = String(domainSettings.public_https_port || "").trim()
+    if (publicHTTPSPort && (!/^[1-9]\d{0,4}$/.test(publicHTTPSPort) || Number(publicHTTPSPort) > 65535)) {
+      ElMessage.error("公网 HTTPS 端口必须是 1 到 65535 的整数")
+      return
+    }
     return setupRequest({
       "action": "set",
       "step": "domain",
       "web_domain": domainSettings.web_domain,
+      "public_https_port": publicHTTPSPort,
       "smtp_domain": domainSettings.smtp_domain,
       "multi_domain": domainSettings.multi_domain.join(",")
     }).then((res) => {
diff --git a/frontend/src/views/Setup/Setup.vue b/frontend/src/views/Setup/Setup.vue
index 2d3e2e4..1dc0f04 100644
--- a/frontend/src/views/Setup/Setup.vue
+++ b/frontend/src/views/Setup/Setup.vue
@@ -161,6 +161,18 @@
             <el-input placeholder="请输入 Web 管理域名" v-model="domainSettings.web_domain"></el-input>
           </el-form-item>
 
+          <el-form-item label="公网 HTTPS 端口">
+            <el-input
+              v-model="domainSettings.public_https_port"
+              inputmode="numeric"
+              maxlength="5"
+              placeholder="留空时使用当前部署的默认端口"
+            ></el-input>
+            <p class="field-hint">
+              填写浏览器访问后台使用的端口。Nginx 对外提供标准 HTTPS 时填写 443；直连部署填写实际 HTTPS 端口。此设置不会改变 Smail 内部监听端口。
+            </p>
+          </el-form-item>
+
           <el-form-item :label="lang.multi_domain_setting">
                         <span>{{ lang.multi_domain_setting_desc }}
                           <el-button @click="addDomain" size="small"