diff --git a/.env.example b/.env.example
index 493d29a9f..7c774204a 100644
--- a/.env.example
+++ b/.env.example
@@ -5,6 +5,9 @@ CANVAS_ALLOW_PRIVATE_UPSTREAMS=false
 # 多个主机使用英文逗号分隔，例如：gateway.internal,192.168.1.10
 CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS=
 CANVAS_CORS_ORIGINS=http://localhost:3000
+# 服务器对模型上游可访问的地址：本地存储的短时签名链接（Agent 看图、生成任务参考图）由它拼出，
+# 内网部署还要把该主机放进 CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS。留空则本地存储无法签出链接。
+CANVAS_PUBLIC_BASE_URL=
 # 启用服务商插件系统以支持特定服务的模型发现（如阿里云百炼的视频生成模型）
 # 设置为 true 启用插件机制，false 使用传统方式（默认：false）
 ENABLE_PROVIDER_PLUGINS=false
diff --git a/docker-compose.deploy.yml b/docker-compose.deploy.yml
index cfe4d3fe3..cc4327256 100644
--- a/docker-compose.deploy.yml
+++ b/docker-compose.deploy.yml
@@ -53,6 +53,7 @@ services:
       CANVAS_ALLOW_PRIVATE_UPSTREAMS: ${CANVAS_ALLOW_PRIVATE_UPSTREAMS:-false}
       CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS: ${CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS:-}
       CANVAS_CORS_ORIGINS: ${CANVAS_CORS_ORIGINS:-}
+      CANVAS_PUBLIC_BASE_URL: ${CANVAS_PUBLIC_BASE_URL:-}
       CANVAS_UPDATER_SOCKET: /run/open-ai-canvas-updater/updater.sock
       CANVAS_UPDATER_TOKEN: ${CANVAS_UPDATER_TOKEN:-}
       GIN_MODE: release
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index eddb70684..fcf16dc56 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -26,6 +26,8 @@ services:
       CANVAS_ALLOW_PRIVATE_UPSTREAMS: ${CANVAS_ALLOW_PRIVATE_UPSTREAMS:-false}
       CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS: ${CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS:-}
       CANVAS_CORS_ORIGINS: ${CANVAS_CORS_ORIGINS:-http://localhost:3000}
+      # 服务器访问地址：Agent 看图与生成参考图都靠它签发上游可取到的短时链接。
+      CANVAS_PUBLIC_BASE_URL: ${CANVAS_PUBLIC_BASE_URL:-}
       GIN_MODE: debug
     volumes:
       - type: bind
diff --git a/docker-compose.local.yml b/docker-compose.local.yml
index e77cadb8e..7dd0a5504 100644
--- a/docker-compose.local.yml
+++ b/docker-compose.local.yml
@@ -19,6 +19,8 @@ services:
       CANVAS_ALLOW_PRIVATE_UPSTREAMS: ${CANVAS_ALLOW_PRIVATE_UPSTREAMS:-false}
       CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS: ${CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS:-}
       CANVAS_CORS_ORIGINS: ${CANVAS_CORS_ORIGINS:-http://localhost:3000}
+      # 服务器访问地址：Agent 看图与生成参考图都靠它签发上游可取到的短时链接。
+      CANVAS_PUBLIC_BASE_URL: ${CANVAS_PUBLIC_BASE_URL:-}
       ENABLE_PROVIDER_PLUGINS: ${ENABLE_PROVIDER_PLUGINS:-false}
       GIN_MODE: release
     volumes:
diff --git a/docker-compose.server.yml b/docker-compose.server.yml
index 6ec284cf5..24ee0c1e9 100644
--- a/docker-compose.server.yml
+++ b/docker-compose.server.yml
@@ -67,6 +67,7 @@ services:
       CANVAS_ALLOW_PRIVATE_UPSTREAMS: ${CANVAS_ALLOW_PRIVATE_UPSTREAMS:-false}
       CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS: ${CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS:-}
       CANVAS_CORS_ORIGINS: ${CANVAS_CORS_ORIGINS:-*}
+      CANVAS_PUBLIC_BASE_URL: ${CANVAS_PUBLIC_BASE_URL:-}
       GIN_MODE: release
     volumes:
       - ${CANVAS_DATA_PATH:-./data}:/data
diff --git a/docker-compose.yml b/docker-compose.yml
index 7fd36c5f4..763cc847a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,6 +19,8 @@ services:
       CANVAS_ALLOW_PRIVATE_UPSTREAMS: ${CANVAS_ALLOW_PRIVATE_UPSTREAMS:-false}
       CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS: ${CANVAS_ALLOWED_PRIVATE_UPSTREAM_HOSTS:-}
       CANVAS_CORS_ORIGINS: ${CANVAS_CORS_ORIGINS:-http://localhost:3000}
+      # 服务器访问地址：Agent 看图与生成参考图都靠它签发上游可取到的短时链接。
+      CANVAS_PUBLIC_BASE_URL: ${CANVAS_PUBLIC_BASE_URL:-}
       GIN_MODE: release
     volumes:
       - backend-data:/data