diff --git a/Makefile b/Makefile
index 7331859..83b149c 100644
--- a/Makefile
+++ b/Makefile
@@ -168,7 +168,24 @@ clean:
 	rm -f $(OBJS) $(TARGET)
 	rm -f $(UNIT_TEST_OBJS) $(UNIT_TEST_BINS)
 
+# 安装 systemd 服务文件
+install-systemd: cocoon.service
+	install -d /etc/cocoon
+	install -d /var/log/cocoon
+	install -d /var/www
+	install -m 644 cocoon.service /etc/systemd/system/
+	@echo "[Cocoon] systemd 服务已安装"
+	@echo "  1. 编辑 /etc/cocoon/cocoon.json 配置服务器"
+	@echo "  2. 运行 'systemctl daemon-reload' 重新加载 systemd"
+	@echo "  3. 运行 'systemctl enable --now cocoon' 启动并启用服务"
+
+# 卸载 systemd 服务
+uninstall-systemd:
+	systemctl disable cocoon 2>/dev/null || true
+	rm -f /etc/systemd/system/cocoon.service
+	@echo "[Cocoon] systemd 服务已卸载"
+
 # 重新构建
 rebuild: clean all
 
-.PHONY: all clean install uninstall rebuild deps build-all test integration-test test-all bench unit-test
+.PHONY: all clean install uninstall rebuild deps build-all test integration-test test-all bench unit-test install-systemd uninstall-systemd
diff --git a/cocoon.service b/cocoon.service
new file mode 100644
index 0000000..4882b83
--- /dev/null
+++ b/cocoon.service
@@ -0,0 +1,45 @@
+[Unit]
+Description=Cocoon - 基于协程的轻量级 Web 服务器
+Documentation=https://github.com/xfy911/cocoon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/cocoon -c /etc/cocoon/cocoon.json
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=5
+
+# 工作目录（静态资源根目录的基准路径）
+WorkingDirectory=/var/www
+
+# 日志输出到 journal
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=cocoon
+
+# 安全加固
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/log/cocoon /var/www /etc/cocoon
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+
+# 网络能力（需要绑定端口）
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# 资源限制
+LimitNOFILE=65535
+LimitNPROC=4096
+
+[Install]
+WantedBy=multi-user.target