diff --git a/backend/config-templates/nacos/rui-service-storage.yaml b/backend/config-templates/nacos/rui-service-storage.yaml
new file mode 100644
index 0000000..a8efe77
--- /dev/null
+++ b/backend/config-templates/nacos/rui-service-storage.yaml
@@ -0,0 +1,67 @@
+# rui-service-storage.yaml — 统一文件存储服务配置
+# Data ID: rui-service-storage.yaml
+# Group:   DEFAULT_GROUP
+# 推送到 Nacos 后必须按 docs/ai-skills/nacos-config-rules.md 验证
+
+# 服务端口：9400（独立部署）/ 9399（被 rui-service-starter 聚合时使用 starter 端口）
+server:
+  port: 9400
+
+# ============================================================================
+# 统一文件存储配置（rui.file.*）
+# 业务配置仅放本服务，公共/框架配置已由 application-template.yml 覆盖
+# ============================================================================
+rui:
+  file:
+    # 当前激活的存储后端：aliyun / tencent / local
+    active: local
+
+    # 默认文件大小上限（按 bizType 未配置时使用）
+    default-max-size: 10MB
+
+    # 各业务类型的白名单与大小限制，key = FileBizType 枚举值
+    biz-types:
+      # 通用文件（无业务白名单限制）
+      COMMON:
+        max-size: 10MB
+        allowed-extensions: []                  # 空 = 不限
+
+      # 第三方应用证书（pem/crt/key/p12）
+      SYS_APP_CERT:
+        max-size: 5MB
+        allowed-extensions: [pem, crt, key, p12]
+
+      # 用户头像
+      USER_AVATAR:
+        max-size: 2MB
+        allowed-extensions: [jpg, jpeg, png, webp]
+
+      # CMS 轮播图
+      CMS_BANNER:
+        max-size: 5MB
+        allowed-extensions: [jpg, jpeg, png, webp, gif]
+
+    # 阿里云 OSS 后端
+    aliyun:
+      enabled: false
+      endpoint: oss-cn-shanghai.aliyuncs.com
+      access-key: ${ALIYUN_AK:}
+      secret-key: ${ALIYUN_SK:}
+      bucket: rui-storage
+      url-prefix: https://rui-storage.oss-cn-shanghai.aliyuncs.com
+      base-path: cert/
+
+    # 腾讯云 COS 后端
+    tencent:
+      enabled: false
+      secret-id: ${TENCENT_SID:}
+      secret-key: ${TENCENT_SKEY:}
+      region: ap-shanghai
+      bucket: rui-storage-1300000000
+      url-prefix: https://rui-storage-1300000000.cos.ap-shanghai.myqcloud.com
+      base-path: cert/
+
+    # 本地存储后端（默认/兜底）
+    local:
+      base-path: ${user.home}/.rui/upload/
+      url-prefix: /api/storage/local/