diff --git a/internal/controller/maker/hsnet.go b/internal/controller/maker/hsnet.go
index 8a24b19..c3b3e56 100644
--- a/internal/controller/maker/hsnet.go
+++ b/internal/controller/maker/hsnet.go
@@ -242,9 +242,113 @@ tcp_mode_disable: false
 		return err
 	}
 
-	// todo upsert.sh
-	// todo /etc/yizhisec/token
-	// todo mkdir /mnt/huge
+	// upsert.sh script
+	const _upsert = `#!/bin/bash
+
+set -e
+
+echo "Starting hs-net deployment..."
+
+# 1. Copy token file
+echo "Copying token file..."
+mkdir -p /etc/yizhisec
+cp ../../configmap/token /etc/yizhisec/token
+echo "Token file copied successfully"
+
+# 2. Get local IP address
+echo "Detecting local IP address..."
+LocalIP=$(ip route get 1.1.1.1 | grep -oP 'src \K\S+')
+if [ -z "$LocalIP" ]; then
+    echo "Error: Failed to detect local IP address"
+    exit 1
+fi
+echo "Local IP detected: $LocalIP"
+
+# 3. Update /etc/hosts with required entries
+echo "Updating /etc/hosts..."
+for host in "hs-gateway-register-controller" "hs-gateway-controller" "mqtt.yizhisec.com"; do
+    if grep -q "$host" /etc/hosts; then
+        sed -i "/$host/d" /etc/hosts
+    fi
+    echo "$LocalIP $host" >> /etc/hosts
+    echo "Added: $LocalIP $host"
+done
+echo "/etc/hosts updated successfully"
+
+# 4. Replace __ip__ in server.conf
+echo "Updating server.conf..."
+sed -i "s/__ip__/$LocalIP/g" server.conf
+echo "server.conf updated successfully"
+
+# 5. Replace __ip__ in conf/server.conf
+echo "Updating conf/server.conf..."
+sed -i "s/__ip__/$LocalIP/g" conf/server.conf
+echo "conf/server.conf updated successfully"
+
+# 6. Create /mnt/huge directory
+echo "Creating /mnt/huge directory..."
+mkdir -p /mnt/huge
+echo "/mnt/huge directory created successfully"
+
+# 7. Create workspace directories
+echo "Creating workspace directories..."
+mkdir -p /yizhisec/hs_net/workspace/log
+mkdir -p /yizhisec/hs_net/conf
+echo "Workspace directories created successfully"
+
+# 8. Copy configuration files
+echo "Copying configuration files..."
+cp -r conf/* /yizhisec/hs_net/conf/
+echo "Configuration files copied successfully"
+
+# 9. Copy binaries based on CPU AVX support
+echo "Detecting CPU AVX support..."
+if grep -q avx /proc/cpuinfo; then
+    echo "AVX support detected, using server_aes"
+    cp server_aes /yizhisec/hs_net/server
+    chmod +x /yizhisec/hs_net/server
+    echo "server_aes copied to /yizhisec/hs_net/server with execute permission"
+else
+    echo "AVX not supported, using server"
+    cp server /yizhisec/hs_net/server
+    chmod +x /yizhisec/hs_net/server
+    echo "server copied to /yizhisec/hs_net/server with execute permission"
+fi
+echo "Binary copied successfully"
+
+# 10. Copy lastVersion.txt
+echo "Copying lastVersion.txt..."
+cp lastVersion.txt /yizhisec/hs_net/
+echo "lastVersion.txt copied successfully"
+
+# 11. Load container image
+echo "Loading hs-net container image..."
+k0s ctr -n hs-net images import hs-net.tar
+echo "Container image loaded successfully"
+
+# 12. Install and enable systemd service
+echo "Installing hs-net systemd service..."
+cp hs-net.service /etc/systemd/system/
+systemctl daemon-reload
+systemctl enable hs-net.service
+echo "hs-net service installed and enabled"
+
+# 13. Start the service
+echo "Starting hs-net service..."
+systemctl restart hs-net.service
+echo "hs-net service started successfully"
+
+echo "hs-net deployment completed successfully!"
+echo "You can check the service status with: systemctl status hs-net.service"
+`
+
+	// Write upsert.sh
+	logger.Debug("☑️ MakeHSNet: 写入 upsert.sh 脚本...")
+	if err = os.WriteFile(filepath.Join(workdir, "upsert.sh"), []byte(_upsert), 0755); err != nil {
+		logger.Debug("❌ MakeHSNet: 写入 upsert.sh 失败: %s", err.Error())
+		return err
+	}
+	logger.Debug("✅ MakeHSNet: 写入 upsert.sh 成功")
 
 	logger.Info("✅ MakeHSNet: 构建 hs-net 成功, workdir = %s", workdir)