diff --git a/ansible/roles/gateway/templates/nftables.conf.j2 b/ansible/roles/gateway/templates/nftables.conf.j2
index b6bbaf7..60091e0 100644
--- a/ansible/roles/gateway/templates/nftables.conf.j2
+++ b/ansible/roles/gateway/templates/nftables.conf.j2
@@ -34,6 +34,9 @@ table inet filter {
         # Hermes gateway (accès LAN domestique + cluster)
         tcp dport 8080 ip saddr { 192.168.1.0/24, 192.168.10.0/24 } accept
 
+        # Hermes dashboard (poste admin uniquement)
+        tcp dport 9119 ip saddr {{ hermes_dashboard_allowed_ip }} accept
+
         # LiteLLM (localhost uniquement — pas d'accès réseau direct)
         # Port 4000 non exposé ici intentionnellement
 
@@ -43,8 +46,13 @@ table inet filter {
     chain forward {
         type filter hook forward priority 0; policy drop;
 
-        # Forwarding LAN cluster → WAN
+        # Forwarding LAN cluster → WAN (NAT sortant)
         iif {{ lan_interface }} oif {{ wan_interface }} ct state new,established,related accept
+
+        # Forwarding LAN domestique → LAN cluster (accès admin depuis le poste perso)
+        iif {{ wan_interface }} oif {{ lan_interface }} ip saddr 192.168.1.0/24 ct state new,established,related accept
+
+        # Réponses WAN → cluster (connexions initiées depuis le cluster)
         iif {{ wan_interface }} oif {{ lan_interface }} ct state established,related accept
     }
 
diff --git a/ansible/roles/hermes_agent/defaults/main.yml b/ansible/roles/hermes_agent/defaults/main.yml
index b67ac22..94b94b5 100644
--- a/ansible/roles/hermes_agent/defaults/main.yml
+++ b/ansible/roles/hermes_agent/defaults/main.yml
@@ -10,3 +10,7 @@ hermes_context_length: 65536
 
 hermes_gateway_port: 8080
 hermes_gateway_host: "0.0.0.0"
+
+# Dashboard web
+hermes_dashboard_port: 9119
+hermes_dashboard_allowed_ip: "192.168.1.10"
diff --git a/ansible/roles/hermes_agent/handlers/main.yml b/ansible/roles/hermes_agent/handlers/main.yml
index 1cf0c3f..3b52729 100644
--- a/ansible/roles/hermes_agent/handlers/main.yml
+++ b/ansible/roles/hermes_agent/handlers/main.yml
@@ -7,3 +7,8 @@
   ansible.builtin.systemd:
     name: hermes-agent
     state: restarted
+
+- name: Restart hermes-dashboard
+  ansible.builtin.systemd:
+    name: hermes-dashboard
+    state: restarted
diff --git a/ansible/roles/hermes_agent/tasks/main.yml b/ansible/roles/hermes_agent/tasks/main.yml
index 6d3a1c7..bea9fd0 100644
--- a/ansible/roles/hermes_agent/tasks/main.yml
+++ b/ansible/roles/hermes_agent/tasks/main.yml
@@ -132,6 +132,24 @@
     daemon_reload: true
     state: started
 
+# --- Dashboard systemd ---
+
+- name: Deploy hermes-dashboard systemd service
+  ansible.builtin.template:
+    src: hermes-dashboard.service.j2
+    dest: /etc/systemd/system/hermes-dashboard.service
+    mode: '0644'
+  notify:
+    - Reload systemd
+    - Restart hermes-dashboard
+
+- name: Enable and start hermes-dashboard
+  ansible.builtin.systemd:
+    name: hermes-dashboard
+    enabled: true
+    daemon_reload: true
+    state: started
+
 # --- Wrapper global ---
 
 - name: Deploy hermes global wrapper (/usr/local/bin/hermes)
diff --git a/ansible/roles/hermes_agent/templates/hermes-dashboard.service.j2 b/ansible/roles/hermes_agent/templates/hermes-dashboard.service.j2
new file mode 100644
index 0000000..c609b8e
--- /dev/null
+++ b/ansible/roles/hermes_agent/templates/hermes-dashboard.service.j2
@@ -0,0 +1,24 @@
+[Unit]
+Description=Hermes Agent Web Dashboard
+After=hermes-agent.service
+Wants=hermes-agent.service
+
+[Service]
+User={{ hermes_user }}
+Group={{ hermes_user }}
+
+Environment=HOME={{ hermes_home }}
+Environment=HERMES_HOME={{ hermes_data_dir }}
+Environment=PATH={{ hermes_data_dir }}/node/bin:{{ hermes_data_dir }}/hermes-agent/venv/bin:/usr/local/bin:/usr/bin:/bin
+
+ExecStart={{ hermes_home }}/.local/bin/hermes dashboard --no-open --tui --insecure --host {{ ansible_host }} --port {{ hermes_dashboard_port }}
+
+Restart=on-failure
+RestartSec=10s
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=hermes-dashboard
+
+[Install]
+WantedBy=multi-user.target