diff --git a/ansible/roles/gateway/templates/nftables.conf.j2 b/ansible/roles/gateway/templates/nftables.conf.j2
index 977dfe9..f266a5a 100644
--- a/ansible/roles/gateway/templates/nftables.conf.j2
+++ b/ansible/roles/gateway/templates/nftables.conf.j2
@@ -44,8 +44,8 @@ table inet filter {
         # Hermes dashboard (poste admin uniquement)
         tcp dport 9119 ip saddr {{ hermes_dashboard_allowed_ip }} accept
 
-        # LiteLLM (localhost uniquement — pas d'accès réseau direct)
-        # Port 4000 non exposé ici intentionnellement
+        # LiteLLM proxy (pods k8s 10.42/16 + nœuds cluster)
+        tcp dport 4000 ip saddr { 192.168.10.0/24, 10.42.0.0/16 } accept
 
         log prefix "nft-drop: " drop
     }
diff --git a/ansible/roles/litellm/defaults/main.yml b/ansible/roles/litellm/defaults/main.yml
index 34a9f09..c9188dd 100644
--- a/ansible/roles/litellm/defaults/main.yml
+++ b/ansible/roles/litellm/defaults/main.yml
@@ -3,7 +3,7 @@ litellm_user: litellm
 litellm_venv: /opt/litellm/venv
 litellm_config_dir: /etc/litellm
 
-litellm_host: "127.0.0.1"   # loopback — Hermes est sur la même machine
+litellm_host: "0.0.0.0"     # toutes interfaces — pods k8s accèdent via 192.168.10.1:4000
 litellm_port: 4000
 litellm_master_key: "lm-studio"