_: {
  # Athena (local AI): allow LAN access to the Hermes web dashboard.
  # Bound to 0.0.0.0:9119 in the athena docker stack; NixOS default-deny
  # firewall otherwise blocks inbound connections from other devices.
  networking.firewall.allowedTCPPorts = [
    9119 # athena hermes dashboard
  ];
}